fix(exec): admit audited Forgejo CI merge checkouts #1633

Merged

coilysiren merged 2 commits from fix/detached-ci-exec into main

2026-08-01 20:26:20 +00:00

coilyco-ops commented

2026-08-01 20:03:43 +00:00

Member

Bug Description

Ward refused repository verbs from the detached synthetic merge commit produced by a standard Forgejo pull-request checkout.

Fixes #1632

Root Cause

The execution gate required a named branch with an upstream, and the shared audit record had no typed field for immutable CI attribution.

Fix

Consume cli-guard v0.130.0, which adds the provider-neutral typed CI audit context from cli-guard #269.
Admit detached HEAD only when Forgejo runner flags, required GITHUB metadata, origin, workspace, event payload, immutable HEAD, and both merge parents agree.
Preserve provider, repository, event, pull-request, commit, workflow, job, actor, and run attribution in the accepted audit row.
Keep ordinary named-branch behavior unchanged. Local, dirty, incomplete, or inconsistent detached checkouts fail closed, even with the dirty-tree override.
Update the CLI help, README, execution contract, audit reference, and feature inventory.

How to Verify

Run ward exec test-cmd to exercise the synthetic Forgejo merge checkout and decoded JSONL audit row.
Run ward exec test for the full repository suite.
Run ward exec test-windows-compile and ward exec pre-commit for cross-platform and catalog validation.

Test Plan

Added regression coverage for accepted Forgejo PR merge checkouts.
Added fail-closed cases for local detached HEAD, missing metadata, inconsistent refs, inconsistent parents, and a dirty checkout.
Added an end-to-end declared verb execution that decodes and checks the emitted audit row.
Confirmed ordinary branch pushes retain the existing path.
Full tests, lint, vet, Windows compilation, and pre-commit pass.

Risk Assessment

Medium. The change is isolated to detached HEAD handling in the repository verb gate. Named branches return through the previous path before CI metadata is read. The main compatibility risk is Forgejo metadata drift, which fails closed with an evidence-specific error.

## Bug Description Ward refused repository verbs from the detached synthetic merge commit produced by a standard Forgejo pull-request checkout. Fixes #1632 ## Root Cause The execution gate required a named branch with an upstream, and the shared audit record had no typed field for immutable CI attribution. ## Fix * Consume cli-guard v0.130.0, which adds the provider-neutral typed CI audit context from cli-guard #269. * Admit detached HEAD only when Forgejo runner flags, required GITHUB metadata, origin, workspace, event payload, immutable HEAD, and both merge parents agree. * Preserve provider, repository, event, pull-request, commit, workflow, job, actor, and run attribution in the accepted audit row. * Keep ordinary named-branch behavior unchanged. Local, dirty, incomplete, or inconsistent detached checkouts fail closed, even with the dirty-tree override. * Update the CLI help, README, execution contract, audit reference, and feature inventory. ## How to Verify 1. Run `ward exec test-cmd` to exercise the synthetic Forgejo merge checkout and decoded JSONL audit row. 2. Run `ward exec test` for the full repository suite. 3. Run `ward exec test-windows-compile` and `ward exec pre-commit` for cross-platform and catalog validation. ## Test Plan * [x] Added regression coverage for accepted Forgejo PR merge checkouts. * [x] Added fail-closed cases for local detached HEAD, missing metadata, inconsistent refs, inconsistent parents, and a dirty checkout. * [x] Added an end-to-end declared verb execution that decodes and checks the emitted audit row. * [x] Confirmed ordinary branch pushes retain the existing path. * [x] Full tests, lint, vet, Windows compilation, and pre-commit pass. ## Risk Assessment Medium. The change is isolated to detached HEAD handling in the repository verb gate. Named branches return through the previous path before CI metadata is read. The main compatibility risk is Forgejo metadata drift, which fails closed with an evidence-specific error.

coilyco-ops added 1 commit

2026-08-01 20:03:44 +00:00

fix(exec): admit audited Forgejo CI merge checkouts

test / test (pull_request) Failing after 35s

Details

f88b891e00

Validate Forgejo runner metadata, origin, workspace, event payload, detached HEAD, and both merge parents before running a repository verb. Attach the immutable pull-request and run attribution through cli-guard v0.130.0 while preserving named-branch behavior and refusing local detached checkouts.

Closes #1632

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Codex <noreply@openai.com>

coilyco-ops requested review from coilysiren

2026-08-01 20:03:44 +00:00

coilyco-ops referenced this pull request

2026-08-01 20:21:01 +00:00

Investigate uncached cmd/ward suite flake during PR verification #1634

coilyco-ops added 1 commit

2026-08-01 20:23:17 +00:00

test(exec): make detached CI refusal assertion hermetic

test / test (pull_request) Successful in 51s

Details

1db218d7df

Assert the first required Forgejo runner marker after the fixture clears CI metadata. This keeps the local-detached regression independent of the host environment and prevents Go test cache reuse from masking the expectation.

Fixes #1632

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Codex <noreply@openai.com>