ci: restore Security Deep pipeline and gate publish on attestation#137
Conversation
Security Deep has been red nightly for weeks across four independent causes, and the release pipeline could publish wheels without provenance. - sanitizers: add RUSTUP_HOME/CARGO_HOME=/tmp to fix EXDEV cross-device link (os error 18) on the ARC runner (same pin as fuzzing/miri-full) - fuzzing: pin nightly-2026-04-27 so cargo-fuzz's rustix compiles, and run encryption_key_derivation instead of the stale encryption_roundtrip target (encryption targets are broken against cachekit-core 0.1.1, #114) - kani: pin CARGO_HOME and put its bin on PATH so cargo-kani is found (was exiting 127) - security-deep-success: open/update a tracking issue on failure so a schedule-only job can no longer fail silently - release-please: gate publish on the attest job, never ship unattested wheels for a security product - attestation-check: the weekly health check called 'gh attestation list', not a real subcommand (errored in ~8s every run, #126); verify the published wheel with 'gh attestation verify' instead Does not re-enable the 9 stale encryption fuzz targets (#114) - that needs the cachekit-core 0.1.1 API migration plus local build verification.
|
Warning Review limit reached
More reviews will be available in 10 minutes and 22 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (3)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
Verified via dispatched run 26675421992: Kani ✅ (was 127), Sanitizers address/thread/memory ✅ (were EXDEV), Extended Fuzzing ✅ (was the rustix build failure), Miri ✅. The new failure-alert step also fired correctly and opened #138. Only Atheris remains red — clang/libFuzzer missing on the runner (see #138); that's a runner-image fix, out of scope here. |
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
|
@coderabbitai full review |
✅ Actions performedFull review triggered. |
1 participant
Why
Security Deep(nightly ASan/TSan/MSan, Kani, fuzzing) has been red every night for weeks — and because it's schedule-only, not a required check, and had no alerting, nobody was told. Four independent root causes, plus a release pipeline that can publish wheels without provenance. For a product whose differentiator is zero-knowledge encryption, that validation gap matters more right before a paid launch.What
security-deep.ymlRUSTUP_HOME/CARGO_HOME=/tmp(the matrix job was missing the pin thatfuzzingandmiri-fullalready have). FixesInvalid cross-device link (os error 18)when rustup stages nightly/rust-src across the ARC runner's overlay/hostPath boundary.nightly-2026-04-27(cargo-fuzz 0.13.1'srustixwon't compile on newer nightly:rustc_layout_scalar_valid_range_*reserved). Swapped the staleencryption_roundtriptarget forencryption_key_derivation, which compiles against cachekit-core 0.1.1.CARGO_HOMEand put itsbinonPATH;cargo-kaniwas installed but not onPATH, so the job exited127.release-please.ymlpublishnowneeds: [..., attest]. If attestation fails, publish is skipped (re-runnable). No unattested wheels.attestation-check.ymlgh attestation list— not a realghsubcommand (onlydownload/trusted-root/verifyexist). That's why it errored in ~8s every week (the real cause behind Attestation verification failed for v0.6.1 #126, not missing attestations). Now downloads the published wheel and runsgh attestation verify.Not in this PR
The other 9 encryption fuzz targets (
encrypt_aes_gcm→encrypt_with_keys, #114) need the cachekit-core 0.1.1 API migration and local build verification — that's a separate, build-verified PR, not something to ship blind here.Verify
Security Deepis schedule-only, so it won't run on this PR. After merge (or now, against this branch), trigger it manually to confirm green:Refs #114, #126.