fix(strix): 교차 저장소 토큰과 실행 권한 정규화 - #574
Merged
Merged
Conversation
seonghobae
changed the title
Contributor
Author
중앙 부트스트랩 검토 영수증Current head
따라서 실제 보안 finding을 우회하는 것이 아니라, 동일 fail-closed 검사를 유지하면서 중앙 required-workflow self-bootstrap 교착을 해소하는 변경으로 승인합니다. 병합 후 downstream current-head Strix를 새 중앙 main에서 다시 실행해 결과를 재검증합니다. |
github-project-automation
Bot
moved this from In Progress
to Done
in naruon Platform Roadmap
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
실증 원인
codec-carver#250의 기본 브랜치
repository_dispatch실행 29517123708에서 두 번째 중앙 결함이 드러났습니다. dispatch는 중앙.github에서 실행되므로github.token이 대상 PR을 읽지 못해STRIX_TARGET_PATH=__PR_SCOPE__ requires PR scoping으로 종료했습니다.또한 #570의
umask 022는 한 실행에서는 통과했지만, 후속 PR 실행 29517654720에서 pip가 기존 콘솔 스크립트 모드를 보존해 동일한 group-writable 오류가 재발했습니다. 따라서 생성 기본값뿐 아니라 해시 전 실제 산출물의 권한도 정규화해야 합니다.수정
pull_request_target은 기존 대상 저장소github.token동작을 유지합니다.umask 022뒤에도chmod go-w -- "$strix_executable"를 적용하고, 그 다음 SHA-256을 계산합니다.로컬 검증
python3 -m pytest tests/test_required_workflow_queue_contract.py -q: 47 passedactionlint .github/workflows/strix.yml: passbash -n scripts/ci/test_strix_quick_gate.sh: passgit diff --check: passCloses #573
Closes #569
Related: #571
Unblocks: ContextualWisdomLab/codec-carver#250
스케줄러 신뢰 dispatch
pull_request_target에서 생성된 skipped/old job을 rerun하지 않습니다.repository_dispatch만 사용해, PR이 privileged workflow 실행 경로를 선택하지 못하도록 합니다.tests/test_pr_review_merge_scheduler.py와 required-workflow 계약 테스트가 이 동작을 함께 고정합니다.통합 재검증 (2026-07-17)
python3 -m pytest tests/test_required_workflow_queue_contract.py tests/test_pr_review_merge_scheduler.py -q: 151 passedactionlint .github/workflows/strix.yml .github/workflows/pr-review-merge-scheduler.yml: passbash -n scripts/ci/test_strix_quick_gate.sh: passgit diff --check: pass