clawlter/memory-symphony
Watch
1
0
Fork
You've already forked memory-symphony
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: Harden score CI validation #8

Closed
clawlter wants to merge 2 commits from audit/ci-trust-lilypond into main
pull from: audit/ci-trust-lilypond
merge into: clawlter:main
Conversation 1 Commits 2 Files changed 5 +387 -8
clawlter commented 2026-07-12 14:51:13 -04:00
Owner
Copy link

Summary

  • Pin the Forgejo checkout action by immutable commit and keep checkout credentials non-persistent.
  • Provision LilyPond 2.26.0 through a rootless, no-Docker bootstrap that downloads the official archive, verifies its reviewed SHA-256 before safe extraction, then exposes only that executable to the smoke gate.
  • Keep bounded all-entrypoint compilation, generated-artifact enforcement, and structured CI-policy validation; policy mutation probes cover weakened checkout pins, timeout, credentials, compiler provisioning, generated diff enforcement, and the toolchain checksum.

Verification

  • python3 tests/validate_ci_policy.py
  • make test
  • python3 tools/ci_lilypond_toolchain.py -- python3 tools/ci_lilypond_smoke.py — 29 entrypoints compiled into a disposable directory.
  • Undefined-compiler negative control fails closed.
  • git diff --exit-code -- build docs score and git diff --check
  • Forgejo Actions run 15 passed on the PR head: 13m55s total; the pinned LilyPond compiler step passed in 11m46s and the generated-artifact step passed.

Review status

Draft/WIP pending review; no production deployment or service restart is involved.

## Summary - Pin the Forgejo checkout action by immutable commit and keep checkout credentials non-persistent. - Provision LilyPond 2.26.0 through a rootless, no-Docker bootstrap that downloads the official archive, verifies its reviewed SHA-256 before safe extraction, then exposes only that executable to the smoke gate. - Keep bounded all-entrypoint compilation, generated-artifact enforcement, and structured CI-policy validation; policy mutation probes cover weakened checkout pins, timeout, credentials, compiler provisioning, generated diff enforcement, and the toolchain checksum. ## Verification - `python3 tests/validate_ci_policy.py` - `make test` - `python3 tools/ci_lilypond_toolchain.py -- python3 tools/ci_lilypond_smoke.py` — 29 entrypoints compiled into a disposable directory. - Undefined-compiler negative control fails closed. - `git diff --exit-code -- build docs score` and `git diff --check` - Forgejo Actions run 15 passed on the PR head: 13m55s total; the pinned LilyPond compiler step passed in 11m46s and the generated-artifact step passed. ## Review status Draft/WIP pending review; no production deployment or service restart is involved.
Harden score CI validation
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 12s
Details
6ed9ba4688
clawlter changed title from Harden score CI validation to WIP: Harden score CI validation 2026-07-12 16:39:42 -04:00
ci: provision pinned LilyPond compiler
All checks were successful
Score CI / Validate generated score artifacts (pull_request) Successful in 13m55s
Details
b647dcaa46
clawlter commented 2026-07-14 08:16:39 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:16:39 -04:00
All checks were successful
Score CI / Validate generated score artifacts (pull_request) Successful in 13m55s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/memory-symphony!8
No description provided.