Repository navigation
Restrict production deployment transport and sandbox administration - #283
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| if args.check_schema: | ||
| _, contract = contract_digest(args.root) | ||
| approved = json.loads((args.root / contract['approved_schema']).read_text()) |
There was a problem hiding this comment.
Suggestion: The shipped contract deploy/geta-deploy.json has no approved_schema key, so
every --check-schema invocation raises KeyError (caught and reported as a
generic failure). Validate the key explicitly and emit a clear error, or add
the key to the contract. [possible issue, importance: 7]
| if args.check_schema: | |
| _, contract = contract_digest(args.root) | |
| approved = json.loads((args.root / contract['approved_schema']).read_text()) | |
| if args.check_schema: | |
| _, contract = contract_digest(args.root) | |
| approved_path = contract.get('approved_schema') | |
| if not approved_path: | |
| raise ValueError('contract declares no approved_schema; cannot verify migrations') | |
| approved = json.loads((args.root / approved_path).read_text()) |
There was a problem hiding this comment.
Fixed in 79a43a9: --check-schema now explicitly requires an approved_schema contract entry and validates its source-root path. A regression test checks the clear CLI error. Openplotva deployment does not invoke this optional mode.
| - name: Request application-only deployment | ||
| env: | ||
| GETA_SSH_TARGET: ${{ secrets.GETA_SSH_TARGET }} | ||
| GETA_DEPLOY_ROOT: ${{ secrets.GETA_DEPLOY_ROOT }} | ||
| DEPLOY_SHA: ${{ github.sha }} | ||
| DEPLOY_OPERATION: deploy | ||
| OPENPLOTVA_IMAGE_DIGEST: ${{ steps.image.outputs.digest }} |
There was a problem hiding this comment.
Suggestion: The GHCR pull token is no longer sent and the contract sets registry_auth: false,
but the image is pushed under ghcr.io/iamwavecut/openplotva using the ephemeral
GITHUB_TOKEN. If that package is private, the host broker cannot pull it and the
deployment will fail. Confirm the package is public or arrange an authenticated
pull path on the host. [general, importance: 5]
| - name: Request application-only deployment | |
| env: | |
| GETA_SSH_TARGET: ${{ secrets.GETA_SSH_TARGET }} | |
| GETA_DEPLOY_ROOT: ${{ secrets.GETA_DEPLOY_ROOT }} | |
| DEPLOY_SHA: ${{ github.sha }} | |
| DEPLOY_OPERATION: deploy | |
| OPENPLOTVA_IMAGE_DIGEST: ${{ steps.image.outputs.digest }} | |
| - name: Request application-only deployment | |
| env: | |
| DEPLOY_SHA: ${{ github.sha }} | |
| DEPLOY_OPERATION: deploy | |
| OPENPLOTVA_IMAGE_DIGEST: ${{ steps.image.outputs.digest }} | |
| run: | | |
| set -euo pipefail | |
| python3 scripts/geta-deploy-request.py | | |
| ssh -T -i ~/.ssh/geta_deploy -o ServerAliveInterval=30 -o ServerAliveCountMax=40 \ | |
| deploy@geta.moe "deploy $DEPLOY_SHA" |
There was a problem hiding this comment.
Confirmed through the package API: ghcr.io/iamwavecut/openplotva is public. Anonymous host pulls are intentional; the production README now states this explicitly.
| if key != 'audience'] | ||
| query.append(('audience', 'geta-deploy')) | ||
| target = endpoint.path + '?' + urllib.parse.urlencode(query) | ||
| connection = http.client.HTTPSConnection(endpoint.hostname, timeout=15) |
There was a problem hiding this comment.
Audited: this helper requires modern Python (Path.is_relative_to alone requires Python 3.9+), and hosted CI uses current Python. HTTPSConnection therefore verifies certificates and hostnames by default. The endpoint is restricted to GitHub Actions HTTPS origins, non-200 replies are rejected, and redirects are not followed. No legacy Python TLS behavior or disabled verification is used.
Changes
zstd 0.14.3,zstd-safe 8.2.0andzstd-sys 2.1.2; no new audit exceptions.Verification
Deployment risk and verification plan
The production transport changes, but application Rust code, database schema and the running privileged sandbox do not. The Zstd upgrade fixes the existing dependency gate and is covered by update/server tests plus full workspace CI.
The host profile was separately reapplied with the old image and protected settings; health/auth checks passed. A root-only backup completed with verified checksums. Merge only with green CI, deploy the exact main SHA, verify health/readiness and running image identity, exercise rollback to the retained baseline and return to the new image, then revoke only this project's old administrator key. Preserve volumes and rollback images. Sandbox/infrastructure changes remain separate administrator operations.