Repository navigation
ci: add validated reusable central security ingress - #2651
seonghobae wants to merge 1 commit into
Conversation
|
Warning Review limit reachedYou've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Next included review available in 44 minutes. View limit details
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
.github/workflows/security-scan.yml— GitHub Actions review jobtests/test_security_bundle_reusable_entrypoint.py— regression suite
Changed behavior
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_security_bundle_reusable_entrypoint.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_security_bundle_reusable_entrypoint.py"]
R2 --> V2["targeted test run"]
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
31a9aefd8d075295c2ad09ac2a9a71949810c9e8 - Workflow run: 38511858474
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow: security-scan.yml"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow: security-scan.yml"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Test: test_security_bundle_reusable_entrypoint.py"]
S2 --> I2["regression suite"]
I2 --> R2["Review risk: Test: test_security_bundle_reusable_entrypoint.py"]
R2 --> V2["targeted test run"]
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
This branch has not been deployed
1 participant
Adds workflow_call to the existing central security bundle with an unprivileged PR identity admission before scanner checkout. Preserves scanner bodies, permissions, hard/soft gates, scope and valid closed-PR behavior. Invalid event/repository/PR/SHA contexts fail closed.\n\nActual verification: invalid-context RED 7 failures plus 3 controls; successor source cohort 23 passed; independent supplier-only whole-source review PASS with 18 focused cases; actionlint exit 0 with shellcheck/pyflakes disabled; byte preservation and diff check passed. Reviewed commit 31a9aef.\n\nUnfinished: consumer immutable pin/caller permissions, per-scanner exact required-context binding, actual isolated runner/cleanjob Actions execution, literal-auto AI review and formal independent App approval. Scope-skipped jobs and soft Scorecard posture are not fabricated scanner PASS. No runner/protection/key/deployment changes. Inherited normal-PR Gitleaks helper trust risk is outside this source slice and not claimed repaired. Original SRC2 source cap and runtime/scientific acceptance are unchanged.