Skip to content
This repository was archived by the owner on Nov 7, 2026. It is now read-only.
This repository was archived by the owner on Nov 7, 2026. It is now read-only.

P0: Restore application validation for production dependency pull requests #49

Closed as not planned
Closed as not planned
P0: Restore application validation for production dependency pull requests#49
Labels
approval-requiredBlocked on an explicit owner approval or accountable decisionarea:operationsHosting, reliability, recovery, and releasepriority:P0Release blockerroadmapPart of the authoritative market-leading roadmap
Milestone
Market-leading beta

Description

@camster91
camster91
opened on Aug 13, 2026

Goal

Enforce a trustworthy application-validation contract for production-affecting pull requests and prevent unreviewed/unvalidated changes from reaching main.

Current state — 2026-09-05

Current main:
b45170409543684a75579a13d7bdd6d8f8ffe8e8

PR #95 is separately ready for review on f8de3ee3180a455634a3261f82020675795e85fe; if explicitly merged, refetch the resulting main SHA before recording any exact-candidate governance evidence.

Implemented code-side validation contract:

  • canonical CI Build / Build performs frozen install, Prisma generation, disposable PostgreSQL 16, prisma migrate deploy, typecheck, lint, tests and production build;
  • relevant PR image validation remains non-publishing/path-scoped;
  • CI housekeeping changes no longer cause unnecessary image publication work;
  • Ashbi Local CI can provide isolated exact-PR-head validation without deployment/production access.

Current evidence:

  • PR fix: reconcile restored upload target during recovery drill #95 exact head passed Ashbi Local CI and GitGuardian and received a clean final Codex review;
  • GitHub-hosted CI Build / Build continues to fail before checkout with steps:null on current/recent exact heads;
  • that is neither passing validation nor an observed application/test failure.

Remaining blocker

main is still unprotected and the connected GitHub integration does not expose repository-administration write capability. The validation contract exists but is not enforced.

Recommended staged governance configuration — requires explicit owner/admin approval

Stage A — safe governance that can be enabled even while hosted Build is unavailable

Protect main with a branch protection rule or repository ruleset requiring:

  • pull request before merge;
  • at least 1 qualified approving review;
  • dismiss stale approvals when new review-relevant commits are pushed;
  • require conversation/review-thread resolution before merge where supported;
  • block force pushes;
  • block branch deletion;
  • do not allow normal direct pushes/bypass except a deliberately documented emergency-admin path;
  • do not require the currently non-executable hosted CI Build / Build yet, because doing so could lock all merges without adding executable evidence.

This stage materially improves governance without weakening the intended validation contract.

Stage B — add executable required-check enforcement after runner recovery

Only after one clean exact-SHA hosted execution exists:

  • add required status check CI Build / Build;
  • require branch to be up to date before merge unless a documented merge-queue policy replaces it;
  • keep one qualified approval and stale-approval dismissal active;
  • do not make image publication a universal required PR check; keep image validation path-scoped.

Stage C — prove enforcement

Create one harmless test PR after protection is active and demonstrate:

  1. it cannot merge without the required review;
  2. after Stage B, it cannot merge without CI Build / Build success;
  3. a new commit invalidates/dismisses stale approval as configured;
  4. force-push/direct-main paths are blocked for normal use;
  5. the test PR is closed or merged only according to the approved test plan.

Exact admin handoff

Repository: camster91/synapse
Branch: main

Recommended settings:

  • Require a pull request before merging: ON
  • Required approving reviews: 1
  • Dismiss stale pull-request approvals when new commits are pushed: ON
  • Require conversation resolution before merging: ON if available
  • Allow force pushes: OFF
  • Allow deletions: OFF
  • Bypass/direct push: OFF for normal actors; emergency path only if explicitly documented
  • Required status check initially: none while hosted Build is non-executable
  • After first clean hosted exact-SHA execution: add CI Build / Build and require up-to-date branch

Acceptance criteria

  • Canonical PR workflow covers frozen install, migration compatibility, typecheck, lint, tests and production build.
  • Current test/typecheck compatibility defects identified by local validation are fixed.
  • CI housekeeping no longer self-triggers unnecessary image builds.
  • Exact reviewed PR fix: reconcile restored upload target during recovery drill #95 has clean local/security/Codex evidence independent of the hosted-runner incident.
  • Stage A main governance is active.
  • A clean exact-SHA hosted CI Build / Build execution exists after runner recovery, or owner explicitly approves an equivalent exact-SHA gate for the beta.
  • Stage B requires CI Build / Build and up-to-date branch.
  • Stage C proves an unreviewed/unverified change cannot merge.

Capability boundary

The connected GitHub integration can inspect repository state but cannot apply branch protection/ruleset administration writes. The configuration above must be applied through an owner/admin-capable GitHub session or suitable admin automation after explicit approval.

Approval boundary

Creating/changing branch protection or rulesets is a repository-administration mutation requiring explicit owner approval. Do not disable validation, rename checks simply to bypass requirements, or weaken the canonical workflow to work around the hosted-runner incident.

Source of truth

.github/workflows/ci.yml; .github/workflows/build-and-push.yml; current main b45170409543684a75579a13d7bdd6d8f8ffe8e8; PR #95 reviewed head f8de3ee3180a455634a3261f82020675795e85fe; roadmap #71.

Activity

  1. camster91 commented on Aug 28, 2026

    @camster91
    camster91
    on Aug 28, 2026
    OwnerAuthor

    PR #55 reproduced the account-level validation blocker on commit c6978a0: Build, Lint, and image jobs all failed before checkout with zero steps and no assigned runner. Local validation is green (40 tests, typecheck, zero-warning lint, and production build). Failed runs: https://github.com/camster91/synapse/actions/runs/33197310074, https://github.com/camster91/synapse/actions/runs/33197310077, and https://github.com/camster91/synapse/actions/runs/33197309993.

  2. camster91 commented on Sep 1, 2026

    @camster91
    camster91
    on Sep 1, 2026
    OwnerAuthor

    Exact-SHA superseding validation evidence is now available on PR #55 at ac9c90d2c34a5d052b1e3959fd5ee6f1b75f255e: CI Build passed, Lint passed, Ashbi Local CI passed, GitGuardian passed, and the read-only dual-architecture (linux/amd64,linux/arm64) image validation passed in 26m58s without publication. Image run: https://github.com/camster91/synapse/actions/runs/33498965202. PR #48 is closed and superseded by the integrated candidate. This issue remains open pending the remaining governance criteria: required-check/branch-protection confirmation and qualified review of the selected candidate.

  3. camster91 commented on Sep 1, 2026

    @camster91
    camster91
    on Sep 1, 2026
    OwnerAuthor

    Governance check on 2026-09-01: GET /repos/camster91/synapse/branches/main/protection returns HTTP 404 Branch not protected. The technical validation contract now passes, but it is not enforced as a merge requirement on main. Closing #49 therefore still requires owner-approved branch protection/ruleset configuration with the selected required checks, plus qualified review evidence.

  4. camster91
    added
    roadmapPart of the authoritative market-leading roadmap
    priority:P0Release blocker
    area:operationsHosting, reliability, recovery, and release
    on Sep 2, 2026
  5. camster91
    added this to the Market-leading beta milestone on Sep 2, 2026
  6. camster91
    added
    approval-requiredBlocked on an explicit owner approval or accountable decision
    on Sep 2, 2026

  7. camster91 commented on Sep 4, 2026

    @camster91
    camster91
    on Sep 4, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    2026-09-03 RC1 preparation update:

    PR #85 (fix: require PostgreSQL migration proof in canonical CI) is open and mergeable at head 308d6ca246bdbd611e597a479bb3b97dde10dcc2.

    Code-side gap corrected:

    • canonical CI Build / Build now starts disposable PostgreSQL 16;
    • PostgreSQL health is required;
    • prisma migrate deploy runs before typecheck/lint/tests/build;
    • workflow remains read-only and contains no deploy/registry/SSH mutation path;
    • regression test guards the complete CI/database contract.

    Latest hosted CI run 33833062177 still failed before execution: the Build job has zero recorded steps. This is runner-allocation/infrastructure evidence, not an application or migration failure.

    Recommended future main protection once explicitly approved and runner execution is healthy:

    1. require pull request before merge;
    2. require one qualified approving review;
    3. dismiss stale approvals on new commits;
    4. require status check CI Build / Build and require branch to be up to date before merge;
    5. do not permit ordinary direct pushes/bypass except an explicitly documented emergency path;
    6. keep container image validation path-scoped rather than making it a universal required check.

    No branch protection/ruleset was changed and PR #85 was not merged.

  8. camster91 commented on Sep 4, 2026

    @camster91
    camster91
    on Sep 4, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Post-merge RC1 status on 2026-09-04:

    PR #85 is now merged. The canonical CI Build / Build workflow on main includes disposable PostgreSQL 16, health gating, prisma generate, prisma migrate deploy, typecheck, zero-warning lint, unit tests, and production build. Current main is b16ca80a28e96ad22a6d2cae3acb4f920466712d.

    Governance remains the only unresolved part of #49:

    • main is still unprotected;
    • repository rulesets endpoint currently returns [];
    • no required status checks are enforced;
    • no review requirement is enforced.

    Recommended protection remains:

    1. require pull request before merge;
    2. require one qualified approval;
    3. dismiss stale approvals on new commits;
    4. require CI Build / Build and require the branch to be up to date;
    5. block ordinary direct pushes/bypass except a separately documented emergency path;
    6. keep image validation path-scoped rather than universal.

    No repository protection/ruleset settings were changed in this update.

  9. camster91 commented on Sep 4, 2026

    @camster91
    camster91
    on Sep 4, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Post-merge RC1 status (2026-09-04): PR #85 is merged and the canonical CI Build / Build contract on current main includes disposable PostgreSQL 16 plus prisma migrate deploy before typecheck/lint/tests/build. Current main is a09a91ac1ff90da23f3c12c397858ec0a460cd03.

    Fresh push run 33865453195 and its explicit retry both failed before checkout with a Build job containing zero executed steps. This remains runner-allocation/infrastructure evidence, not application or migration failure.

    Governance is still unresolved: main reports protected: false, required status-check enforcement is off, and no repository ruleset is present. The connected GitHub app does not expose administration write capability, so this session cannot safely apply branch protection. #49 therefore remains open for admin-side enforcement of PR-only merges, one qualified approval, stale-approval dismissal, and required CI Build / Build once runner execution is healthy.

  10. camster91 commented on Sep 4, 2026

    @camster91
    camster91
    on Sep 4, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Post-merge CI governance review — 2026-09-04

    Current main: 0c05e7037b5d07029401aad2d6515ef6c243a08c.

    The canonical CI contract remains migration-aware and unchanged by the latest maintenance merges. PR #89 reduced unnecessary image-workflow noise for GitHub/docs/Markdown-only changes without weakening the canonical CI Build / Build gate or runtime/tag image publication.

    Observed behavior on the #89 merge:

    • canonical CI Build triggered;
    • Build and Push Image correctly did not trigger for the workflow-only push;
    • the Build job again failed before checkout with zero recorded steps.

    Therefore #49 remains blocked on hosted runner execution plus governance, not on a known application/test failure. main is still unprotected and no repository ruleset enforces CI Build / Build or qualified review.

  11. camster91 commented on Sep 4, 2026

    @camster91
    camster91
    on Sep 4, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Connector capability check on 2026-09-04: this GitHub connection exposes ruleset/branch-protection read access only; no ruleset/branch-protection write action is available through the connected GitHub tool. Therefore #49's governance mutation cannot be completed from this chat even after approval. The exact admin handoff remains the recommended configuration in the issue body: protect main, require PRs, one qualified approval, CI Build / Build, stale-approval dismissal, and block force-push/delete. After an authorized admin applies it, this chat can re-read the branch/ruleset state and verify the gate.

  12. camster91 commented on Sep 4, 2026

    @camster91
    camster91
    on Sep 4, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Latest hosted-runner retry — 2026-09-04

    Re-ran canonical CI Build / Build for exact current candidate 0c05e7037b5d07029401aad2d6515ef6c243a08c.

    Observed sequence:

    • retry was accepted and briefly entered queued;
    • job then completed failure;
    • GitHub returned steps: null / no executed workflow steps.

    Conclusion: hosted-runner allocation is still unavailable. This remains infrastructure evidence only, not an application failure and not a pass.

    Additional review evidence:

    That equivalence is useful context but does not satisfy the exact-SHA execution requirement. Keep #49 open until governance is active and either hosted CI executes successfully on the exact candidate or an explicitly approved equivalent exact-SHA gate is produced.

  13. camster91 commented on Sep 5, 2026

    @camster91
    camster91
    on Sep 5, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Repository-governance admin handoff — exact current state

    Current exact repository candidate: b45170409543684a75579a13d7bdd6d8f8ffe8e8.

    Read-only verification on 2026-09-04:

    • main protection: off;
    • repository rulesets: [];
    • latest current-candidate workflow: CI Build, run 33924508272;
    • actual Checks API job name: Build (GitHub Actions app);
    • job failed before workflow steps (steps:null), so it is not application pass/fail evidence.

    Exact admin configuration to apply when explicitly approved

    Target: main only.

    1. Require a pull request before merging.
    2. Require 1 qualified approving review.
    3. Dismiss stale approvals when new review-relevant commits are pushed.
    4. Require all review conversations to be resolved.
    5. Require the GitHub Actions check Build from workflow CI Build. In the GitHub UI, select the check associated with the CI Build workflow; do not add image publication as a universal required check.
    6. Require the branch to be up to date before merge, unless a deliberate merge-queue policy is adopted instead.
    7. Block force pushes.
    8. Block branch deletion.
    9. Do not grant routine bypass. If an emergency bypass is later needed, document the actor, reason, exact SHA, validation evidence and rollback separately.

    Important sequencing

    Do not enforce the currently failing hosted Build check until either:

    • GitHub-hosted runner allocation recovers and one real exact-head execution completes, or
    • Cameron explicitly approves an equivalent exact-SHA validation gate.

    Otherwise main would become permanently unmergeable because the required check cannot currently start.

    Recommended safe sequence:

    1. recover/replace executable exact-SHA validation;
    2. confirm the check context to require is still Build under CI Build;
    3. enable PR/review protections and the required check together;
    4. open a harmless test PR that intentionally lacks/has not completed Build and verify GitHub blocks merge;
    5. let Build complete successfully on the test PR and verify merge becomes eligible only after the required approving review;
    6. close the test PR without merging if its only purpose is governance verification.

    Capability boundary

    The current connected GitHub integration can read branch/ruleset state but cannot perform repository-administration writes, so this is an execution-ready GitHub-admin/Codex handoff rather than an in-chat mutation.

    No protection settings were changed by this comment.

  14. camster91
    closed this as not plannedon Nov 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    approval-requiredBlocked on an explicit owner approval or accountable decisionarea:operationsHosting, reliability, recovery, and releasepriority:P0Release blockerroadmapPart of the authoritative market-leading roadmap

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions