fix(strix): map official modes without branch-selected dispatch - #1062
Draft
cursor[bot] wants to merge 3 commits into
Draft
fix(strix): map official modes without branch-selected dispatch#1062cursor[bot] wants to merge 3 commits into
cursor[bot] wants to merge 3 commits into
Conversation
Set STRIX_SCAN_MODE from the GitHub event instead of inheriting Quick on every trigger. Required PR and repository_dispatch evidence stay quick; push to develop stays quick; push to main/master and the weekly schedule use standard. Restore workflow_dispatch with a scan_mode choice so an incomplete RC can be scanned by hand. Deep is manual-only and is the only path that raises the 360/340/4h/4.5h budget. Do not invent release or RC-tag triggers. Allowlist official CLI mode names and reject the unofficial normal alias. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
grep -F treats an embedded newline as a second pattern, so a leading newline made the release-trigger guard match every file. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Map pull_request_target, repository_dispatch, and develop pushes to quick, and protected main/master plus the weekly schedule to standard. Leave Deep unwired on this privileged workflow so a caller-selected revision cannot mint OIDC tokens or publish a fake strix status. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prefer this over #1054.
Why
#1054 correctly maps official Strix CLI modes (
quick,standard,deep) and stops every trigger inheriting Quick. It also restoresworkflow_dispatchon the privileged org-requiredstrix.yml. GitHub's manual UI/API lets the caller select a branch, and that revision supplies the workflow YAML (id-token: writeplusstatuses: writefor thestrixcommit-status context) before any in-job trusted-source checkout can run. A feature-branch dispatch can skip the scan and publish a fake passingstrixstatus. The same class of defect already failedtest_no_central_workflow_exposes_branch_selected_manual_dispatchon the quality job (docs/doctoring/strix-legal-git-paths.md).What landed
pull_request_target/repository_dispatch/pushtodevelopstay Quick;pushtomain/masterand the Monday 03:00 UTC schedule use Standard with the existing 120/100/90/95 budget.workflow_dispatch,release:,v*-rc*, orclient_payload.scan_modeon this privileged file.quick|standard|deepand rejectnormal.docs/doctoring/strix-scan-mode-dual-flow.md(APA 7th; Strix, n.d.; NIST SP 800-218; CWE-345).Next action
Review and merge this head. Do not merge #1054. Do not add
workflow_dispatchback ontostrix.ymlto recover Deep.Evidence
python3 -m pytest tests/test_strix_scan_mode_policy.py tests/test_required_workflow_queue_contract.py tests/test_strix_workflow_dependency_hashes.py tests/test_strix_changed_path_policy.py tests/test_strix_quality_timeout_fixture_budget.py— 89 passedbash scripts/ci/strix_required_workflow_smoke.sh— passed