Codex/issue 3 release safe - #4822
Conversation
Use standard GitHub-hosted runners and archive T3-owned release, relay, and Expo workflows so this fork does not wait on or publish through accounts it does not own. Add a workflow policy check and release prerequisites to prevent upstream credentials and runner labels from returning unnoticed.
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
size:XXL
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
|
|
||
| const approvedRunnerLabels = new Set(["macos-15", "ubuntu-24.04"]); | ||
| const approvedCredentialReferences = new Set(["secrets.GITHUB_TOKEN"]); | ||
| const credentialReferencePattern = /\b(?:secrets|vars)\.[A-Za-z0-9_]+\b/g; |
There was a problem hiding this comment.
🟠 High scripts/fork-workflow-policy.ts:7
credentialReferencePattern matches only dot notation like secrets.NAME, so a workflow that uses bracket notation like ${{ secrets['EXPO_TOKEN'] }} produces no credential violation. This lets unapproved fork credentials bypass the policy entirely. Consider extending the pattern to also match bracket-style property access such as secrets['NAME'] and secrets["NAME"].
| const credentialReferencePattern = /\b(?:secrets|vars)\.[A-Za-z0-9_]+\b/g; | |
| const credentialReferencePattern = /\b(?:secrets|vars)\.[A-Za-z0-9_]+\b|\b(?:secrets|vars)\[["'`][^"'`]+["'`]\]/g; |
🤖 Copy this AI Prompt to have your agent fix this:
In file @scripts/fork-workflow-policy.ts around line 7:
`credentialReferencePattern` matches only dot notation like `secrets.NAME`, so a workflow that uses bracket notation like `${{ secrets['EXPO_TOKEN'] }}` produces no credential violation. This lets unapproved fork credentials bypass the policy entirely. Consider extending the pattern to also match bracket-style property access such as `secrets['NAME']` and `secrets["NAME"]`.
| const approvedRunnerLabels = new Set(["macos-15", "ubuntu-24.04"]); | ||
| const approvedCredentialReferences = new Set(["secrets.GITHUB_TOKEN"]); | ||
| const credentialReferencePattern = /\b(?:secrets|vars)\.[A-Za-z0-9_]+\b/g; | ||
| const runnerLabelPattern = /^\s*runs-on:\s*([^\s#]+)\s*(?:#.*)?$/gm; |
There was a problem hiding this comment.
🟠 High scripts/fork-workflow-policy.ts:8
runnerLabelPattern only matches scalar runs-on: values, so array forms like runs-on: [self-hosted, production] or block sequences are not detected. A workflow using an unapproved or self-hosted runner via an array produces no violation, silently bypassing the policy that should restrict every active workflow to the two approved hosted runners. Consider extending the pattern (or parsing runs-on with a YAML-aware approach) so array and block-sequence forms are also checked.
🤖 Copy this AI Prompt to have your agent fix this:
In file @scripts/fork-workflow-policy.ts around line 8:
`runnerLabelPattern` only matches scalar `runs-on:` values, so array forms like `runs-on: [self-hosted, production]` or block sequences are not detected. A workflow using an unapproved or self-hosted runner via an array produces no violation, silently bypassing the policy that should restrict every active workflow to the two approved hosted runners. Consider extending the pattern (or parsing `runs-on` with a YAML-aware approach) so array and block-sequence forms are also checked.
| const approvedRunnerLabels = new Set(["macos-15", "ubuntu-24.04"]); | ||
| const approvedCredentialReferences = new Set(["secrets.GITHUB_TOKEN"]); | ||
| const credentialReferencePattern = /\b(?:secrets|vars)\.[A-Za-z0-9_]+\b/g; | ||
| const runnerLabelPattern = /^\s*runs-on:\s*([^\s#]+)\s*(?:#.*)?$/gm; |
There was a problem hiding this comment.
🟡 Medium scripts/fork-workflow-policy.ts:8
runnerLabelPattern captures the YAML quoting characters as part of the runner label, so a workflow with runs-on: "ubuntu-24.04" or runs-on: 'macos-15' is compared as "ubuntu-24.04" / 'macos-15' and rejected, even though YAML resolves it to an approved label. Stripping surrounding quotes before the approvedRunnerLabels lookup will fix this.
| const runnerLabelPattern = /^\s*runs-on:\s*([^\s#]+)\s*(?:#.*)?$/gm; | |
| const runnerLabelPattern = /^\s*runs-on:\s*['"]?([^\s#'"]+)['"]?\s*(?:#.*)?$/gm; |
🤖 Copy this AI Prompt to have your agent fix this:
In file @scripts/fork-workflow-policy.ts around line 8:
`runnerLabelPattern` captures the YAML quoting characters as part of the runner label, so a workflow with `runs-on: "ubuntu-24.04"` or `runs-on: 'macos-15'` is compared as `"ubuntu-24.04"` / `'macos-15'` and rejected, even though YAML resolves it to an approved label. Stripping surrounding quotes before the `approvedRunnerLabels` lookup will fix this.
| ? [`${workflowName}: runner '${runnerLabel}' is not approved for this fork`] | ||
| : []; | ||
| }); | ||
| const credentialViolations = Array.from( |
There was a problem hiding this comment.
🟡 Medium scripts/fork-workflow-policy.ts:20
findActiveWorkflowViolations scans the raw YAML text for credential references, so any secrets.* or vars.* token appearing in a comment or string is flagged as a violation. For example, a comment like # Do not use secrets.EXPO_TOKEN makes the policy report secrets.EXPO_TOKEN as an unapproved credential even though the workflow never uses it, causing false CI failures. Consider parsing the YAML and checking only active workflow values, or stripping comments before matching.
🤖 Copy this AI Prompt to have your agent fix this:
In file @scripts/fork-workflow-policy.ts around line 20:
`findActiveWorkflowViolations` scans the raw YAML text for credential references, so any `secrets.*` or `vars.*` token appearing in a comment or string is flagged as a violation. For example, a comment like `# Do not use secrets.EXPO_TOKEN` makes the policy report `secrets.EXPO_TOKEN` as an unapproved credential even though the workflow never uses it, causing false CI failures. Consider parsing the YAML and checking only active workflow values, or stripping comments before matching.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want fixes drafted automatically? Bugbot Autofix can create code changes for findings. A team admin can enable Autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3accf0f. Configure here.
ApprovabilityVerdict: Needs human review This PR establishes fork governance with documentation and CI changes, but has 4 unresolved review comments (2 high severity) on the new workflow policy enforcement script identifying regex patterns that can be bypassed - allowing unapproved runners or credentials to go undetected. You can customize Macroscope's approvability policy. Learn more. |
Resolve the repository root without the prohibited Node path import and shrink the synthetic image fixture so the same too-large assertion completes within the standard GitHub runner timeout.
1 participant
What Changed
Why
UI Changes
Checklist
Note
Low Risk
Changes are mostly documentation, archived workflows, and CI runner labels; the workflow policy test guards against accidental upstream credential use.
Overview
Establishes fork-safe automation and governance so CI and docs match a product fork that does not publish through upstream T3 infrastructure.
CI and workflow policy: Active workflows move from custom
blacksmith-*runners toubuntu-24.04andmacos-15. Newfork-workflow-policyscans.github/workflowsand fails on unapproved runners orsecrets/varsreferences other thanGITHUB_TOKEN..github/release.ymladds labeled categories for GitHub-generated release notes.Upstream release isolation: T3 release, relay deploy, and EAS workflows are archived under
docs/upstream/workflows/(with header comments so they do not run).docs/operations/release.mdis shortened to describe what the fork runs today and points restoration atdocs/releases/prerequisites.md.infra/relaydeploy tests now read the archived release workflow path.Project docs: Adds
CHANGELOG.md,ROADMAP.md,UPSTREAM.md, upstream baseline/sync/patch docs, and agent pointers (issue-tracker, triage labels, domain).AGENTS.mdlinks to those guides.Test fix: The stash image “too-large” test uses a smaller budget and blobs so the quality/scale ladder stays fast on standard CI runners.
Reviewed by Cursor Bugbot for commit 7e38620. Bugbot is set up for automated code reviews on this repo. Configure here.
Note
Archive upstream publish workflows and add fork workflow policy enforcement
.github/workflowsinto docs/upstream/workflows/ so they are no longer executable by GitHub Actions.findForkWorkflowPolicyViolationsfunction that scans active workflows for disallowed runner labels and non-GITHUB_TOKENcredentials, with accompanying tests.ubuntu-24.04andmacos-15runners.docs/.Macroscope summarized 7e38620.