mirror of
https://github.com/GoodOlClint/PSProxmoxVE.git
synced 2026-09-03 18:55:33 +00:00
goodolclint-claude[bot]
c38ca95987
* ci: take review instructions from the default branch, and gate self-approval Moves the review prompt out of claude-code-review.yml into .github/review-prompt.md, materialized from the default branch at review time. Prompt edits then neither trip claude-code-action's anti-tamper gate nor influence the review of the PR making them. PR #131 is what prompted this: 38 files of ADR migration were blocked from review by a four-line prompt edit. A security review of the first draft found the naive materialization was itself exploitable, and that is fixed here rather than shipped: - git show "origin/$DEFAULT_BRANCH:..." takes an UNQUALIFIED refname, and gitrevisions(7) resolves refs/tags/<name> before refs/remotes/<name>. With fetch-depth: 0 fetching all tags, a tag named "origin/main" would supply the review instructions for every PR, exiting 0 with only a stderr warning. Reproduced end to end. Now resolves refs/remotes/origin/<default> to a SHA, logs it, and reads by SHA. - CLAUDE.md is materialized from the default branch too. The prompt judges against its Key Conventions list, so reading it from the PR checkout let a PR edit the list to permit its own violation. - A PR touching review-prompt.md, .github/workflows/ or CLAUDE.md now has any claude[bot] APPROVED dismissed via the API and the check failed. Prose alone cannot protect the root of trust. - The sentinel is grepped in the materialize step rather than only asserted by the model it protects. - Fork PRs are skipped, not failed. A required check permanently red on outside contributions trains the operator to override red checks. Also drops track_progress and gh pr comment so the review body and inline comments are the only channel, and adds actions: read plus gh pr checks / gh run view so the reviewer can verify build and test claims against CI's own result. It deliberately gets no build or test tools: those execute PR-authored code in a job that can approve the PR. ADR 0025 records the decision. * ci: fix three defects found in second-opinion review - Job-level 'actions: read' was missing. An explicit permissions block sets every unlisted permission to none, so additional_permissions: actions: read on the action alone granted nothing and the reviewer could not have read the check runs it was just told to verify claims against. Athena has both; only the action-level half was copied. - The governance detector checked review-prompt.md, .github/workflows/ and CLAUDE.md, while review-prompt.md told the reviewer DECISIONS.md and docs/decisions/ were mechanically covered too. A PR adding an ADR could escape the guard it was promised to be under. Detector now covers both, which means every ADR PR needs operator approval — that is the intended reading of ADR 0023, since the reviewer defers to ADRs as precedent. - The formal-review check counted ANY historical claude[bot] review, so a re-run after a new push went green on a verdict about the previous commit. Now scoped to the head SHA. Pre-existing, fixed here because the file was already open. Adds a fork-notice job. A skipped job reports its required check as PASSING, so skipping the review on fork PRs made them green with nothing reviewed and no trace of why; the notice puts it in the run summary. Prompt: pending checks are a race, so say unverified rather than reporting a queued check as a failure; and defer-to-operator maps to --comment, not --request-changes. * ci: withhold approval on review-governing PRs, not the review itself Operator ruling: Claude should still review the protected files and report what it finds; only the power to approve is reserved. The gate failed the check unconditionally whenever a PR touched a governance path, even when the reviewer had correctly submitted COMMENTED. That discarded a review that was wanted, and made a red check the normal outcome for a whole class of PR — training exactly the merge-past-red habit the fork-notice change exists to avoid. Now: a COMMENTED deferral passes, with a notice saying the check is green because the reviewer behaved, not because the PR is approved. Merge still waits for the operator, since COMMENTED does not satisfy branch protection. The step fails only when claude[bot] actually approved — that approval is dismissed and the red check records the disobedience. ADRs stay in the protected set, per the same ruling. * ci: close a green-with-live-approval hole and widen the governance detector Third security pass. The two that mattered: - Both review queries were unpaginated. GitHub returns 30 reviews oldest-first, so an approval submitted now sits on page 2 of any PR that already has 30 review objects — the withhold step would find nothing, print 'reviewer behaved correctly' and exit 0 green while the approval stood and satisfied branch protection. Reachable without an attacker: every inline comment creates a review object. Both queries now --paginate. - The detector covered CLAUDE.md but not .claude/, .mcp.json, AGENTS.md, or nested CLAUDE.md. .claude/settings.json is tracked and .gitignore had no claude entry, so a PR could add .claude/settings.local.json - which outranks settings.json - carrying env (redirect model traffic) or hooks (arbitrary shell in the job holding the approval token). Those are read by the runtime before the model starts, so no prompt-level rule can defend against them. Added to the detector and to .gitignore. Also: dismissal now matches .user.type == 'Bot' rather than the claude[bot] login literal, so an approval from another App is not invisible; the test fixtures, psd1 and CHANGELOG join the detector, since the prompt already reserved release tagging to the operator and did not enforce it; a failed dismissal says so loudly instead of aborting silently under bash -e and claiming success; the pre-review notice no longer promises a red check on the path that goes green; show-ref --verify replaces rev-parse, which still DWIMs on a ref that does not exist; and a concurrency group stops two runs interleaving dismissals. Dropped the '@claude re-review' suggestion from the fail-closed message: it pointed at an ungated workflow on exactly the PRs where approval is reserved. ADR 0025 now states the premise the whole design rests on - that code-owner review is off, deliberately, because enabling it would end bot merging - and records claude.yml as an open second path to a binding approval. * ci: narrow CODEOWNERS so code-owner review becomes usable Operator's suggestion, and it is better than what ADR 0025 previously recorded. CODEOWNERS was '* @goodolclint'. At that breadth 'Require review from Code Owners' is unusable — it would demand the operator on every PR and end the verdict-gated merge loop — which is why the setting is off and why the self-approval guard had to live in the workflow. Narrowed to the governance and release paths only, matching the detector. An ordinary PR has no code owner and an automated approval still merges it; a PR touching what governs review or what gets published requires the operator. That makes the setting safe to enable, and GitHub then enforces the property better than the workflow step can: not one-shot, no pagination limit, no bot identity to match, no dismissal permission needed, and it covers an approval from any source — including claude.yml, the ungated second path the dismissal step cannot see. Enabling the setting is the operator's action, not this commit's. Until then the workflow gate remains load-bearing, and it stays either way as defence-in-depth. Both files carry a keep-in-sync note; drift is silent in the direction that matters. ADR 0025 records the edge case: GitHub does not let an author approve their own PR, so an operator-authored governance PR would need admin enforcement toggled or to go through the bot. * ci: stop the green-path notice claiming more than it checked Third-party re-review: the empty-id branch announced 'It reviewed and deferred, as intended', but an empty list only means no automated APPROVED was found. It cannot distinguish a deferral from CHANGES_REQUESTED, from no verdict, or from no review at all — that a formal review exists at this head SHA is established by the verify step, not this one. The notice now says what was actually checked, and says plainly that green does not mean approved or adequately reviewed. ADR 0025 said a prompt edit 'gets a red check', contradicting its own statement two paragraphs earlier that a deferral passes. Corrected, and it now records the one governance path that genuinely gets no review: this workflow itself, where the action's anti-tamper gate means there is no verdict to observe. --------- Co-authored-by: goodolclint-claude[bot] <323206664+goodolclint-claude[bot]@users.noreply.github.com>
42 lines
1.9 KiB
Plaintext
42 lines
1.9 KiB
Plaintext
# Ownership is deliberately NARROW.
|
|
#
|
|
# It used to be `* @goodolclint`, which does nothing while branch protection's
|
|
# "Require review from Code Owners" is off, and would block every pull request
|
|
# the moment it was switched on. That made the setting unusable, so the
|
|
# self-approval guard had to be built in the review workflow instead.
|
|
#
|
|
# The paths below are the ones where an automated approval must not be
|
|
# sufficient: they govern how review itself works, what the reviewer is told,
|
|
# what it judges against, and what gets published. Everything else has no code
|
|
# owner, so an automated approval still merges it and the bot-driven flow is
|
|
# unaffected.
|
|
#
|
|
# KEEP IN SYNC with the governance detector in
|
|
# .github/workflows/claude-code-review.yml. The two lists express the same
|
|
# policy through different mechanisms and drifting apart is the failure mode:
|
|
# CODEOWNERS is enforced by GitHub, the detector is a backstop for when the
|
|
# branch-protection setting is off.
|
|
|
|
# --- what governs review ---
|
|
/.github/workflows/ @goodolclint
|
|
/.github/review-prompt.md @goodolclint
|
|
/.claude/ @goodolclint
|
|
/.mcp.json @goodolclint
|
|
|
|
# Unanchored, so these match at any depth. The harness auto-loads them as
|
|
# project instructions before the model starts.
|
|
CLAUDE.md @goodolclint
|
|
AGENTS.md @goodolclint
|
|
|
|
# --- what the reviewer defers to ---
|
|
/DECISIONS.md @goodolclint
|
|
/docs/decisions/ @goodolclint
|
|
/tests/PSProxmoxVE.Core.Tests/Fixtures/ @goodolclint
|
|
|
|
# --- what gets published ---
|
|
/src/PSProxmoxVE/PSProxmoxVE.psd1 @goodolclint
|
|
/CHANGELOG.md @goodolclint
|
|
|
|
# This file, or ownership could be removed by a pull request.
|
|
/CODEOWNERS @goodolclint
|