Repository navigation
feat(wfctl): bounded pipeline records and registry reports - #1020
Merged
Merged
Conversation
Automation must not treat stopped errors or leaked stdout as success. Supervise pipeline actors, broker strict sandboxes, and retain recovery state until exact cleanup is proven. Bind registry changes to reread immutable release identity and canonical Git tree reports.
⏱ Benchmark Results✅ No significant performance regressions detected. benchstat comparison (baseline → PR)
|
Contributor
Author
|
All 25 CI checks passed on 56b95de. Independent design/code review has no unresolved Critical or Important findings; final test-harness corrections passed focused race verification. Copilot review was requested with both the required reviewer login and the CLI-supported alias, but no review or threads have arrived. Using maintainer-preapproved admin merge for the outstanding review requirement. Task 35 remains open until main CI, exact release/tag/checksum, and downloaded-binary verification pass; downstream work remains gated. |
Contributor
Author
|
Post-merge checkpoint: newer main 49e1803 includes this PR and independently merged IaC PR #1021. Named main CI and snapshot now pass; exact original merge CI hit the aggregate 600s wfctl race/coverage ceiling twice, after the new runtime matrices passed. Full OSV findings match the prior baseline exactly, but include inherited shipped Go/UI exposure; this is not a clean security scan. A separately scoped maintenance design is on fix/workflow-release-security-20261003, preserving scanner failure policy and the staged trust lifecycle. Concurrent v0.86.1 is immutable and not retagged. Task 35 downloaded-release verification and patched-consumer promotion remain pending. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add executable, bounded pipeline records and deterministic registry-sync reports for the approved Signal ecosystem prerequisites. Human pipeline mode remains available; record mode is a Linux/macOS step-only contract, not an untrusted native-plugin sandbox.
Changes
Design And Scope
Accepted implementation plan
and locked umbrella.
PR Count: 34
Tasks: 41
This PR: Group 14, Task 35,
wfctl-pipeline-registry-reports.This PR does not complete the umbrella, contact the official Signal service, or resume the deferred Encrypted Spaces proof work. Task 35's release/tag/checksum and downloaded-binary reruns remain mandatory after merge; downstream consumers stay blocked until those gates pass.
Verification
Pinned
GOWORK=off GOTOOLCHAIN=go1.26.5:golangci-lint runacross changed packages: 0 issues;go vet: PASS.Runtime Launch Evidence
The actual built CLI ran both real-Docker host tests, including a digest-pinned BusyBox strict sandbox: PASS, 57.061s. The container checked UID/GID 65532, dropped capabilities, no-new-privileges, read-only root, credential absence, non-executable
/tmp, owner-only/work, and a caller-supplied value round-trip. Final cleanup journal was empty; the daemon'swfctl.pipeline.cleanuplabel query returned no containers.Transport fixtures do not prove container execution or live GitHub release immutability. The explicit real-container tests provide the sandbox evidence. Source-built and macOS linker-API fixtures do not prove downloaded release conformance.
Doc-reconciliation: clean.
CI and downloaded-release verification: pending; no runner/trust-policy changes.