[Infra] Default bootstrap to active enforcement and fail closed on ruleset downgrades by DongyuZhao · Pull Request #65 · nouprax/markdown-core

DongyuZhao · 2026-07-28T05:45:52Z

Summary

The template's embedded bootstrap-repository.sh now defaults to the mature-repository shape: RULESET_ENFORCEMENT=active and MAIN_ADMIN_BYPASS=false, so a maintenance re-run with only the required inputs converges on full protection instead of silently re-weakening it. Initial bootstrap of a fresh repository can still opt into RULESET_ENFORCEMENT=evaluate explicitly while CI stabilizes, exactly as the migration runbook already does.
upsert_ruleset now fails closed when updating an existing ruleset: downgrading enforcement from active to evaluate/disabled, or adding bypass actors beyond the current set, aborts with an explanation unless ALLOW_PROTECTION_DOWNGRADE=true is passed deliberately.
A short note after the migration examples documents the new defaults and the override variable.
Ported from tex-core ([Engine/Bindings/Release/CI] Close the independent M1 exit audit (#29–#69) tex-core#70), the same direction as [Release] Refresh Maven checksum sidecars after the publication merge #36/[Infra] Preserve benchmark failures through the metrics tee #37/[Infra] Pin squash-only merges with PR-title messages in bootstrap #39. markdown-core carries the bootstrap script only as the embedded copy in docs/repository-setup-template.md, so this PR touches that one spot (same as [Infra] Pin squash-only merges with PR-title messages in bootstrap #39).
No CHANGELOG entry: markdown-core's changelog records release changes only, matching [Release] Refresh Maven checksum sidecars after the publication merge #36/[Infra] Preserve benchmark failures through the metrics tee #37/[Infra] Pin squash-only merges with PR-title messages in bootstrap #39.

Verification

shellcheck clean and bash -n on the extracted embedded script; audit:repository and audit:ci green.

🤖 Generated with Claude Code

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8fae9f367

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-07-28T06:13:44Z

PR performance and binary-size diff

Benchmark execution is required; hosted-runner timing, memory, and size deltas are informational only.

Baseline unavailable for exact PR base 938bba6aa55a; current values are shown without a diff.

Performance

Runtime	Workload	Median	Perf diff	Memory	Memory diff
c	representative_large	6.133 ms	n/a	8,560 KiB	n/a
es	deep_nesting	0.320 ms	n/a	146,800 KiB	n/a
es	large_document	38.189 ms	n/a	146,800 KiB	n/a
kotlin	deep_nesting	0.293 ms	n/a	93,600 KiB	n/a
kotlin	large_document	29.944 ms	n/a	90,972 KiB	n/a
swift	deep_nesting	0.076 ms	n/a	26,064 KiB	n/a
swift	large_document	12.641 ms	n/a	25,936 KiB	n/a

Binary size

Artifact	Bytes	KiB	Size diff
c-shared-library	501,952	490.2	n/a
es-wasm	288,818	282.0	n/a
kotlin-jvm-jar	318,255	310.8	n/a

Head CI run

Size deltas are deterministic for identical build inputs. Performance deltas compare separate hosted runners and should be treated as directional evidence, not a pass/fail threshold.

…leset downgrades Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Review: comparing bypass_actors by length let a re-run swap one actor for another without ALLOW_PROTECTION_DOWNGRADE, and the enforcement guard missed evaluate -> disabled. Compare requested actors as a subset of currently granted ones and order enforcement levels instead. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

## Summary - Every `uses:` reference across the five workflows (`ci`, `codeql`, `release`, `release-dry-run`, `pr-metrics-comment`) is now pinned to a full commit SHA with the release version recorded in a trailing comment. A movable major tag lets a tag replacement change the code that CI and release jobs execute without a reviewed diff; the SHA makes the executed bytes part of the reviewed history. - `audit-ci-policy.sh` (run as `audit:ci` in the repository health check) now rejects any workflow action reference that is not a 40-hex commit SHA, so a future workflow edit cannot quietly reintroduce a movable ref. Local `uses: ./…` references stay exempt. - Every SHA↔version pair was verified against the GitHub API (`repos/<action>/commits/<tag>`) before landing; the pins match the ones tex-core reviewed. - Ported from tex-core (nouprax/tex-core#70), the same direction as #36/#37/#39/#65. - No CHANGELOG entry: markdown-core's changelog records release changes only, matching the previous mirrors. ## Verification `audit:ci` green on the pinned tree; negative test confirmed the new check fails with a pointed message when a single ref is reverted to `@v7`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

## Summary - The repo-managed Python tool venvs now install from hash-locked requirements files (`pip --require-hashes`): `scripts/requirements/clang-format.txt` for the clang-format venv in `init-environment.sh`, and `scripts/requirements/cmakelang.txt` (cmakelang + PyYAML + the transitive six) for the cmake-format venv in `format-cmake.sh`, which is where markdown-core builds that venv. Every distribution PyPI publishes for the pinned versions is enumerated, so an index-side replacement cannot change the bytes the tools run. - `install_emscripten` now pins the emsdk manager itself to `EMSCRIPTEN_COMMIT` — the immutable commit of the `4.0.23` release tag, kept in lockstep with `EMSCRIPTEN_VERSION` — and verifies the checkout, so a moved tag or new default-branch commit can never change the installer bytes it executes. - `audit-ci-policy.sh` (`audit:ci`) now enforces all of this: it fails if `init-environment.sh` loses the emsdk commit pin or `--require-hashes`, or if `format-cmake.sh` loses `--require-hashes`. - Ported from tex-core (nouprax/tex-core#70), the same direction as #36/#37/#39/#65/#66. Adapted where the repos differ: markdown-core installs cmakelang via `format-cmake.sh` rather than inline in `init-environment.sh`, so the requirements file is wired (and audited) there. The emsdk commit was verified against the GitHub API to be the `4.0.23` tag commit. - No CHANGELOG entry: markdown-core's changelog records release changes only, matching the previous mirrors. ## Verification `audit:ci` green with the new checks active; both requirements files installed for real with `--require-hashes` into fresh venvs on macOS arm64 (`cmake-format 0.6.13`, `clang-format 22.1.8`); the modified `format-cmake.sh --check` ran end-to-end against the repo with a fresh tool dir; `shellcheck` reports nothing new on either script. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

DongyuZhao requested a review from a team July 28, 2026 05:45

chatgpt-codex-connector Bot reviewed Jul 28, 2026

View reviewed changes

Comment thread docs/repository-setup-template.md Outdated

Comment thread docs/repository-setup-template.md Outdated

This was referenced Jul 28, 2026

[Infra] Pin workflow actions to commit SHAs and audit movable refs #66

Merged

[Infra] Hash-lock Python tool installs and pin the emsdk commit #67

Merged

DongyuZhao and others added 2 commits July 28, 2026 09:35

[Infra] Default bootstrap to active enforcement and fail closed on ru…

8d5f2b6

…leset downgrades Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

DongyuZhao force-pushed the bootstrap-fail-closed-protections branch from 8859468 to 20ea398 Compare July 28, 2026 13:35

DongyuZhao merged commit c4249db into main Jul 28, 2026
87 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Infra] Default bootstrap to active enforcement and fail closed on ruleset downgrades - #65

[Infra] Default bootstrap to active enforcement and fail closed on ruleset downgrades#65
DongyuZhao merged 2 commits into
mainfrom
bootstrap-fail-closed-protections

DongyuZhao commented Jul 28, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

DongyuZhao commented Jul 28, 2026

Summary

Verification

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR performance and binary-size diff

Performance

Binary size

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Jul 28, 2026 •

edited

Loading