docs: add protected GitHub Pages publication lane - #98
seonghobae wants to merge 25 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughGitHub Pages 수동 배포 워크플로를 추가했다. ChangesPages 문서 배포
Priority: ⬇️ Low Estimated code review effort: 3 (Moderate) | ~25 minutes Change: Feature Sequence Diagram(s)sequenceDiagram
participant BuildJob
participant PagesArtifact
participant DeployJob
participant PublicSite
BuildJob->>PagesArtifact: 문서 빌드 결과와 source-sha.txt 업로드
PagesArtifact->>DeployJob: Pages 아티팩트 전달
DeployJob->>PublicSite: 아티팩트 배포
DeployJob->>PublicSite: HTTPS source-sha.txt 요청
PublicSite-->>DeployJob: 공개 소스 SHA 응답
Merge Risk: ⚪ Minimal · up to The Pages workflow has no remaining actionable issue from this review and is ready to merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current technical re-review on 891156096cff7692694aab74afe5036025c4863f: re-read the full three-path child range after terminal execution and revalidated the pinned GitHub Pages action authority. The workflow remains manual-only and fails closed off refs/heads/main; checkout and the public source-sha.txt marker are bound to the exact protected SHA; build/Jekyll authority has only contents: read + pages: read; deployment/OIDC authority is isolated to the deploy job; deployment is serialized without cancelling an in-flight publish; and post-deploy verification requires HTTPS plus exact public source-SHA convergence. actions/configure-pages@45bfe019... documents enablement=false by default and that enablement needs non-GITHUB_TOKEN admin+Pages write authority, so repository-owner enablement correctly remains outside this source lane. Current exact CI 34669688301, Supply Chain 34669688233, TLS H2 Performance 34669688274, PgErd capacity 34669688226, and Release Reproducibility 34669688225 are all terminal success. Fresh review threads are empty. I found no additional writer-safe source/test/doctoring or authority-boundary defect. This COMMENT is technical evidence only, not an independent APPROVED review; has_pages:false means no public-site completion or protected merge/release/cutover credit is claimed.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current technical re-review on db93bb100faa37da1525f1dc0d6e246c7286b8ef: re-read all three writer-safe paths after the HTTPS redirect-downgrade repair and terminal exact-head execution. The historical verifier could follow an initial HTTPS Pages URL onto HTTP; hostile characterization reproduced that acceptance. Current source now constrains both initial and redirect protocols on both public verification requests with curl --proto '=https' --proto-redir '=https', while preserving the exact protected-SHA marker, manual protected-main authority, exact action pins, job-scoped least privilege and serialized deployment. The structural contract requires both HTTPS-only controls twice, and TRACEABILITY records the transport-integrity RCA and recovery boundary. Current exact CI 34670282108, Supply Chain 34670282112, TLS H2 Performance 34670282095, PgErd bounded-origin capacity 34670282140, and Release Reproducibility 34670282161 are all terminal success. Fresh review threads are empty. I found no additional writer-safe source/test/doctoring or authority-boundary defect. This COMMENT is technical evidence only, not an independent APPROVED review; repository has_pages:false still prevents publication-completion credit.
|
@coderabbitai review Please review exact current head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="db93bb100faa37da1525f1dc0d6e246c7286b8ef"
actual_head="$(git rev-parse HEAD)"
printf 'HEAD=%s\nEXPECTED=%s\n' "$actual_head" "$expected_head"
test "$actual_head" = "$expected_head"
printf '\n== Changed paths against first parent ==\n'
git diff-tree --no-commit-id --name-status -r HEAD^ HEAD
printf '\n== Workflow ==\n'
nl -ba .github/workflows/pages.yml
printf '\n== Structural test ==\n'
nl -ba tests/pages_workflow_contract.rs
printf '\n== Traceability document ==\n'
nl -ba docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.md
printf '\n== Exact diff ==\n'
git diff --no-ext-diff --unified=80 HEAD^ HEAD -- \
.github/workflows/pages.yml \
tests/pages_workflow_contract.rs \
docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.md
printf '\n== Workflow YAML parser availability and parse ==\n'
if command -v ruby >/dev/null 2>&1; then
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/pages.yml"); puts "ruby_yaml_parse=ok"'
else
echo "ruby unavailable; skipped"
fi
printf '\n== Relevant repository workflow conventions ==\n'
fd -a -t f -e yml -e yaml .github/workflows -x sh -c 'echo "--- $1"; sed -n "1,240p" "$1"' sh {} \;Length of output: 24069 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="db93bb100faa37da1525f1dc0d6e246c7286b8ef"
test "$(git rev-parse HEAD)" = "$expected_head"
base="$(git merge-base HEAD origin/main)"
printf 'MERGE_BASE=%s\nHEAD=%s\n' "$base" "$(git rev-parse HEAD)"
printf '\n== All PR paths and diff from main merge base ==\n'
git diff --name-status "$base" HEAD
git diff --no-ext-diff --check "$base" HEAD
git diff --no-ext-diff --unified=100 "$base" HEAD -- \
.github/workflows/pages.yml \
tests/pages_workflow_contract.rs \
docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.md
printf '\n== Commit scope from merge base ==\n'
git log --format='%H %s' --no-decorate "$base"..HEAD
printf '\n== Workflow files ==\n'
fd -a -t f . .github/workflows -x sh -c 'echo "--- $1"; nl -ba "$1"' sh {}
printf '\n== Cargo test registration/context ==\n'
rg -n -C 3 --glob 'Cargo.toml' --glob '*.rs' 'pages_workflow_contract|mod[[:space:]]+pages_workflow_contract|include!.*pages_workflow_contract' .
printf '\n== Repository branch protection and Pages settings (if GitHub credentials are available) ==\n'
gh api repos/ContextualWisdomLab/pingora-gateway --jq '{default_branch, has_pages, private, visibility}' || true
gh api repos/ContextualWisdomLab/pingora-gateway/branches/main/protection --jq '{required_status_checks, enforce_admins, required_pull_request_reviews, restrictions}' || trueLength of output: 209206 🤖 web_search executed:
Length of output: 17597
The workflow is manual-only. It fails unless the dispatch ref is The authority separation is correct. The build job has no deployment or OIDC authority. Only the deploy job has The workflow writes the verified source SHA into the rendered artifact before upload. It then requires the public Both public fetches restrict the initial protocol and all redirect protocols to HTTPS. An HTTPS-to-HTTP redirect cannot satisfy the publication check. The structural test covers the reviewed authority, source-binding, ordering, and redirect-protocol invariants. The traceability document accurately retains the repository-owner Pages enablement boundary. It does not claim current publication. This is an independent source review of the specified head. It does not transfer predecessor review credit. I did not execute the workflow in this sandbox. ✅ Action performedReview finished.
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current technical re-review on 0342fbda2c0e4f97d412d12d4a025fdffd46b599: re-read the complete three-path Pages child after the build-origin rendered-root repair and terminal exact-head execution. The prior verifier trusted public index-sha256.txt as its expected root digest, allowing a fresh source marker to coexist with a stale digest+root pair. Current source now computes SHA-256 of exact _site/index.html in the build job, writes it into the uploaded artifact, exports the same value through the workflow DAG, and requires both the public digest file and fetched root SHA-256 to equal that build-origin value. Manual protected-main-only authority, exact action pins, job-scoped least privilege, direct HTTPS/no-redirect transfer, real curl success and exact HTTP 200 remain intact. Current exact CI 34680605405, Supply Chain 34680605333, Release Reproducibility 34680605311, PgErd bounded-origin capacity 34680605316, and TLS H2 Performance 34680605315 are all terminal success. Fresh review threads are empty. I found no additional writer-safe workflow/test/doctoring or authority-boundary defect. This COMMENT is technical evidence only, not an independent APPROVED review; repository has_pages:false still prevents publication-completion credit.
seonghobae
added
documentation
ChatGPT Codex Connector
1 participant
Refs #51, #58, #97.
Writer-safe publication child of #93 exact
175b831895a58791c5243778c508b17c25f14e46.Repository metadata still reports
has_pages:false, whiledocs/index.mdis maintained as the buyer-facing source. A checked-in Markdown page is not public-site evidence. This PR owns only the source/workflow half of that gap and does not fabricate repository-admin enablement.Changes:
.github/workflows/pages.ymlas a manual-only publication lane that fails closed unless dispatched from protectedmain;github.sha, builds only./docsthrough GitHub's Jekyll Pages builder, writessource-sha.txt, computes the exact rendered_site/index.htmlSHA-256, exports that digest as a trusted build-job output, writes the same digest toindex-sha256.txt, uploads the rendered artifact, deploys through thegithub-pagesenvironment, and verifies both source identity and buyer-facing root bytes after deployment;checkout@v6,configure-pages@v6,jekyll-build-pages@v1,upload-pages-artifact@v5,deploy-pages@v5);permissions: {}, build-onlycontents: read+pages: read, deploy-onlypages: write+id-token: write;--max-redirs 0, preserves curl failure status, and requires exact HTTP200;index-sha256.txtas the expected-digest authority;tests/pages_workflow_contract.rsto lock manual/main-only authority, job-scoped least privilege, exact pins, source/rendered-root binding, build-to-deploy digest propagation, zero-redirect/failure-preserving/exact-200 public verification, deployment ordering and serialization;docs/doctoring/PAGES_PUBLISHING_TRACEABILITY.mdwith the admin boundary, alternatives, action authority, transport/origin/exit-status/HTTP-status/rendered-root evidence, acceptance and forward-recovery model.The lane intentionally does not use
configure-pages enablement: true: exactactions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0ddocuments that enabling Pages requires a token other thanGITHUB_TOKENand, for a GitHub App, administration+Pages write permission. That authority remains with the repository owner rather than being introduced as a repository secret.RED/repair history includes the earlier job-permission isolation, HTTPS downgrade rejection, cross-origin redirect rejection, curl failure-status preservation, exact-HTTP-200 gates, and rendered-root binding. Fresh review found one remaining evidence-integrity gap in
2780f08f53c36f7f367a043b1097e13449552596: the verifier fetchedindex-sha256.txtfrom the public site and then used that public value as the expected digest. A cache-skewed state with a freshsource-sha.txtbut staleindex-sha256.txtplus matching stale/could therefore satisfy the predicate. Test-first352c39c441e204c1a7ce15821b58e93bc49f1a67requires build-origin digest authority;95084621c54fae4f707969b8e3a868066bcbf082exports the rendered-root digest from the build step and passes it through the workflow DAG to deploy; current exact0342fbda2c0e4f97d412d12d4a025fdffd46b599records the RCA and recovery boundary.Current exact head is
0342fbda2c0e4f97d412d12d4a025fdffd46b599, an ordinary-forward repair touching only the existing workflow/test/TRACEABILITY scope. Fresh exact-head CI34680605405, Supply Chain34680605333, Release Reproducibility34680605311, PgErd bounded-origin capacity34680605316, and TLS H2 Performance34680605315are all terminal success. Exact-current technical re-review5185751327re-read the complete three-path range after execution and found no additional writer-safe workflow/test/doctoring or authority-boundary defect; fresh review threads are empty. The PR is Ready again. This COMMENT is technical evidence only and no independentAPPROVEDreview is claimed.This does not claim publication yet. Repository-owner administration must enable GitHub Actions as the Pages publishing source. After dependency-ordered protected integration, a manual run from protected
mainmust deploy the exact protected artifact; the public HTTPS source marker must equal the protected source SHA, the public digest file must equal the build-origin rendered-root digest, and the public root bytes must hash to that same digest before issue #97 can close. No product release, gateway deployment, canary/cutover or legacy-removal credit follows from Pages publication.