fix(ci): share release candidates and enforce quality gates (TAN-843) - #1933
Conversation
Includes draft CI corrections and preserves the original published branch. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
Preserve stable Rust hex decoding, remove the unused presentation dependency, update vulnerable and yanked lockfile packages, and pin patched OpenSSL runtime packages without weakening audit gates. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
Require the reviewed Debian and security snapshot plus all exact OpenSSL package pins. Preserve digest, inventory, privilege and vulnerability checks. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
Replace the old Node 24.18.0 image with the official multi-architecture Node 24.20.0 trixie-slim digest in runtime and migration services. Update policy and provenance together, retaining both vulnerability scanners. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
Compare engine version and binary digest instead of all Dockerfile edits, keeping candidate and tagged-release checksum verification intact. Fix two current-stable server lints, add fail-closed pin-scope regressions, and cancel superseded runs only for pull requests. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
…ates TAN-843: remove the duplicate release build, verify same-run candidate provenance before container scanning, pin quality toolchains, align Cargo caches, and fix the three desktop lints hidden by the non-enforcing fallback. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Address CodeQL file-race review #55 by opening without following symlinks, inspecting the opened descriptor, and hashing bytes through that same descriptor. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
❌ AI Evaluation Gate FailedCritical path: ❌ no results produced (build or eval run failed — see job logs) See artifacts for detailed results. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 242035586c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Require opaque model binding IDs in install requests and source provider, credential and network metadata from the host-approved registry. Lock the selected binding ID and metadata, reject unapproved or inline client metadata, and run the focused contract workflow for schema-only edits. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
📊 AI Evaluation ResultsCritical path: 100.0% (5/5) See artifacts for detailed results. |
Carry the host-approved model-binding contract and focused schema-triggered contract workflow from the foundation PR into TAN-843 without rewriting published history. Co-authored-by: Codex <codex@openai.com> Signed-off-by: TacShade <198919272+tacshade@users.noreply.github.com> Signed-off-by: Codex <codex@openai.com>
📊 AI Evaluation ResultsCritical path: 100.0% (5/5) See artifacts for detailed results. |
2 participants
Tandem's foundation checks are passing, but the same Linux release candidate was built independently for enterprise composition and container scanning. Desktop Clippy also hid three errors behind
|| true, and floating Rust installs could introduce unrelated failures overnight.This is the first broader cleanup slice for TAN-843. It is based on #1931's verified head
4b37048e. Merge #1931 first; until then this PR includes its commits. The cleanup itself is these two commits. The PR targets main so the existing main-targeted quality workflows actually run.Changes:
Validation:
Baseline on #1931/#1932: each had 31 successful checks and 3 intentional skips. The independent engine build + scan took 22m10s / 20m33s in addition to enterprise composition's 34m55s / 27m50s. Actual cleanup savings are not yet measured.
This slice conservatively runs the full enterprise composition on every Security Assurance invocation. Component selection and fast-PR/full-platform separation remain TAN-843 follow-ups; no runtime, isolation, approval, migration or advisory suite was removed. The engine scan now waits for the shared producer, so reduced runner work does not necessarily shorten the critical path. Repository branch protection was not edited;
Security Assurance Resultis available to require.Review follow-up: CodeQL flagged a pathname check/read race in the new candidate verifier. Commit
c6b218820e1e1da712989af992d5048fceb98858opens withO_NOFOLLOW, checks the opened descriptor and reads through that same descriptor. All 16 focused tests pass, including symlink rejection. The published tree again matches the validated local tree. New-head full CI and CodeQL confirmation are pending; no scanner suppression was added.Review triage — 2026-09-05:
Solution Contractworkflow watchesspecs/solutions/**, crate/dependency changes and its own configuration. It runs the existing contract suite once; the duplicate explicit invocations in Engine CI's OS matrix are removed. Schema-only edits do not need the full engine matrix to exercise schema drift.The request-metadata regression was observed failing before the fix and passing afterwards. All 19 solution contract tests, all-targets crate Clippy, the offline fixture, workflow policy, actionlint and formatting pass locally. Foundation fix: db308347; imported into cleanup by cee502a1. Both published trees match their locally validated trees. New-head CI is running; earlier green checks do not establish new-head completion.