From a7b24bf9a0e3efa2998d5b727603197b851c8e95 Mon Sep 17 00:00:00 2001 From: Josh Date: Sat, 7 Nov 2026 20:20:58 -0500 Subject: [PATCH] ci: approve the sectioned review engine --- scripts/check_agent_review_workflow.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/check_agent_review_workflow.py b/scripts/check_agent_review_workflow.py index 5dad23c..736fdf7 100644 --- a/scripts/check_agent_review_workflow.py +++ b/scripts/check_agent_review_workflow.py @@ -9,7 +9,7 @@ # Existing caller-policy contract: approve a source/shape on main, migrate, # then remove the predecessor approval. Never execute proposed target code. MAX_WORKFLOW_BYTES = 65536 -APPROVED_REVIEWER_SHAS = ("eb1819f4a796bc3d3f0be61fc5dbe691253c7746", +APPROVED_REVIEWER_SHAS = ("e0e5662a0612d24f041130a455f8c8898d6239fc", "250991344a567c7c0832869ecce9279c8b0084c5") EXPECTED_CONTRACTS = ('name: Review caller contract\n\non:\n pull_request:\n types: [opened, synchronize, reopened]\n paths:\n - \'.github/workflows/agent-review.yaml\'\n - \'.github/agent-review.toml\'\n - \'.github/workflows/review-caller-contract.yaml\'\n - \'scripts/check_agent_review_workflow.py\'\n pull_request_target:\n types: [opened, synchronize, reopened]\n paths:\n - \'.github/workflows/agent-review.yaml\'\n - \'.github/agent-review.toml\'\n - \'.github/workflows/review-caller-contract.yaml\'\n - \'scripts/check_agent_review_workflow.py\'\n push:\n branches: [main]\n paths:\n - \'.github/workflows/agent-review.yaml\'\n - \'.github/agent-review.toml\'\n - \'.github/workflows/review-caller-contract.yaml\'\n - \'scripts/check_agent_review_workflow.py\'\n\npermissions:\n contents: read\n\njobs:\n contract:\n runs-on: ubuntu-latest\n timeout-minutes: 5\n steps:\n - name: Check out the caller validator\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7\n with:\n # Bootstrap tests run proposed code without secrets. Target validation\n # always runs the default-branch copy, independently of proposed code.\n repository: ${{ github.event_name == \'pull_request\' && github.event.pull_request.head.repo.full_name || github.repository }}\n ref: ${{ github.event_name == \'pull_request\' && github.event.pull_request.head.sha || github.sha }}\n allow-unsafe-pr-checkout: true\n path: trusted-validator\n persist-credentials: false\n sparse-checkout: scripts/check_agent_review_workflow.py\n sparse-checkout-cone-mode: false\n - name: Check out proposed policy as data\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7\n with:\n repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}\n ref: ${{ github.event.pull_request.head.sha || github.sha }}\n allow-unsafe-pr-checkout: true\n path: proposed\n persist-credentials: false\n sparse-checkout: |\n .github/workflows/agent-review.yaml\n .github/agent-review.toml\n .github/workflows/review-caller-contract.yaml\n sparse-checkout-cone-mode: false\n - name: Check approved source and checking workflow before loading shared code\n id: policy\n run: python3 -I trusted-validator/scripts/check_agent_review_workflow.py --root proposed --output "$GITHUB_OUTPUT"\n - name: Check out the approved immutable shared validator\n uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7\n with:\n repository: pipelab-org/agent-review\n ref: ${{ steps.policy.outputs.reviewer_sha }}\n path: trusted-reviewer\n persist-credentials: false\n sparse-checkout: scripts/agent_review_contract.py\n sparse-checkout-cone-mode: false\n - name: Validate caller and profile with approved shared code\n env:\n REVIEW_SOURCE_SHA: ${{ steps.policy.outputs.reviewer_sha }}\n run: |\n python3 -I - <<\'PYCODE\'\n import os\n import pathlib\n import runpy\n\n contract = runpy.run_path("trusted-reviewer/scripts/agent_review_contract.py")\n root = pathlib.Path("proposed")\n contract["validate_caller"](\n root / ".github/workflows/agent-review.yaml", os.environ["REVIEW_SOURCE_SHA"],\n )\n contract["load_profile"](root / ".github/agent-review.toml")\n print("Review caller and profile contract passed")\n PYCODE\n',)