Skip to content

fix(governance): clear symlinked report-back entries before the artifact download #297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hyperpolymath merged 2 commits into from
Oct 27, 2026
Merged

fix(governance): clear symlinked report-back entries before the artifact download #297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4fbb567
fix(governance): clear symlinked and directory report-back entries be…
claude Oct 27, 2026
9736d56
test(governance): escape the glob in the symlink mutation so it mutates
claude Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/hypatia-scan-reusable.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -754,7 +754,9 @@ jobs:
run: |
set -euo pipefail
mkdir -p .gitbot-fleet/report-backs
find .gitbot-fleet/report-backs -maxdepth 1 -name '*.json' -type f -print -delete
# Every entry named *.json goes, symlinks and directories included: a committed
# symlink survives a -type f filter and the renderer follows it to its target.
find .gitbot-fleet/report-backs -mindepth 1 -maxdepth 1 -name '*.json' -print -exec rm -rf -- {} +

@chatgpt-codex-connector chatgpt-codex-connector Bot Oct 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reject a symlinked report-backs directory

A PR can replace .gitbot-fleet/report-backs itself with a symlink to another committed directory containing forged *.json envelopes. In that case mkdir -p accepts the symlink, while this find clears nothing because GNU find defaults to -P (“Never follow symbolic links”) and therefore does not descend through the command-line symlink; if the tolerated artifact download is then absent, the renderer follows the directory symlink and consumes the committed evidence. Remove and recreate the report-backs path as a real directory, or explicitly reject a symlink, before clearing its contents.

Useful? React with 👍 / 👎.


- name: Download the fleet report-backs
if: ${{ always() && inputs.report-backs-artifact != '' }}
Expand Down
2 changes: 1 addition & 1 deletion scripts/check-governance-contract.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ else
fail 'the fleet report-backs must come from hyperpolymath/gitbot-fleet pinned to a 40-hex commit'
fi
if fleet_clear="$(step_block "$REUSABLE" 'Clear any checked-out fleet report-backs')"; then
contains "$fleet_clear" "find .gitbot-fleet/report-backs -maxdepth 1 -name '*.json' -type f -print -delete" \
contains "$fleet_clear" "find .gitbot-fleet/report-backs -mindepth 1 -maxdepth 1 -name '*.json' -print -exec rm -rf -- {} +" \
'a committed envelope can never pose as report-back evidence'
clear_line=$(grep -nF -- '- name: Clear any checked-out fleet report-backs' "$REUSABLE" | cut -d: -f1 | head -n1)
dl_line0=$(grep -nF -- '- name: Download the fleet report-backs' "$REUSABLE" | cut -d: -f1 | head -n1)
Expand Down
5 changes: 3 additions & 2 deletions scripts/tests/test-governance-contract.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ reset_fixture() {
}
reset_fixture
bash "$fixture/scripts/check-governance-contract.sh" > "$fixture/log" 2>&1
for mutation in allowlist-addition baseline-zero-gate baseline-operator-gate baseline-grouping-gate sarif upstream-exception effective-grid jcs-manifest jcs-canonicalizer raw-ijson k9-pin k9-require k9-indeterminate k9-verdict scanner-advisory scanner-secrets scanner-trigger scorecard-trigger stale-standards-owner scorecard-owner deed-remote scorecard-remote deed-source-sha scorecard-source-sha scorecard-no-upload scorecard-quiet-reconcile cross-owner-reusable fleet-unpinned fleet-before-contract fleet-dropped-download fleet-download-after-render fleet-download-fatal fleet-committed-evidence fleet-ignores-cancel; do
for mutation in allowlist-addition baseline-zero-gate baseline-operator-gate baseline-grouping-gate sarif upstream-exception effective-grid jcs-manifest jcs-canonicalizer raw-ijson k9-pin k9-require k9-indeterminate k9-verdict scanner-advisory scanner-secrets scanner-trigger scorecard-trigger stale-standards-owner scorecard-owner deed-remote scorecard-remote deed-source-sha scorecard-source-sha scorecard-no-upload scorecard-quiet-reconcile cross-owner-reusable fleet-unpinned fleet-before-contract fleet-dropped-download fleet-download-after-render fleet-download-fatal fleet-committed-evidence fleet-symlinked-evidence fleet-ignores-cancel; do
reset_fixture
case "$mutation" in
allowlist-addition) echo 'frontend/src/fork-only.ts' >> "$fixture/config/hypatia/upstream-typescript-allowlist.txt" ;;
Expand Down Expand Up @@ -56,7 +56,8 @@ for mutation in allowlist-addition baseline-zero-gate baseline-operator-gate bas
fleet-dropped-download) sed -i '/^ - name: Download the fleet report-backs$/,/^ path: .gitbot-fleet\/report-backs$/d' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
fleet-download-after-render) awk '/^ - name: Download the fleet report-backs$/{hold=1} hold && /^ - name: Render the verdict grid$/{hold=0; print; printf "%s", buf; buf=""; next} hold{buf=buf $0 "\n"; next} {print}' "$fixture/.github/workflows/hypatia-scan-reusable.yml" > "$fixture/reordered.yml" && mv "$fixture/reordered.yml" "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
fleet-download-fatal) sed -i '/^ - name: Download the fleet report-backs$/,/^ path: .gitbot-fleet\/report-backs$/{/continue-on-error: true/d}' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
fleet-committed-evidence) sed -i '/^ - name: Clear any checked-out fleet report-backs$/,/-print -delete$/d' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
fleet-committed-evidence) sed -i '/^ - name: Clear any checked-out fleet report-backs$/,/-exec rm -rf -- {} +$/d' "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
fleet-symlinked-evidence) sed -i "s|-mindepth 1 -maxdepth 1 -name '\*.json' -print -exec rm -rf -- {} +|-maxdepth 1 -name '*.json' -type f -print -delete|" "$fixture/.github/workflows/hypatia-scan-reusable.yml" ;;
fleet-ignores-cancel) sed -i "s|if: \${{ !cancelled() \&\& needs.workflow-contract.result == 'success' }}|if: \${{ always() \&\& needs.workflow-contract.result == 'success' }}|" "$fixture/.github/workflows/hypatia-scan.yml" ;;
# A copy is only a copy while it still comes from the audited commit and
# keeps the guards whose absence froze code scanning upstream.
Expand Down
Loading