fix(#854): update stale policy refs and mask GITLAB_TOKEN in post-code - #855
Conversation
Three doc references pointed to policies/github/code.yaml, which does
not exist — GitHub inherits policies/base.yaml. Updated docs/code.md
and docs/network-policy.md to reference the correct path.
Added ::add-mask:: for GITLAB_TOKEN in scripts/post-code.src.sh next
to the existing PUSH_TOKEN masking so the token value is redacted from
GHA logs before the export GITLAB_TOKEN="${PUSH_TOKEN}" reassignment.
Rebuilt scripts/post-code.sh via make script-build.
Note: pre-commit could not run (network restrictions in sandbox).
The post-script runs pre-commit authoritatively on the runner.
Closes #854
|
🤖 Finished Review · ✅ Success · Started 11:22 PM UTC · Completed 11:34 PM UTC Commit: |
ReviewFindingsMedium
Low
Previous runReviewFindingsMedium
Low
Previous run (2)ReviewFindingsHigh
Medium
Low
Next steps:
Previous run (3)ReviewFindingsMedium
Low
Labels: PR modifies code-agent post-scripts and documentation files fixing stale policy references |
|
/fs-fix - Rebase, fix all review issues and also the failed functional test. |
|
🤖 Finished Fix · ✅ Success · Started 11:37 PM UTC · Completed 11:47 PM UTC Commit: |
- Update stale policy reference in agents/triage.md from policies/github/triage.yaml to policies/base.yaml (review finding). - Fix functional-tests-complete rollup to pass when gate is skipped on pull_request_target labeled events for non-ok-to-test labels, preventing false failures on unrelated label additions. - Update check-rollup-result-test.sh to match the corrected behavior. Addresses review feedback on #855
🔧 Fix agent — iteration 1 (human-triggered)Addressed 2 of 3 review findings. Fixed stale policy reference in agents/triage.md and fixed functional-tests-complete rollup false-failure caused by non-relevant label events. Disagreed with 1 finding (protected-path is informational, not actionable as code). Branch is already on latest main — no rebase needed. Fixed (2):
Disagreed (1):
Tests: passed Decision points
Next steps:
|
|
🤖 Finished Review · ✅ Success · Started 11:48 PM UTC · Completed 12:06 AM UTC Commit: |
|
/fs-fix - Rebase, fix all review issues and resolve the conversations. |
|
🤖 Finished Fix · ✅ Success · Started 12:13 AM UTC · Completed 12:21 AM UTC Commit: |
- Revert scope-creep: remove gate-skipped pass-through from check-rollup-result.sh and revert test expectation in check-rollup-result-test.sh (unrelated to issue #854) - Fix stale-doc: update policies/fix.yaml reference to policies/base.yaml in docs/network-policy.md Addresses review feedback on #855
🔧 Fix agent — iteration 2 (human-triggered)Addressed 3 of 5 review findings by reverting scope-creep CI changes and fixing a stale docs reference. Disagreed with 2: agents/triage.md change is defensible per reviewer's own assessment, and rebase was not possible due to sandbox network restrictions. Fixed (3):
Disagreed (2):
Tests: passed Decision points
Next steps:
|
|
🤖 Finished Review · ✅ Success · Started 12:22 AM UTC · Completed 12:36 AM UTC Commit: |
Superseded by updated review
|
/fs-fix - Rebase, fix all review issues and resolve the conversations. Update #854 to include the triage file. It needs to be fixed. |
|
🤖 Finished Fix · ✅ Success · Started 12:46 AM UTC · Completed 12:53 AM UTC Commit: |
Update the comment in agents/triage.md to accurately describe how curl is excluded on GitHub. The binary allowlists live in profile files (e.g. profiles/fullsend-github-ro.yaml), not in policies/base.yaml which has no binaries section. Curl is excluded by omission from the profile binary allowlists. Addresses review feedback on #855
🔧 Fix agent — iteration 3 (human-triggered)Fixed 1 of 2 review findings. Corrected the curl exclusion comment in agents/triage.md to reference profile binary allowlists instead of policies/base.yaml. Protected-path finding is informational (not actionable). Could not update issue #854 due to sandbox API restrictions — human should update the issue to include agents/triage.md. Fixed (1):
Disagreed (3):
Tests: passed Decision points
Next steps:
|
|
🤖 Finished Review · ✅ Success · Started 12:55 AM UTC · Completed 1:10 AM UTC Commit: |
|
🤖 Finished Retro · ✅ Success · Started 1:38 AM UTC · Completed 1:54 AM UTC Commit: |
Retro: PR #855 — fix(#854): update stale policy refs and mask GITLAB_TOKENWorkflow overview: Issue #854 (filed by ggallen) was a follow-up to PR #813, requesting 2 fixes: update 3 stale Total agent runs: 13 (1 triage, 1 code, 5 review, 4 fix, 1 retro, 1 cancelled review). Time from issue creation to merge: ~2.5 hours. What went well
Rework drivers
Evidence for existing issues (not filed as new proposals)
Proposals filed
|
Summary
policies/github/code.yaml(which does not exist) indocs/code.mdanddocs/network-policy.mdto point topolicies/base.yaml, the actual policy file used by the GitHub forge.::add-mask::${GITLAB_TOKEN}inscripts/post-code.src.shalongside the existingPUSH_TOKENmasking to prevent the token from appearing in GHA log output before theexport GITLAB_TOKEN="${PUSH_TOKEN}"reassignment.scripts/post-code.shviamake script-buildto keep the bundled artifact in sync.Testing
make check-bundleconfirms bundled scripts match source.bash scripts/post-code-test.shpasses all tests.hack/lint-agent-docspasses all checks.grep -r 'policies/github/code.yaml' docs/returns no matches, confirming stale references are removed.grep '::add-mask::.*GITLAB_TOKEN' scripts/post-code.src.shconfirms the masking line is present.Closes #854
Post-script verification
agent/854-fix-stale-refs-masking)3794c2d09458521c03ecda01832d43a05fbacb37..HEAD)