Support audited repo verbs from detached CI merge commits #1632

New issue

Closed

opened 2026-08-01 05:26:36 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-08-01 05:26:36 +00:00

Member

Problem

Ward refuses repository verbs in a standard Forgejo pull-request checkout because actions/checkout@v4 leaves the synthetic merge commit at detached HEAD.

Observed in infrastructure PR 710:

PR: coilyco-flight-deck/infrastructure#710
Failing run: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/1973
ward exec ansible-sync-test exits 2 before command execution with: ward: refusing repo verb "repo.ansible-sync-test" - HEAD is detached (no branch)
Checkout and dependency sync pass.
The separate secret scan passes.
Recent pull-request lint runs show the same failure, while main push lint runs pass.

Reproduction

Check out commit 4c0d32f9d7790b473b332041f9a9b27dce124bc7 detached.
Run ward exec ansible-sync-test. Ward refuses before executing the test.
Put the same commit on a local branch tracking origin/main.
Run the same Ward verb. All 13 tests pass.
Run ward exec pre-commit. The full suite passes.

Impact

Ward cannot run repository verbs against the standard synthetic pull-request merge commit. Consumer workflows must bypass Ward or synthesize a local tracking branch. This prevents merge-result validation across Ward-enabled pull-request workflows.

The current workaround is to create a temporary local branch at the checked-out merge commit and give it an upstream such as the fetched base branch. That preserves the tested merge commit, but it is consumer boilerplate and exposes an implementation detail of the audit gate.

Desired contract

Support detached CI commits without weakening workstation clean-and-synced safety:

Admit detached HEAD only under an explicit, validated CI context.
Record immutable HEAD SHA plus provider repository, event ref, base, head, and run attribution in the audit row.
Require a clean tree and validate the relevant commit relationships.
Fail closed when CI metadata is missing or inconsistent.
Cover Forgejo pull-request merge commits and ordinary branch pushes in tests.

Acceptance

ward exec runs from Forgejo default pull-request checkout when evidence is sufficient.
A local detached checkout without trusted CI evidence remains refused.
The audit row preserves commit and pull-request/run attribution.
Existing named-branch behavior remains unchanged.
The exec-verb contract and feature inventory describe CI detached-checkout support.

## Problem Ward refuses repository verbs in a standard Forgejo pull-request checkout because actions/checkout@v4 leaves the synthetic merge commit at detached HEAD. Observed in infrastructure PR 710: * PR: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/pulls/710 * Failing run: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/actions/runs/1973 * ward exec ansible-sync-test exits 2 before command execution with: ward: refusing repo verb "repo.ansible-sync-test" - HEAD is detached (no branch) * Checkout and dependency sync pass. * The separate secret scan passes. * Recent pull-request lint runs show the same failure, while main push lint runs pass. ## Reproduction 1. Check out commit 4c0d32f9d7790b473b332041f9a9b27dce124bc7 detached. 2. Run ward exec ansible-sync-test. Ward refuses before executing the test. 3. Put the same commit on a local branch tracking origin/main. 4. Run the same Ward verb. All 13 tests pass. 5. Run ward exec pre-commit. The full suite passes. ## Impact Ward cannot run repository verbs against the standard synthetic pull-request merge commit. Consumer workflows must bypass Ward or synthesize a local tracking branch. This prevents merge-result validation across Ward-enabled pull-request workflows. The current workaround is to create a temporary local branch at the checked-out merge commit and give it an upstream such as the fetched base branch. That preserves the tested merge commit, but it is consumer boilerplate and exposes an implementation detail of the audit gate. ## Desired contract Support detached CI commits without weakening workstation clean-and-synced safety: * Admit detached HEAD only under an explicit, validated CI context. * Record immutable HEAD SHA plus provider repository, event ref, base, head, and run attribution in the audit row. * Require a clean tree and validate the relevant commit relationships. * Fail closed when CI metadata is missing or inconsistent. * Cover Forgejo pull-request merge commits and ordinary branch pushes in tests. ## Acceptance * ward exec runs from Forgejo default pull-request checkout when evidence is sufficient. * A local detached checkout without trusted CI evidence remains refused. * The audit row preserves commit and pull-request/run attribution. * Existing named-branch behavior remains unchanged. * The exec-verb contract and feature inventory describe CI detached-checkout support.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-08-01 05:31:43 +00:00

Attach Forgejo PR merge commits for Ward validation #715

coilyco-ops referenced this issue from coilyco-flight-deck/umbra

2026-08-01 19:31:55 +00:00

Add typed CI attribution to audit records #269

coilyco-ops referenced this issue from coilyco-flight-deck/agentic-os

2026-08-01 19:34:20 +00:00

Inspect runner-only aos-cli-tests failure on PR 838 #846

coilyco-ops referenced this issue from a commit

2026-08-01 20:03:11 +00:00

fix(exec): admit audited Forgejo CI merge checkouts