Repository navigation
fix(ci): restore runner-isolation evidence collection - #4795
Conversation
Source The PR has been promoted and admitted through the normal head-pinned merge queue. Merge-group CI is running on After actual merge, the remaining acceptance step is one protected transport proof from reviewed main, followed by an independent check that temporary probe resources are absent. Parent #4570 stays open until that succeeds. This repair does not activate ARC runners, change the GitHub App, widen access or skip the transport proof. |
@codex review for the conjunctive Hubble request, native-parser fixture, preserved identity and policy-denial evidence, fail-closed errors and owned cleanup |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 444c8bcb0c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
@coderabbitai full review |
✅ Action performedFull review finished. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ➖ Normal Severity of issue fixed: Medium Merge Risk: ⚪ Minimal · up to No actionable issue in this change is established. A fresh protected-main transport proof is still needed to complete transport acceptance. Pre-merge checks |
  |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Docstring Coverage |  |
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 … | Write docstrings for the functions missing them to satisfy the coverage threshold. |
✅ Passed checks (4 passed)
-
Check name Status Explanation Linked Issues check The changes satisfy the coding requirements in #4794. The verifier now sends one structured conjunctive Hubble allowlist with source IP and Pod, destination IP and port, TCP, DROPPED, and POLICY_DENIE…Out of Scope Changes check The changed workflow, verifier, fixture tests, and operations documentation directly support #4794. The workflow change enforces the required native parser. The fixture changes test the parser refusal…Title check The title clearly identifies the CI fix that restores runner-isolation evidence collection. It is concise and directly related to the primary changes. Description check The description explains the Hubble request failure and the supported conjunctive filter used to restore runner-isolation verification. It is directly related to the changeset.
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 3 files. (2 skipped: 2 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Ancillary finding resolved by assessment at b579db7: the docstring percentage is not evidence of an undocumented function here. Its complete detail says two functions were analyzed and both were skipped as unsupported, and names no missing docstring. This change adds no production Go API; the new Go function is a test, and the changed shell behavior has its conjunctive-filter explanation and operations documentation. No coverage threshold or analyzer configuration is changed. A concrete missing documentation finding would still be addressed. Readiness at this exact signed head: all native CI checks pass, including all 48 cases with the mandatory checksum-pinned native Linux Hubble parser. The authenticated current-head CodeRabbit summary 6128894105 was updated after request 6128850804 and the reviewed summary classifier returns GREEN. All threads are resolved; there is no other thread/body/comment-form finding or human control, and the current worktree-holder read is clear. Real parser behavior and rejection cases were exercised offline, not claimed as production transport acceptance. GitHub reports MERGEABLE/CLEAN. The opaque configured code-quality analysis remains unreadable, not waived; normal head-pinned queue admission leaves that rule enforced by GitHub. #4570 remains open for the protected-main proof and owned cleanup readback. |
1 participant
Why
The runner-isolation verification stops before it can observe denied traffic, blocking the existing runner integration. Its request combines options the observation tool does not accept.
What
Uses one supported request that keeps all the same identity and denial requirements. Verification remains bounded, cleans up its temporary probes, and refuses incomplete or contradictory evidence.
Fixes #4794
Part of #4570