fix(review): authorize private target PR lookup with Noema App - #85
fix(review): authorize private target PR lookup with Noema App#85seonghobae wants to merge 5 commits into
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review the unchanged exact head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Exact HEAD and changed files =='
git rev-parse HEAD
git status --short
git diff --name-status 9adb784902cae19a150146a8fadd6a0491f67814..8d5d62437a944e8c1e9eda4a2b695edb3b5678e3
printf '%s\n' '== Candidate workflow, test, and documentation files =='
fd -HI 'central_review|central-review|test_central_review_workflow|private-target-review-auth|CHANGELOG' . \
-E .git -E node_modules | sort
printf '%s\n' '== Workflow and test outlines =='
for f in $(fd -HI 'central-review.yml|test_central_review_workflow.py' . -E .git -E node_modules); do
echo "--- $f"
ast-grep outline "$f" --items all || true
done
printf '%s\n' '== Target API calls and token-related assignments =='
rg -n -i -C 5 \
'(repos/\$\{TARGET_REPOSITORY\}/pulls|/pulls/\$\{PR_NUMBER\}|gh\s+api|GH_TOKEN|github\.token|create-github-app-token|app[_ -]?token|TARGET_REPOSITORY|PR_NUMBER)' \
.github reviewer \
-g '*.yml' -g '*.yaml' -g '*.py' 2>/dev/null || true
printf '%s\n' '== Pull request metadata and current checks =='
gh pr view 85 --repo ContextualWisdomLab/noema \
--json number,headRefOid,baseRefOid,isDraft,reviewDecision,reviews,statusCheckRollup \
--jq '{number,headRefOid,baseRefOid,isDraft,reviewDecision,reviews: [.reviews[] | {author: .author.login, state}], checks: [.statusCheckRollup[] | {name, status, conclusion, headSha}]}' || trueLength of output: 95187 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Exact production and test diffs =='
git diff --unified=80 \
9adb784902cae19a150146a8fadd6a0491f67814..8d5d62437a944e8c1e9eda4a2b695edb3b5678e3 \
-- .github/workflows/central-review.yml reviewer/tests/test_central_review_workflow.py
printf '%s\n' '== Authentication bootstrap and evidence collection =='
sed -n '19,275p' .github/workflows/central-review.yml
printf '%s\n' '== Attestation and publication binding =='
sed -n '275,475p' .github/workflows/central-review.yml
printf '%s\n' '== Focused regression tests =='
cat -n reviewer/tests/test_central_review_workflow.py
printf '%s\n' '== All central-review gh API calls with step, environment, and source range =='
python3 - <<'PY'
from pathlib import Path
lines = Path(".github/workflows/central-review.yml").read_text(encoding="utf-8").splitlines()
for index, line in enumerate(lines):
if "gh api" not in line:
continue
start = index
while start > 0 and not lines[start].startswith(" - name:"):
start -= 1
end = index
while end + 1 < len(lines) and not lines[end + 1].startswith(" - name:"):
end += 1
print(f"\n--- lines {start + 1}-{end + 1}: {lines[start].strip()}")
print("\n".join(f"{number + 1:4}: {lines[number]}" for number in range(start, end + 1)))
PY
printf '%s\n' '== Python GitHub API entry points and environment token use =='
ast-grep outline reviewer/noema_reviewer/github_io.py --items all
rg -n -C 4 '(os\.environ|GH_TOKEN|GITHUB_TOKEN|subprocess\.run|default_runner|gh[" ]*,[" ]*"api")' \
reviewer/noema_reviewer/github_io.pyLength of output: 60857 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== Redaction-safe central-review credential and target-call inventory =='
python3 - <<'PY'
from pathlib import Path
lines = Path(".github/workflows/central-review.yml").read_text(encoding="utf-8").splitlines()
steps = []
current = None
for number, line in enumerate(lines, 1):
if line.startswith(" - name:"):
if current:
steps.append(current)
current = {"name": line.split(":", 1)[1].strip(), "start": number, "lines": []}
if current:
current["lines"].append(line)
if current:
steps.append(current)
for step in steps:
text = "\n".join(step["lines"])
target_refs = (
"TARGET_REPOSITORY" in text
or "target-source" in text
or "needs.collect_evidence.outputs.repository_name" in text
)
api_call = "gh api" in text or "gh attestation" in text or "fetch_manifest(" in text
if target_refs or api_call:
print(
f'{step["start"]:>4} {step["name"]} | '
f'target_ref={target_refs} gh_api={"gh api" in text} '
f'gh_attestation={"gh attestation" in text} fetch_manifest={"fetch_manifest(" in text} '
f'read_app_token={"steps.noema_read_app.outputs.token" in text} '
f'write_app_token={"steps.noema_write_app.outputs.token" in text} '
f'workflow_token={"github.token" in text}'
)
PY
printf '%s\n' '== Every GitHub CLI invocation in reviewer I/O =='
rg -n -C 6 '"gh"|gh\s+api|graphql|GITHUB_TOKEN|GH_TOKEN' reviewer/noema_reviewer/github_io.py
printf '%s\n' '== Manifest collection and publication tail =='
sed -n '231,475p' .github/workflows/central-review.yml
printf '%s\n' '== Static integrity checks =='
git diff --check 9adb784902cae19a150146a8fadd6a0491f67814..8d5d62437a944e8c1e9eda4a2b695edb3b5678e3
git diff --numstat 9adb784902cae19a150146a8fadd6a0491f67814..8d5d62437a944e8c1e9eda4a2b695edb3b5678e3
git status --shortLength of output: 22492
This is static diagnostic evidence. It does not prove the Noema App installation can read a private target repository. The required live private-target dispatch remains necessary. The PR is also still a draft, and current metadata reports a completed failing You are interacting with an AI system. |
|
Superseded by clean protected-main successor #92 after #76 integrated. #92 starts from protected |
1 participant
Purpose
Repair the central reviewer’s cross-repository trust bootstrap so private target repositories are supported without widening authority. GitHub documents the automatically generated
GITHUB_TOKENas repository-scoped to the repository containing the workflow; the previouscentral-review.ymlused that Noema-repository token for the first target PR lookup before minting the target-scoped Noema App token.Exact implementation
Freshly revalidated source identity:
main; live/base tip9adb784902cae19a150146a8fadd6a0491f67814.fix/private-target-review-auth.8d5d62437a944e8c1e9eda4a2b695edb3b5678e3.The evidence-collection job now orders the trust bootstrap as:
The target identifier step performs no target-state GitHub API request and has no
GH_TOKEN. The first liverepos/${TARGET_REPOSITORY}/pulls/${PR_NUMBER}read uses${{ steps.noema_read_app.outputs.token }}. Downstream evidence collection already uses the same scoped App token, so this removes a credential-scope inconsistency rather than introducing another credential family.No merge, release, deployment, contents-write, or broader publication authority is added.
Test-first lineage
01d4f69c0c98c8aa95c79afe0dd8ac8835a09769: test-only contract requiring target validation → repository-scoped App token → authenticated live PR binding → checkout. The pre-fix workflow visibly violated this ordering and used${{ github.token }}in the live target-binding step. GitHub-hostedci,reviewer-ci, andSecurity Scanremained queued without runner assignment and were cancelled by concurrency when the branch advanced, so no executed RED run is falsely claimed.a2084c9ce7c9c523227c5dad93162c1c8a4ba8f1: minimal workflow repair moving live target-state access behind the existing read-only target-scoped App token.575b840e08a33f4ee22815b97a0f5489fa0b66a4: APA 7 doctoring documenting GitHub token scope, failure behavior, and private-target acceptance.0b611e649878038828ff8c3dc8b39c9385455121: records the security/interoperability contract underCHANGELOG.md→## Unreleased.8d5d62437a944e8c1e9eda4a2b695edb3b5678e3: current exact head; adds regression assertions for the existing review-dependent-check exclusion set so the independent reviewer waits on every review-independent current-head check while excluding onlyopencode-reviewandmetadata-only gate evaluation. The exact comparison from0b611...changes onlyreviewer/tests/test_central_review_workflow.py(+20/-0); production workflow source is unchanged by this final commit.RCA and feasibility
Root cause: the first cross-repository API read used workflow-repository
GITHUB_TOKENauthority even though the product supports targets beyond the Noema repository. Public targets can hide the defect because their PR metadata is public; private targets cannot rely on that authority.Verified remediation path: the workflow already possesses a dedicated Noema GitHub App credential and already minted a repository-scoped read token for later target checkout/evidence reads. The narrow repair therefore performs only syntax validation before token creation, then uses that existing least-privilege token for the first live target read.
Rejected alternatives: broadening
GITHUB_TOKEN, adding PAT-like credentials, making the target repository public, skipping exact-head binding, widening the App installation token to the whole organization, or treating public-repository success as proof of private-target authority.Current exact-head evidence
For exact head
8d5d62437a944e8c1e9eda4a2b695edb3b5678e3:cirun31320482243: terminal failure. The application/repository tests and configured 100% coverage gates complete successfully before the unchanged repository-widenpm audit --audit-level=highboundary rejects inheritednanoid@3.3.16(GHSA-2v37-7h3g-55p8). The root dependency remediation is PR fix(security): update transitive nanoid for CVE-2026-67213 #76; duplicating it here is rejected.reviewer-cirun31320482244: terminal success.Security Scanrun31320482249: terminal success.The earlier queued-run symptom has recovered for this exact head; it is not counted as a source remedy and remains tracked as organization/control-plane RCA under #30. The current CI failure is a distinct inherited dependency boundary, not a private-target-auth implementation failure.
Documentation
docs/doctoring/private-target-review-auth.mdrecords the decision, failure/recovery behavior, acceptance contract, and current GitHub primary sources in APA 7 format.CHANGELOG.mdrecords the behavior change under## Unreleased.Required acceptance before Ready / merge
ci,reviewer-ci, andSecurity Scanon the unchanged exact head.Queued, pending, cancelled, absent, status-only, stale-head, predecessor-head, model-only, or synthetic evidence is never promoted to passing check, approval, or merge authority. No version bump or release is warranted for an unintegrated workflow repair.