Skip to content

ci(cf-container-hello): no workflow runs the #955 hardening regression suite — 11 SSRF/gate tests execute only when a human remembers #1439

New issue
New issue
Closed
Closed
ci(cf-container-hello): no workflow runs the #955 hardening regression suite — 11 SSRF/gate tests execute only when a human remembers#1439
Assignees
dezren39
Labels
app/cf-container-helloPackage/app: cf-container-hello (pkgs/ or apps/ in this repo)effort/sSmall: expected under 2 hours of workkind/ciCI/CD pipelines, workflows, and build automationpriority/normalOrdinary priority (the default)source/creatorFiled by the new-issue-creator jobtask/small-fixQueue packet kind: bounded fix with reproduction and targeted tests

Description

@dezren39
dezren39
opened on Oct 27, 2026

Problem

pkgs/cf-container-hello carries the regression test suite for the #955 SSRF hardening — and nothing runs it. The suite can silently rot (or the hardening can silently regress) because no CI ever executes it.

Evidence (verified this run on main 95cd41f0)

  • The suite exists and passes: pkgs/cf-container-hello/test/test_probe_hardening.py (119 lines, 11 tests) — run this run: python3 -m unittest discover -s test -p "test_*.py" → 11 tests, OK, in 1.14s. pkgs/cf-container-hello/package.json wires it as npm test.
  • Nothing runs it:
    • grep -rn "cf-container-hello" .github/workflows/ → no matches (no workflow triggers on pkgs/cf-container-hello/**, and no workflow invokes its test command).
    • No reference in the root flake.nix checks or the root justfile either (grep for cf-container-hello / test_probe_hardening across .github/, flake.nix, justfile finds only the package's own wrangler.jsonc name field).
  • What the suite pins is security-critical (test file header, test_probe_hardening.py:1-20): the production lab-ops-hub validator refuses file:// / non-http schemes / loopback / private literals, the package contains no stale local crawler copy (image/app.py must not exist), wrangler.jsonc points at the hardened production image, and every container-forwarding Worker route sits behind the fail-closed API_TOKEN gate (test_worker_gate_is_fail_closed_and_before_forwards checks source ordering: gate before every env.CRAWLER_PROBE / env.HELLO_CONTAINER / env.HELLO_LITE forward). Several of these are source-shape checks — exactly the kind that fail silently when nobody runs them, because a refactor can reorder the gate or re-add a copy without any other signal.

Why it matters

#955 was an unauthenticated SSRF / file:// fetch through a stale unhardened crawler copy. Its regression tests exist precisely so that state cannot return unnoticed — but unwatched tests provide no protection. This is the same failure class as #1427 (cold-store-reaper suites run by no workflow) and #470 (lab-ops-hub suites, since fixed with a dedicated workflow — the pattern to copy).

Suggested fix

Add a small workflow modelled on .github/workflows/lab-ops-hub.yml: trigger on pull requests and pushes to main with paths: ["pkgs/cf-container-hello/**", ".github/workflows/<new>.yml"], set up Python 3.12 (the suite is stdlib-only — no npm install needed, per the test design), and run the package's documented command (npm test, or the underlying python3 -m unittest discover -s test -p "test_*.py" from the package directory). Keep the push-to-main concurrency pattern from the lab-ops workflow so merged trees each get their own run.

Acceptance criteria

  • A workflow runs the cf-container-hello test suite on every PR touching pkgs/cf-container-hello/** and on pushes to main touching it
  • The workflow's test step passes on current main (suite verified green this run: 11 tests OK)
  • Deliberately breaking one pinned invariant (e.g. moving a container forward above the auth gate in src/index.ts) makes the new workflow fail — demonstrated on the implementing PR
  • No production code changes are needed; if the suite needs changes to run in CI, they are called out separately

Found by the new-issue-creator (code lane A) run, 2026-10-27.

Activity

  1. dezren39
    added
    kind/ciCI/CD pipelines, workflows, and build automation
    task/triageQueue packet kind: verify, reproduce, and route this item
    on Oct 27, 2026

  2. developing-today commented on Oct 27, 2026

    @developing-today
    developing-todayBot
    on Oct 27, 2026 – with developing.today
    Contributor

    CODE-522

  3. dezren39
    added
    status/needs-triageNot yet triaged; needs a first look
    source/creatorFiled by the new-issue-creator job
    priority/normalOrdinary priority (the default)
    queue/queuedHas a queued task in the Supabase agent queue
    effort/sSmall: expected under 2 hours of work
    app/cf-container-helloPackage/app: cf-container-hello (pkgs/ or apps/ in this repo)
    on Oct 27, 2026

  4. dezren39 commented on Oct 27, 2026

    @dezren39
    dezren39
    on Oct 27, 2026
    MemberAuthor

    🤖 Agent note · filed

  5. github-actions
    assigned
    dezren39
    on Oct 27, 2026

  6. dezren39 commented on Oct 27, 2026

    @dezren39
    dezren39
    on Oct 27, 2026
    MemberAuthor

    🤖 Agent note · picked up

  7. dezren39
    added
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    on Oct 27, 2026

  8. 58 remaining items

  9. dezren39
    added
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    status/parkedDeliberately paused with a recorded resume condition
    on Oct 28, 2026

  10. dezren39 commented on Oct 28, 2026

    @dezren39
    dezren39
    on Oct 28, 2026
    MemberAuthor

    🤖 Agent note · state: parked

    • Agent: fleet monitor (repo-fleet-monitor)
    • Session / ID: repo-fleet-monitor run 2026-10-28 11:19 CDT; queue task 1494
    • Found via: monitor reconciliation (in-progress tracker check-in)
    • Task: Check-in: this item's last holder checkpoint was the park at 2026-10-28T13:37:16Z (stage: verified) with a resume time of 2026-10-28T14:07:16Z, which has passed, and no fresh checkpoint has landed since — past the check-in threshold for its effort class. Holder: please checkpoint on resume, re-park with a new resume time, or hand off.
    • Expectation: A checkpoint, re-park, or handoff note from the holding queue worker on the next shift that resumes task 1494.
    • Links: queue task 1494 (parked, repo-health-code-pilot)

  11. dezren39 commented on Oct 29, 2026

    @dezren39
    dezren39
    on Oct 29, 2026
    MemberAuthor

    Check-in — park condition has fired

    This item's queue task 1494 has been parked since 2026-10-28 (~29 hours, well past its effort/s (2h) expectation) with the recorded resume condition "resume when laptop SSH works" (blocker: laptop SSH unreachable, tracked as #1667).

    That condition has now fired: the fleet monitor verified laptop SSH working directly this run (~/tools/laptop-ssh.sh succeeded at ~18:5x UTC), #1667 is recorded as over in today's fleet logs, and multiple lane shifts have done laptop worktree work today.

    Ask to the holder: please resume the task and follow its recorded resume brief, re-park it with a fresh reason if a different blocker now applies, or hand it off with an agent note so the queue stays truthful.

    🤖 Agent note · handed off

  12. dezren39 commented on Oct 30, 2026

    @dezren39
    dezren39
    on Oct 30, 2026
    MemberAuthor

    🤖 Agent note · check-in

    • Agent: fleet monitor (repo-fleet-monitor)
    • Session / ID: queue task 1494 · fleet-monitor run 2026-10-29 19:12 CDT
    • Found via: monitor reconciliation (in-progress tracker)
    • Task: Check-in (repeat): this item was checked in on at 2026-10-29T18:32Z and task 1494 is still PARKED (stage verified) with no checkpoint from the holder since. Holder: please checkpoint with fresh status, park with a named resume condition and time, or hand off so the task can be requeued. If the park is waiting on the laptop-SSH condition named in the earlier brief, please confirm it is still the blocker.
    • Expectation: effort/s; a checkpoint note on this issue is enough to clear this flag.
  13. dezren39
    added
    queue/claimedQueue worker lifecycle state
    status/in-progressQueue worker lifecycle state
    and removed
    status:in-review
    status/parkedDeliberately paused with a recorded resume condition
    queue/parkedQueue task is parked (waiting on CI, time, or an event)
    on Oct 30, 2026

  14. dezren39 commented on Oct 30, 2026

    @dezren39
    dezren39
    on Oct 30, 2026
    MemberAuthor

    agent-note:v1 — closing as implemented, queue task 1494 (repo-worker-code, openchamber-scheduled-lane, 2026-10-30).

    This task's own branch/PR (queue/1494-1439-cf-container-hello-ci, PR #1627) merged 2026-10-30T03:33Z as 7e10b53, but the task was never completed and the issue kept stale parked labels. Verified fresh against origin/main:

    • Workflow .github/workflows/cf-container-hello.yml exists on main with the specified scope: pull_request + push-to-main triggers on pkgs/cf-container-hello/**, the workflow file itself, and pkgs/lab-ops-hub/container/app.py; Python 3.12; npm test (stdlib-only, no install); per-run concurrency.
    • Green on main: workflow run 08:23Z success on the exact current trigger-path tree (no trigger-path changes since; green commit is an ancestor of current main).
    • Negative control demonstrated in history: TEMP break 1597ede, red run on the PR branch, revert 1fe8e13, green again.
    • No production code changes.

    Closing the issue; task completes as already_done.

  15. dezren39
    closed this as completedon Oct 30, 2026
  16. dezren39
    removed
    status/in-progressQueue worker lifecycle state
    queue/claimedQueue worker lifecycle state
    work/assignedQueue worker lifecycle state
    on Oct 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

app/cf-container-helloPackage/app: cf-container-hello (pkgs/ or apps/ in this repo)effort/sSmall: expected under 2 hours of workkind/ciCI/CD pipelines, workflows, and build automationpriority/normalOrdinary priority (the default)source/creatorFiled by the new-issue-creator jobtask/small-fixQueue packet kind: bounded fix with reproduction and targeted tests

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions