Repository navigation
fix(workflows): permit verified CAO farm snapshot review roles - #2219
bradygaster wants to merge 1 commit into
Conversation
Use reserved workflow roles only for the verified Actions-bot farm Markdown PR and producer run. Preserve ordinary attribution and bootstrap clearing gates. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 33ebda51-5808-40cf-b34d-df44be618896
🟡 Impact Analysis — PR #2219Risk tier: 🟡 MEDIUM 📊 Summary
🎯 Risk Factors
📦 Modules Affecteddocs (1 file)
root (4 files)
tests (1 file)
This report is generated automatically for every PR. See #733 for details. |
🛫 PR Readiness Check
PR Scope: 🔧 Infrastructure
|
| Status | Check | Details |
|---|---|---|
| ✅ | Single commit | 1 commit — clean history |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | No source files changed — changeset not required |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ❌ | Copilot threads resolved | 1 unresolved Copilot thread(s) — fix and resolve before merging |
| ❌ | CI passing | 1 check(s) still running |
Files Changed (6 files, +362 −15)
| File | +/− |
|---|---|
docs/src/content/docs/guide/gh-aw.md |
+33 −0 |
test/gh-aw-review-guard.test.ts |
+163 −0 |
workflows/package/squad-review.md |
+47 −3 |
workflows/shared/squad-review-guard.mjs |
+66 −3 |
workflows/squad-review.md |
+47 −3 |
workflows/squad-workflows.manifest.json |
+6 −6 |
Total: +362 −15
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
There was a problem hiding this comment.
🟡 Changes recommended
Producer workflow runs are not immutably bound to the snapshot PR or its exact head.
1 open finding
What changed in this PR
Adds a narrowly scoped native review path for CAO farm snapshot pull requests lacking cast attribution.
Changes:
- Validates farm-only diffs, producer workflow provenance, and reserved identities.
- Adds focused positive and mutation tests.
- Updates workflow documentation and generated integrity metadata.
| File | Description |
|---|---|
workflows/squad-workflows.manifest.json |
Refreshes review workflow and guard digests. |
workflows/squad-review.md |
Documents the farm snapshot exception. |
workflows/shared/squad-review-guard.mjs |
Implements snapshot provenance validation. |
workflows/package/squad-review.md |
Regenerates the packaged workflow source. |
test/gh-aw-review-guard.test.ts |
Tests acceptance and fail-closed mutations. |
docs/src/content/docs/guide/gh-aw.md |
Documents operator-facing behavior. |
Review effort: Balanced
| requireThat(run?.id === runId && run.path === FARM_SNAPSHOT_WORKFLOW && | ||
| run.repository?.full_name === repository && run.event === 'workflow_dispatch' && | ||
| run.head_branch === pr.base.ref, |
|
Parking as draft. The paired CAO producer (bradygaster/gh-aw-cao#9) is parked: its output conflicts with the CAO farm receipt-ownership contract. Copilot finding 4266690635 is also valid: the run ID is not bound to this PR's head or creation time. If this resumes, bind the run to the PR head and creation window together with the redesigned producer. |
|
Closing this snapshot-refresh approach. Ongoing research waves now use the run-local CAO evidence hook in #2226. |
What
Add one narrow, base-controlled native Squad review exception for CAO farm snapshot PRs, using reserved workflow identities rather than fabricated cast authorship. Working as agentic-workflows-dev (Agentic Workflows Engineer).
Why
The deterministic farm snapshot refresh has no
.squad-review.json, so native review currently rejects it and blocks the daily advisory campaign. No tracking issue was supplied. Coordinated CAO producer change: bradygaster/gh-aw-cao#9.How
Only a genuine attribution-file HTTP 404 permits this path. Require bot author
github-actions[bot], exact title[squad-advisory:farm-snapshot] Farm snapshot for the control repository Squad, both labelssquad-advisoryandsquad-advisory:farm-snapshot, and a complete nonempty diff confined tofarm/**/*.md(including root Markdown and rename sources).Require exactly one standalone
<!-- squad:farm-snapshot run=<RUN_ID> -->line after CRLF normalization, with no othersquad:farm-snapshotoccurrence. Verify the same-repository run's canonical path.github/workflows/squad-advisory-farm-snapshot.lock.yml,workflow_dispatch, default branch, and producer SHA equal to or an API-verified ancestor of the current PR base. gh-aw chooses the PR branch, so no branch-name binding is fabricated.Use
@squad/base-controlled-farm-snapshot/@squad/base-controlled-review. Preserve base-loaded guards, exact current PR SHA/review-run checks, ordinary cast attribution and bootstrap behavior. Reuse bootstrap's completion gate: output may precede producer completion; clearing requires completed/success. CAO opens a draft and a maintainer marks it ready. A fresh rerun after producer completion can clear if the initial run raced it.Validation evidence:
TMPDIR="$PWD/.squad-review-validation" node node_modules/vitest/vitest.mjs run test/gh-aw-review-guard.test.ts— passed, 234 tests.node workflows/shared/squad-install-verifier.mjs --write-source— passed with checksum-verified isolated gh-aw v0.91.5.node workflows/shared/squad-install-verifier.mjs --check-source— passed.compileWithPinnedActionsplus emitted-artifact assertions — passed; verified both PR-base guard imports, output/final handlers, base-SHA checkout, reserved role.SKIP_BUILD_BUMP=1 npm run build— passed; avoids unrelated version rewrites.git diff --check— passed.npx changeset add/.changeset/*.md, directCHANGELOG.mdentry for maintainers, orskip-changeloglabel for no user-facing changes)N/A: no SDK/CLI source or template changes; workflow package digests regenerated.
PR Readiness Checklist
Branch & Commit
dev(notmain)dev(git fetch upstream && git rebase upstream/dev)git diff --cached --stat)Build & Test
npm run buildpassesnpm testpasses (all tests green)npm run lintpasses (type check clean)npm run lint:eslintpassesFocused guard suite and mandatory build passed as above. Full test suite and standalone lint commands were not run, per the explicit focused-validation scope. Not a migration.
Changeset
npx changeset add(ifpackages/squad-sdk/src/orpackages/squad-cli/src/changed)CHANGELOG.mdentry (maintainers only — write-protected for external contributors)skip-changeloglabel applied (if no user-facing changes)N/A: no files covered by the changeset gate changed.
Docs
Updated the gh-aw guide and review workflow instructions; no new module.
Exports
N/A: no SDK changes.
Breaking Changes
None. All non-snapshot review paths remain unchanged.
Waivers
Requested: accept focused guard tests plus strict compiler/package verification and build instead of additional local full-suite/lint runs, per user-directed minimal validation scope. Lead/Quality approval is still required before merge; no waiver is claimed approved. Normal CI, independent review, and branch protections remain in force.