continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

verify(P43): code review — 1 P0 auto-fixed, 1 P1 auto-fixed, 3 P1 flagged
acdl-ci / Lint (push) Successful in 6s
Details
acdl-ci / Test (push) Successful in 26s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details

Browse Source 
---ci---
phase: 43
milestone: v1.9
status: verify
lessons:
  - P0 fix: run_platform.sh HITL gate passed approver via string interpolation into Python (GITHUB_ACTOR injection vector) — fixed by passing env vars (ACDL_HITL_*) read via os.environ
  - P1 fix: attestation_matrix._is_fresh accepted future-dated artifacts (negative age bypassed freshness) — fixed with negative-age guard + test
  - P1 flagged: WizClient._post does not check GraphQL errors (silent empty-list mask)
  - P1 flagged: WizClient._post no SSRF validation on WIZ_API_URL
  - P1 flagged: contract_resolver._load_env duplicates environment_check.load (can drift)
---/ci---

Multi-persona review of the v1.9 diff (v1.8.0..HEAD). Review pass 2
(post-complete) caught issues the initial self-review missed:

P0-INJECT (auto-fixed): scripts/run_platform.sh Step 7b interpolated
$APPROVER (GITHUB_ACTOR/GITEA_ACTOR) directly into a Python string
literal — an attacker-controllable username containing shell/python
metacharacters would execute arbitrary Python. Fixed: approver, contract
id, and env are now passed as environment variables to the subprocess
and read via os.environ[...] (no string interpolation).

P1-FRESHNESS (auto-fixed): core/attestation_matrix.py _is_fresh
accepted future-dated artifacts (negative age.days <= window_days).
Fixed: added age.total_seconds() < 0 guard rejecting future timestamps.
Test added: test_freshness_rejects_future_dated_artifact.

3 P1 flagged for post-hoc:
- WizClient._post does not surface GraphQL errors (silent empty mask)
- WizClient._post no SSRF validation on WIZ_API_URL (operator-supplied, low risk)
- contract_resolver._load_env duplicates environment_check.load (drift risk)

REVIEW.md updated with the findings. 494 tests pass; run_ci.sh + run_platform.sh --check-only green.
This commit is contained in:
Jon Chery
2026-07-23 11:54:58 +00:00
parent c4d966359f
commit 6e41f09c6e
4 changed files with 77 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run_platform.sh
+6 -3
View File
@@ -343,16 +343,19 @@ if [ "$RESOLVED_ENV" != "dev" ]; then
echo " the gate would block in a real CI run. Passing for local." >&2
fi
python3 -c "
import sys
import os, sys
sys.path.insert(0, '.')
from core.hitl_gates import attest
ok, reason = attest('$CONTRACT_ID', '$RESOLVED_ENV', '$APPROVER' or 'local-test')
contract_id = os.environ['ACDL_HITL_CONTRACT_ID']
env = os.environ['ACDL_HITL_ENV']
approver = os.environ.get('ACDL_HITL_APPROVER', '') or 'local-test'
ok, reason = attest(contract_id, env, approver)
if ok:
print(f'HITL PASS: {reason}')
else:
print(f'HITL BLOCK: {reason}', file=sys.stderr)
sys.exit(1)
" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
" ACDL_HITL_CONTRACT_ID="$CONTRACT_ID" ACDL_HITL_ENV="$RESOLVED_ENV" ACDL_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
else
echo "Environment is dev — autonomous (no HITL gate)."
fi