actions/checkout v7 is now GA and refuses to fetch fork PR head code in
pull_request_target / workflow_run workflows when unsafe ref patterns are
detected. The enforcement backports to all supported majors on 2026-07-16,
so pinned SHAs must be upgraded manually.
Pin all 36 checkout usages across 26 workflows to v7.0.0
(9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0), collapsing the prior v6.0.2 and
v4 pins to one version. All pull_request_target/workflow_run workflows check
out trusted refs (main / default branch) and never the fork head, so v7's new
refusal does not affect them — no allow-unsafe-pr-checkout opt-out needed.
Co-authored-by: Isaac
Add the npm analog of the `uv sync --locked` gate. `npm ci` only checks
the lockfile is consistent with package.json; it tolerates cosmetic
drift (dev/extraneous flags, metadata) that a fresh resolution rewrites.
Regenerate with `npm install --package-lock-only` and fail if the result
differs from the committed lockfile.
Also regenerate the currently-stale lockfile: it carried a dropped
`extraneous` yaml entry and missing `dev` flags on @types/react,
@types/react-dom, tailwindcss, and typescript (all devDependencies), so
the gate is green from the first run.
Co-authored-by: Isaac
Add .github/actions/setup-node that wraps actions/setup-node (Node 20,
npm cache on ap-web/package-lock.json) and pins npm to the EXACT version
11.12.1 — the version that regenerates the lockfile in
oss-regenerate-and-smoke.yml. Pin the regen workflow to the same exact
version so generation and verification never diverge (11.12.1 still
satisfies the >= 11.10.0 cooldown floor that workflow needs).
Without a pin, jobs use whatever npm Node 20 bundles (npm 10.x), so the
npm that verifies the lockfile differs from the one that generates it.
Wire lint.yml, ap-web-tests.yml, and e2e-ui.yml to the composite action
so every JS job shares one toolchain definition.
Co-authored-by: Isaac
* ci: multi-line long pytest paths + trim inline comments (ci.yml)
Fold the matrix `paths:` values (esp. the misc shard's long --ignore list)
into >- block scalars (fold back to the identical space-joined string passed
to pytest -- no behavior change) and cut the verbose inline comments to terse
one-liners, keeping a tightened top-of-file description. Verified the parsed
YAML is identical apart from comments.
Co-authored-by: Isaac
* ci: trim inline comments + multi-line long commands across workflows
Apply the ci.yml cleanup to the rest of the workflows: condense each file's
top block to a concise behavior+caveats description, cut verbose inline
narration to terse WHY-only one-liners, and fold any long word-split arg
lists into >- block scalars. Comment/formatting only -- verified per file by
parsing old vs new YAML and asserting the structures are identical after
stripping comment lines (every trigger/job/step/expression/run command and
folded arg-string is unchanged). Also dropped a couple of stale internal
references from comments while condensing.
Co-authored-by: Isaac
* ci: gate untrusted PR CI behind a deterministic security scan
Add a Security Gate that holds CI (ci, lint, e2e, e2e-ui) for untrusted
contributor PRs until a deterministic scan of the diff passes, so untrusted
code is not checked out, built, or run on our runners until it has been vetted.
- .github/workflows/security-gate.yml: reusable (workflow_call) gate, no
secrets, scanner always checked out from main. Each CI workflow runs it as
its first job; real jobs declare `needs: gate`, so a failing gate skips them.
- Detectors under .github/scripts/security-scan/: trust gate (should-scan.sh),
committed-secret scan, sensitive-path guard, workflow-misuse lint, plus a
local semgrep ruleset (.github/security/semgrep-rules.yml).
- Trust tiers: trusted authors (OWNER/MEMBER/COLLABORATOR) and non-PR events
pass through instantly; returning contributors auto-proceed on a clean scan;
first-timers are held by GitHub's native fork-approval gate.
Not a merge-required check: merge stays blocked transitively via the skipped
required pytest/e2e checks, and Maintainer Approval remains the ultimate gate.
Co-authored-by: Isaac
* ci: make security gate fail-open when scanner absent on main (bootstrap)
The gate checks out the scanner scripts from main so a PR cannot edit its own
gate, but before this change is merged the scripts do not exist on main, so the
Trust gate step exited 127 and skipped all CI. Proceed with a warning when the
scanner is absent; once merged the scripts are on main and the guard is inert.
Co-authored-by: Isaac
* fix(security-scan): satisfy ruff lint and correct stale workflow name
- lint-workflow-misuse.py: use a context manager when reading workflow files
(SIM115, addresses PR review comment) and a single tuple startswith (PIE810)
- secret-scan.py: formatter reflow of the HIGH_CONFIDENCE table (E501)
- update docstring/comment references from the old security-scan.yml to the
reusable security-gate.yml
Co-authored-by: Isaac
* test(security-scan): add temporary detector selftest harness
Pre-merge verification that runs the real detectors in CI against crafted
malicious + benign fixtures (secret scan, sensitive paths, workflow-misuse
lint, semgrep), asserting block-vs-permit exit codes. Needed because the gate
fail-opens as bootstrap until the scanner is on main, so this PR's own gate
never exercises the detectors. To be removed once validated and merged.
Co-authored-by: Isaac
* ci: gate ap-web tests behind the security scan on untrusted PRs
ap-web-tests.yml checks out the PR head and runs `npm ci` (install lifecycle
hooks) and `npm test` — untrusted code execution that the gate is meant to
cover. Add the same `needs: gate` precondition used by ci/lint/e2e/e2e-ui so
untrusted ap-web PRs are scanned before npm runs.
Co-authored-by: Isaac
* ci: run security gate in audit (non-blocking) mode; drop selftest harness
Introduce a single GATE_BLOCKING switch (default "false"): detector steps are
continue-on-error so the gate always succeeds and never skips downstream CI,
while still surfacing findings as annotations and a job summary. This lets the
scan be observed on real PRs before enforcing; flip GATE_BLOCKING to "true" to
block. Remove the temporary security-gate-selftest workflow and selftest.sh,
which were only needed to validate the blocking gate pre-merge.
Co-authored-by: Isaac
* test(entities): add unit tests for all untested entity DTOs
Cover Account, AccountToken, Agent, Comment, CommentsFingerprint,
StoredFile, PagedList, paginate_in_memory, SessionPermission,
ResolvedAccess, Policy, and extend conversation.py coverage with
ErrorData, CompactionData, NativeToolData, ResourceEventData,
TerminalCommandData, NON_CONTENT_ITEM_TYPES, and
_validate_type_matches_data.
Co-authored-by: Isaac
* lint
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
* fix: run Node.js setup and npm ci before pre-commit checks in lint workflow
---------
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Local `uv` runs rewrite uv.lock's `registry` URLs to whatever index is
configured on the developer's machine (e.g. the Databricks PyPI proxy).
This OSS repo must always commit the public PyPI URL so the lock is
reproducible for contributors without the proxy.
Two layers of defense:
- A pre-commit fixer (scripts/normalize_uv_lock_registry.py) normalizes
every registry source back to https://pypi.org/simple before a commit
lands, re-staging on change.
- A CI step in lint.yml runs the script's new --check mode against the
committed lockfile BEFORE any `uv` command. A bare `uv run pre-commit`
can't catch a committed proxy URL because `uv` re-syncs the working
tree to CI's index (pypi.org) first and masks it.
Covered by tests/test_normalize_uv_lock_registry.py.
Co-authored-by: Isaac
Daniel Lok