ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-28 13:26:04 -06:00
Code Issues Packages Projects Releases Wiki Activity

ci: remove security guard rollout floor

Browse Source
This commit is contained in:
joshavant
2026-07-01 20:27:38 -05:00
parent 0cdce79221
commit 7fa26e088d
2 changed files with 4 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/security-sensitive-guard.yml
-59
View File
@@ -9,11 +9,6 @@ permissions:
pull-requests: write
issues: write
env:
# Temporary rollout bridge for PRs opened before this workflow's script landed.
# Remove once the pre-rollout PR set has drained.
OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA: 5d9c010628ea4de3492a12e32f9be5b8c5dfa9ed
concurrency:
group: security-sensitive-guard-${{ github.event.pull_request.number }}
cancel-in-progress: true
@@ -24,40 +19,13 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Check security-sensitive guard rollout eligibility
id: rollout
env:
GH_TOKEN: ${{ github.token }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: |
status="$(
gh api \
"repos/${GITHUB_REPOSITORY}/compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}" \
--jq '.status'
)"
case "$status" in
ahead|identical)
echo "ready=true" >> "$GITHUB_OUTPUT"
;;
behind|diverged)
echo "ready=false" >> "$GITHUB_OUTPUT"
echo "::notice::Skipping security-sensitive guard for a PR base that predates rollout commit ${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}."
;;
*)
echo "Unexpected compare status for security-sensitive guard rollout: $status" >&2
exit 1
;;
esac
- name: Check out trusted base workflow scripts
if: steps.rollout.outputs.ready == 'true'
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ github.workflow_sha }}
persist-credentials: false
- name: Detect security-sensitive changes
if: steps.rollout.outputs.ready == 'true'
env:
GITHUB_TOKEN: ${{ github.token }}
OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant
@@ -72,40 +40,13 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 5
steps:
- name: Check security-sensitive guard rollout eligibility
id: rollout
env:
GH_TOKEN: ${{ github.token }}
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
run: |
status="$(
gh api \
"repos/${GITHUB_REPOSITORY}/compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}" \
--jq '.status'
)"
case "$status" in
ahead|identical)
echo "ready=true" >> "$GITHUB_OUTPUT"
;;
behind|diverged)
echo "ready=false" >> "$GITHUB_OUTPUT"
echo "::notice::Skipping security-sensitive guard for a PR base that predates rollout commit ${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}."
;;
*)
echo "Unexpected compare status for security-sensitive guard rollout: $status" >&2
exit 1
;;
esac
- name: Check out trusted base workflow scripts
if: steps.rollout.outputs.ready == 'true'
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
ref: ${{ github.workflow_sha }}
persist-credentials: false
- name: Enforce security-sensitive guard
if: steps.rollout.outputs.ready == 'true'
env:
GITHUB_TOKEN: ${{ github.token }}
OPENCLAW_SECURITY_APPROVERS: vincentkoc,steipete,joshavant
test/scripts/security-sensitive-guard-workflow.test.ts
+4 -31
View File
@@ -8,8 +8,6 @@ const CODEOWNERS = ".github/CODEOWNERS";
type WorkflowStep = {
env?: Record<string, string>;
id?: string;
if?: string;
name?: string;
run?: string;
uses?: string;
@@ -24,7 +22,6 @@ type WorkflowJob = {
};
type Workflow = {
env?: Record<string, string>;
jobs?: Record<string, WorkflowJob>;
name?: string;
permissions?: Record<string, string>;
@@ -80,40 +77,16 @@ describe("security-sensitive guard workflow", () => {
const checkout = steps.find((step) => step.uses?.startsWith("actions/checkout@"));
expect(checkout?.uses).toBe("actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd");
expect(checkout?.if).toBe("steps.rollout.outputs.ready == 'true'");
expect(checkout?.with?.ref).toBe("${{ github.workflow_sha }}");
expect(checkout?.with?.ref).not.toBe("${{ github.event.pull_request.base.sha }}");
expect(checkout?.with?.["persist-credentials"]).toBe(false);
expect(steps.at(-1)?.run).toBe("node scripts/github/security-sensitive-guard.mjs");
expect(steps.at(-1)?.if).toBe("steps.rollout.outputs.ready == 'true'");
}
});
it("temporarily skips PR bases that predate the guard rollout commit", () => {
const parsed = readWorkflow();
expect(parsed.env?.OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA).toBe(
"5d9c010628ea4de3492a12e32f9be5b8c5dfa9ed",
);
const jobs = parsed.jobs ?? {};
for (const jobName of ["security-sensitive-guard-detect", "security-sensitive-guard"]) {
const steps = jobs[jobName]?.steps ?? [];
const rollout = steps.find(
(step) => step.name === "Check security-sensitive guard rollout eligibility",
);
expect(rollout?.id).toBe("rollout");
expect(rollout?.env?.GH_TOKEN).toBe("${{ github.token }}");
expect(rollout?.env?.PR_BASE_SHA).toBe("${{ github.event.pull_request.base.sha }}");
expect(rollout?.run).toContain(
"compare/${OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA}...${PR_BASE_SHA}",
);
expect(rollout?.run).toContain("ahead|identical)");
expect(rollout?.run).toContain("behind|diverged)");
expect(rollout?.run).toContain("ready=false");
expect(rollout?.run).toContain("predates rollout commit");
}
expect(workflow).not.toContain("OPENCLAW_SECURITY_SENSITIVE_GUARD_ROLLOUT_SHA");
expect(workflow).not.toContain("Check security-sensitive guard rollout eligibility");
expect(workflow).not.toContain("steps.rollout.outputs.ready");
expect(workflow).not.toContain("/compare/");
});
it("keeps detection separate from the final required check", () => {