cesnimda
345 lines
12 KiB
JSON
345 lines
12 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"reportLocalDate": "2026-10-25",
|
|
"timezone": "Europe/Paris",
|
|
"observedUtc": "2026-10-25T06:23:27.915835+00:00",
|
|
"baselineCommit": "f17dba2ec06ea8f53c2785eaaebd25abc515ebf8",
|
|
"branch": "fix/p9-model-cache-and-ci-qualification",
|
|
"hostedVerdict": "BLOCKED",
|
|
"isolationVerdict": "UNVERIFIED",
|
|
"currentLiveHostConfig": "UNKNOWN; metadata cannot certify effective HostConfig",
|
|
"scope": "Bounded read-only CI API GET metadata and official pinned source retrieval; no runtime logs or host inspection",
|
|
"giteaVersion": {
|
|
"version": "1.26.0"
|
|
},
|
|
"repositoryPermissions": {
|
|
"admin": true,
|
|
"push": true,
|
|
"pull": true
|
|
},
|
|
"httpStatuses": {
|
|
"version": 200,
|
|
"repository": 200,
|
|
"repository-runners": 200,
|
|
"instance-runners": 403,
|
|
"user": 403,
|
|
"runs-latest100": 200,
|
|
"runs-branch-query": 200,
|
|
"jobs-855": 200,
|
|
"jobs-854": 200
|
|
},
|
|
"repositoryRunners": {
|
|
"runners": [
|
|
{
|
|
"id": 3,
|
|
"name": "pi-runner-1",
|
|
"status": "offline",
|
|
"busy": false,
|
|
"disabled": false,
|
|
"ephemeral": false,
|
|
"labels": [
|
|
{
|
|
"id": 0,
|
|
"name": "ubuntu-latest",
|
|
"type": "custom"
|
|
},
|
|
{
|
|
"id": 1,
|
|
"name": "ubuntu-22.04",
|
|
"type": "custom"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"total_count": 1
|
|
},
|
|
"observedLatestRunCount": 50,
|
|
"latestObservedRuns": [
|
|
{
|
|
"id": 855,
|
|
"head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
|
|
"head_branch": "main",
|
|
"status": "completed",
|
|
"conclusion": "success",
|
|
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/855",
|
|
"created_at": null,
|
|
"updated_at": null
|
|
},
|
|
{
|
|
"id": 854,
|
|
"head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
|
|
"head_branch": "main",
|
|
"status": "completed",
|
|
"conclusion": "success",
|
|
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/854",
|
|
"created_at": null,
|
|
"updated_at": null
|
|
},
|
|
{
|
|
"id": 853,
|
|
"head_sha": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
|
"head_branch": "fix/p9-ci-and-requalification",
|
|
"status": "completed",
|
|
"conclusion": "failure",
|
|
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/853",
|
|
"created_at": null,
|
|
"updated_at": null
|
|
},
|
|
{
|
|
"id": 852,
|
|
"head_sha": "7092697cb3e20a5f22e173648fd544de3de6c553",
|
|
"head_branch": "fix/p9-ci-and-requalification",
|
|
"status": "completed",
|
|
"conclusion": "failure",
|
|
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/852",
|
|
"created_at": null,
|
|
"updated_at": null
|
|
},
|
|
{
|
|
"id": 851,
|
|
"head_sha": "5ac11549b2caa27469aa9fb2b5b9ed402471a453",
|
|
"head_branch": "fix/p9-ci-and-requalification",
|
|
"status": "completed",
|
|
"conclusion": "failure",
|
|
"html_url": "https://git.cesnimda.uk/cesnimda/jobtrackingapp/actions/runs/851",
|
|
"created_at": null,
|
|
"updated_at": null
|
|
}
|
|
],
|
|
"latestAccessibleJobs": [
|
|
{
|
|
"runId": 855,
|
|
"head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
|
|
"jobs": [
|
|
{
|
|
"id": 1745,
|
|
"name": "backup",
|
|
"status": "completed",
|
|
"conclusion": "success",
|
|
"runner_id": 5,
|
|
"runner_name": "Live-Runner",
|
|
"started_at": "2026-10-25T01:00:47Z",
|
|
"completed_at": "2026-10-25T01:01:04Z"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"runId": 854,
|
|
"head_sha": "5f835e54a9b74e6b71418422e28431b2af06453f",
|
|
"jobs": [
|
|
{
|
|
"id": 1744,
|
|
"name": "backup",
|
|
"status": "completed",
|
|
"conclusion": "success",
|
|
"runner_id": 5,
|
|
"runner_name": "Live-Runner",
|
|
"started_at": "2026-10-25T00:01:21Z",
|
|
"completed_at": "2026-10-25T00:01:38Z"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"taskBranchQuery": {
|
|
"observedCount": 0,
|
|
"allReturnedRowsMatchRequestedBranch": true,
|
|
"matchingRunIds": [],
|
|
"note": "An empty or ignored query is not proof of all historical branch executions."
|
|
},
|
|
"taskBranchRunsInLatestWindow": [],
|
|
"historicalRuntimeEvidence": {
|
|
"runId": 853,
|
|
"jobId": 1743,
|
|
"sourceCommit": "3727a723e8d0d9066ef3a0a4eed3e5313ff9cc28",
|
|
"logSha256": "448df52f9c9cf3c156b5f742dbef6e3745844b25f968d4e9138c142437837134",
|
|
"effectiveHostNetworking": true,
|
|
"effectiveDockerSocketBind": true,
|
|
"privileged": false,
|
|
"guardExitCode": 1,
|
|
"mariaDbExecuted": false,
|
|
"historicalIsolationVerdict": "UNSAFE for the proposed database lane"
|
|
},
|
|
"sourceCapability": {
|
|
"runnerVersionReportedHistorically": "v0.4.1",
|
|
"runnerSourceCommit": "9aafec169b7ebf3d71df2b06780868fb552b435e",
|
|
"actVersion": "v0.261.10",
|
|
"nativePrivateServicesSupportedInPinnedSource": true,
|
|
"installedBinaryMatched": false,
|
|
"sources": [
|
|
{
|
|
"name": "docs",
|
|
"url": "https://docs.gitea.com/1.26/usage/actions/act-runner/",
|
|
"httpStatus": 403,
|
|
"path": ".artifacts/p9-sec-02/ci/sources-20261025/docs.txt",
|
|
"bytes": 17,
|
|
"sha256": "2938e9f1284180959e33ab1718d0793a72ff6e4cdb8108c34dcd14e69446de5c"
|
|
},
|
|
{
|
|
"name": "config",
|
|
"url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/pkg/config/config.example.yaml",
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/sources-20261025/config.txt",
|
|
"bytes": 7511,
|
|
"sha256": "e47d046dc368eb85b35665b4a5dba57ce0be4053c665ff737916a7561f7337fa"
|
|
},
|
|
{
|
|
"name": "runner",
|
|
"url": "https://gitea.com/gitea/runner/raw/commit/9aafec169b7ebf3d71df2b06780868fb552b435e/internal/app/run/runner.go",
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/sources-20261025/runner.txt",
|
|
"bytes": 9299,
|
|
"sha256": "857b163f42aeb350aa32fbdc884e8d2ceb738d77e8a25504ac38c3e0035ab590"
|
|
},
|
|
{
|
|
"name": "engine",
|
|
"url": "https://gitea.com/gitea/act/raw/tag/v0.261.10/pkg/runner/run_context.go",
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/sources-20261025/engine.txt",
|
|
"bytes": 36451,
|
|
"sha256": "45aea88466bc40c1cddad7ee6cfe98444ffd225a719683ee319c909075466c2c"
|
|
}
|
|
]
|
|
},
|
|
"repositoryGuardAssessment": {
|
|
"unconditionalFirstStepFailure": true,
|
|
"taskBranchPushTrigger": false,
|
|
"pullRequestAndManualTriggers": true,
|
|
"runnerPreparationOccursBeforeGuard": true,
|
|
"sharedUbuntuLatestRouting": true,
|
|
"defaultLoopbackAndGeneratedSchemasPreserved": true,
|
|
"sourceManifest": [
|
|
{
|
|
"path": ".gitea/workflows/mariadb-integration.yml",
|
|
"bytes": 1306,
|
|
"sha256": "f7579be39a4b4318567edf98ba8dff0d6991ceae96ae27b917e6847253b1f850"
|
|
},
|
|
{
|
|
"path": "scripts/mariadb-integration.py",
|
|
"bytes": 4570,
|
|
"sha256": "410cede3ca8794de99735a579ac626a34b6a56ee89c6ef63880d692153c7cd97"
|
|
},
|
|
{
|
|
"path": "scripts/test-mariadb-integration.py",
|
|
"bytes": 2938,
|
|
"sha256": "39aa5618724e74b859aceaf814bf08b9ea63a54205452805caa810a302441a80"
|
|
},
|
|
{
|
|
"path": "JobTrackerApi.MariaDb.Tests/MariaDbDatabase.cs",
|
|
"bytes": 6716,
|
|
"sha256": "1375d97093f686f77d511ef6d81ad2d62ecf329aa6e7bf53036cd6e199035e40"
|
|
},
|
|
{
|
|
"path": "docker-compose.database.yml",
|
|
"bytes": 1441,
|
|
"sha256": "bc4f0d19ef913f9e0f92540ed9a817e7bbf00d2f00ae80ed5b1acd43d55ba363"
|
|
},
|
|
{
|
|
"path": ".gitea/workflows/backup.yml",
|
|
"bytes": 1008,
|
|
"sha256": "9a6a7a9d49f88b6d9383a2d688ef64b14c53c451d1669ae6bda642780d291f75"
|
|
},
|
|
{
|
|
"path": ".gitea/workflows/ci-deploy.yml",
|
|
"bytes": 21659,
|
|
"sha256": "713a62a635b1f695c3e70d2484997fb3ce2a616bbaae3885f80c1be821cf98cf"
|
|
},
|
|
{
|
|
"path": ".gitea/workflows/maintenance.yml",
|
|
"bytes": 2343,
|
|
"sha256": "49fac8dde43531338fc713ac2a367ec9ca55379c94fcee44c1957dd861df54f9"
|
|
}
|
|
]
|
|
},
|
|
"validation": {
|
|
"staticGuardAssertions": "PASS",
|
|
"offlinePythonGuardTests": {
|
|
"passed": 5,
|
|
"failed": 0,
|
|
"scope": "Mocked runner guard tests only; no Docker/service/database access",
|
|
"outputCaveat": "Expected injected cleanup failure17 and setup failure1 are test fixtures, not real service failures"
|
|
}
|
|
},
|
|
"unknowns": [
|
|
"Runner5 host/daemon ownership, installed binary identity, registration scope and current effective configuration",
|
|
"Production workload/credential/mount/egress separation",
|
|
"Job-token/fork/PR trust and secret scopes",
|
|
"Private service runtime, DNS and no published port/socket/host network/privilege",
|
|
"Cross-job/cache isolation and success/failure/cancel/crash recovery"
|
|
],
|
|
"repositoryImprovementProposal": "Keep execution blocker. Optionally remove the broad pull_request event while isolation is unverified to prevent automatic runner preparation; review provider behavior and dedicated routing before re-enabling. No enabling transport change is justified before operator proof.",
|
|
"rawMetadataEvidence": [
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/version.json",
|
|
"bytes": 20,
|
|
"sha256": "64030fee3ab1730681c4567c01d1b30087578ef8bec61e6b0ab6c02842f3303e"
|
|
},
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository.json",
|
|
"bytes": 2315,
|
|
"sha256": "cb29faeadc15e5761db1043edff1c9d810c43ffea38abc5e6cee8d410a20e94d"
|
|
},
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/repository-runners.json",
|
|
"bytes": 232,
|
|
"sha256": "f66190023c670ce75b068c0e8b394a1589c28bbd5842686e9904b7cca07b5a45"
|
|
},
|
|
{
|
|
"httpStatus": 403,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/instance-runners.json",
|
|
"bytes": 164,
|
|
"sha256": "5aea25deaabb1778f0f4d023fb4529d5161efab460ed6028a27711004e1030d1"
|
|
},
|
|
{
|
|
"httpStatus": 403,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/user.json",
|
|
"bytes": 163,
|
|
"sha256": "f9e323bca7fe906d1fbb8a15b90d3f3553b23da32bec8a2c3c959795eae9305b"
|
|
},
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-latest100.json",
|
|
"bytes": 203780,
|
|
"sha256": "7c2ac0004b093f34f83804a9168f23af17c4036f79ed7ff48bcb30daa7822cf2"
|
|
},
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/runs-branch-query.json",
|
|
"bytes": 36,
|
|
"sha256": "c88e581390a4c04eaddaf6dc1bafd07c56d33e594c62ad3498c7313043b39bbf"
|
|
},
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-855.json",
|
|
"bytes": 836,
|
|
"sha256": "8fddbb1014c708d1c088f45c874cffb2f1446d21d3412cda64e18917e94ed5c9"
|
|
},
|
|
{
|
|
"httpStatus": 200,
|
|
"path": ".artifacts/p9-sec-02/ci/metadata-20261025/jobs-854.json",
|
|
"bytes": 836,
|
|
"sha256": "6b7e0849d1eeca72cc264984e00bd4ae2bbb576aa541f7c2e8f26b38e4348b05"
|
|
}
|
|
],
|
|
"actions": {
|
|
"hostedJobsDispatched": false,
|
|
"newRuntimeLogsDownloaded": false,
|
|
"runnerOrHostChanged": false,
|
|
"workflowChanged": false,
|
|
"dockerSocketAccess": false,
|
|
"secretValuesReadOrRetained": false,
|
|
"productionAccess": false,
|
|
"deployment": false
|
|
},
|
|
"limits": [
|
|
"Latest request limit100 returned50; bounded window, not full history",
|
|
"Branch query0 and no latest-window match do not prove provider filter support or exhaustive absence",
|
|
"Instance runners and user403 despite repository admin/push/pull",
|
|
"Official docs HTTPS request403; capability rests on freshly fetched immutable primary source matching prior hashes",
|
|
"Backup success metadata is not MariaDB execution or isolation evidence"
|
|
],
|
|
"documentation": "CI_ASSESSMENT.md"
|
|
}
|