Skip to content

๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ] #885

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. Weโ€™ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
seonghobae wants to merge 10 commits into
base: main
Choose a base branch
from
+51 โˆ’47
Open

๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ] #885

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
d29dbd4
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 9, 2026
2eda83a
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 9, 2026
e488119
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 9, 2026
597c6cd
test(uv): cover trusted origin port boundaries
seonghobae Aug 9, 2026
9ac59a4
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 9, 2026
4ebec0c
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 9, 2026
609073a
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 11, 2026
9028402
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 11, 2026
a5b39a9
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 11, 2026
c0918bc
๐Ÿงน [์ฝ”๋“œ ํ—ฌ์Šค ๊ฐœ์„ : ์‹ ๋ขฐํ•  ์ˆ˜ ์žˆ๋Š” UV ์ถœ์ฒ˜ ๊ฒ€์ฆ ๋กœ์ง ๋ถ„๋ฆฌ]
seonghobae Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 21 additions & 17 deletions scripts/ci/materialize_base_python_requirements.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -165,6 +165,26 @@ def _git(repo_root: pathlib.Path, *args: str) -> bytes:
return completed.stdout


def _verify_trusted_uv_origin(url: str) -> None:
"""Verify the final response URL remains within the trusted HTTPS origin."""
final_url = urllib.parse.urlparse(url)
try:
final_port = final_url.port
except ValueError as exc:
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
) from exc
if (
(final_url.scheme, final_url.hostname)
!= ("https", "releases.astral.sh")
or final_port not in (None, 443)
):
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
)

Comment thread
seonghobae marked this conversation as resolved.
def _download_trusted_uv_archive() -> bytes:
"""Download the fixed uv release archive through one HTTPS trust boundary."""
_install_trusted_uv_url_opener()
Expand All @@ -177,23 +197,7 @@ def _download_trusted_uv_archive() -> bytes:
"uv-x86_64-unknown-linux-gnu.tar.gz",
timeout=TRUSTED_UV_DOWNLOAD_TIMEOUT_SECONDS,
) as response:
final_url = urllib.parse.urlparse(response.geturl())
try:
final_port = final_url.port
except ValueError as exc:
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
) from exc
if (
(final_url.scheme, final_url.hostname)
!= ("https", "releases.astral.sh")
or final_port not in (None, 443)
):
raise RuntimeError(
"trusted uv archive redirected outside the fixed "
"releases.astral.sh HTTPS origin"
)
_verify_trusted_uv_origin(response.geturl())
payload = bytearray()
while len(payload) <= TRUSTED_UV_DOWNLOAD_MAX_BYTES:
chunk = response.read(
Expand Down
60 changes: 30 additions & 30 deletions scripts/ci/test_strix_quick_gate.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5118,7 +5118,7 @@ EOS
;;
esac
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"

cat >"$fake_gh" <<'EOF'
#!/usr/bin/env bash
Expand Down Expand Up @@ -6337,7 +6337,7 @@ else
fi
echo "scan ok with PR head content"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6460,7 +6460,7 @@ vertex_ai/fallback-one)
;;
esac
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/stale-source-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6581,7 +6581,7 @@ if [ -e "$context_file" ]; then
fi
echo "scan ok with bounded PR head backend context"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6719,7 +6719,7 @@ fi
echo "Error: unexpected changed context scan attempt $attempt" >&2
exit 71
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -6924,7 +6924,7 @@ fi

echo "scan ok with non-email backend scope"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7150,7 +7150,7 @@ fi

echo "scan ok with frontend email trusted backend authorization context"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7239,7 +7239,7 @@ set -euo pipefail
echo "scan ok"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7390,7 +7390,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run after a PR-head blob failure" >&2
exit 64
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7480,7 +7480,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run after invalid pull request SHA metadata" >&2
exit 67
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7573,7 +7573,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run after an irregular PR-head entry" >&2
exit 66
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7654,7 +7654,7 @@ set -euo pipefail
printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
exit 66
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7758,7 +7758,7 @@ if [ -e "$target_path/vendor/newsdom-api" ]; then
fi
echo "scan ok with PR head content"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -7853,7 +7853,7 @@ printf 'called\n' >> "${FAKE_STRIX_CALL_LOG:?}"
echo "Error: Strix should not run for unsafe changed paths" >&2
exit 65
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'gemini/test-model' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
cat >"$event_payload_file" <<'EOF'
Expand Down Expand Up @@ -7945,7 +7945,7 @@ child_pid=$!
printf '%s' "$child_pid" > "${FAKE_STRIX_CHILD_PID_FILE:?}"
sleep "${FAKE_STRIX_TIMEOUT_SLEEP_SECONDS:?}"
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/timeout-cleanup-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -8024,7 +8024,7 @@ printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
echo "vertex scan ok without external LLM_API_BASE"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/gemini-2.5-pro' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8077,7 +8077,7 @@ set -euo pipefail
echo "1" >> "${FAKE_STRIX_CALL_COUNT_FILE:?}"
sleep 30
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/total-timeout-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -8148,7 +8148,7 @@ set -euo pipefail
echo "1" >> "${STRIX_CALL_COUNT_FILE:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
if [ -n "$strix_llm" ]; then
printf '%s' "$strix_llm" >"$strix_llm_file"
fi
Expand Down Expand Up @@ -8197,7 +8197,7 @@ set -euo pipefail
echo "1" >> "${STRIX_CALL_COUNT_FILE:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf 'openai-direct/gpt-5.4 $(touch %s)' "$marker_file" >"$strix_llm_file"
printf '%s' 'dummy-key' >"$llm_api_key_file"

Expand Down Expand Up @@ -8252,7 +8252,7 @@ if [ "${LLM_API_KEY_FILE+x}" = "x" ]; then
fi
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' "vertex_ai/ready-primary" >"$strix_llm_file"

set +e
Expand Down Expand Up @@ -8302,7 +8302,7 @@ if [ "${LLM_API_KEY_FILE+x}" = "x" ]; then
fi
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' "vertex_ai/ready-primary" >"$strix_llm_file"
printf '%s' "openai-key-should-not-reach-vertex" >"$llm_api_key_file"

Expand Down Expand Up @@ -8345,7 +8345,7 @@ set -euo pipefail
echo "unexpected strix execution" >&2
exit 99
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'vertex_ai/ready-primary' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"

Expand Down Expand Up @@ -8398,7 +8398,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8455,7 +8455,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8514,7 +8514,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8584,7 +8584,7 @@ set -euo pipefail
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8643,7 +8643,7 @@ set -euo pipefail
echo "Error: transport timeout"
exit 1
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8699,7 +8699,7 @@ set -euo pipefail
echo "Error: transport timeout"
exit 1
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8749,7 +8749,7 @@ set -euo pipefail
printf '%s\n' called >>"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down Expand Up @@ -8802,7 +8802,7 @@ run_absolute_outside_target_path_case() {
printf 'called\n' >"${FAKE_STRIX_CALL_LOG:?}"
exit 0
EOF
chmod +x "$fake_strix"
chmod 0755 "$fake_strix"
printf '%s' 'openai/gpt-4o-mini' >"$strix_llm_file"
printf '%s' 'dummy' >"$llm_api_key_file"
printf '%s' 'https://example.invalid/generateContent' >"$llm_api_base_file"
Expand Down
Loading