fix(ci): route package gate to isolated self-hosted runners

[seonghobae]

범위

닫힌 #2261의 successor #2573 위에 올라가는 package self-hosted 수리입니다. 중앙 main 배포와 이 stack base 전달을 구분합니다.

• Package producer와 trusted inspector를 CWL CI isolated의 self-hosted/Linux/x64/cwlab-ci-isolated runner로 전환합니다. Hosted fallback은 없습니다.
• Producer/inspector 분리, 불변 central checkout, credential non-persistence, artifact 실패 차단을 유지합니다.
• 기존 audit clock과 sandbox home fixture를 고칩니다. Production freshness와 home denial은 변경하지 않습니다.
• 중앙 main과 동일한 actionlint label 설정을 사용합니다. Session GOAL.md는 제거했습니다.
• CodeQL PR의 세 job에 중앙 main의 이미 병합된 self-hosted selector를 그대로 가져왔습니다. Exact trusted-main workflow만 control group을 사용하고 PR revision은 isolated group만 사용합니다. 관련 세 계약 테스트를 맞췄습니다.

현재 검증

Head: 51711760d1644acf5d866c9b4c7fd6064101cc4f
Base: 41e9c45407e3f72d138da2ad24cdf934aa42fbe1 (#2573)

• CodeQL workflow는 검토 당시 main 4e32b99ec79b6565800d1081f60acfea368adecd의 파일과 byte 단위로 같습니다.
• CI-mode 전체 suite: 5351 passed / 4 skipped / 40 subtests passed, pytest exit 0, 362.03초.
• CodeQL 관련 집중 테스트: 일반/CI mode 각각 46 passed.
• CodeQL workflow actionlint exit 0; git diff --check exit 0.
• 3파일 CodeQL source delta 독립 APPROVE와 추가 계약 테스트 delta 독립 APPROVE를 받았습니다. Parent가 최종 파일 hash 4/4를 확인했습니다. Formal GitHub App approval은 아닙니다.
• Package workflow의 job.workflow_repository/sha에 대한 actionlint 1.7.12 schema 오류 4건은 계속 미해결입니다. Ignore를 추가하지 않았습니다.
• HTTPError cleanup ResourceWarning을 숨기지 않았습니다.

실행 및 전달 상태

Ready for review이며, 신규 head의 체크는 진행 중입니다. Queue/in-progress/skip을 통과나 장애로 단정하지 않습니다. 실제 disposable runner 격리/cleanup canary, literal auto inference와 author-distinct App APPROVED는 별도 미완료입니다.

이전 head d2c96e6에서 확인된 실패는 역사적 근거로 남깁니다: CodeQL hosted ubuntu-24.04에서 runner 미배정·step 0개; Noema 독립 issuer/custody input 부재; OpenCode current-head formal receipt 부재; Strix self-hosted 실행 중 gh executable 부재. 이들은 신규 head 소스 finding이나 성공으로 이월하지 않습니다.

Shared LiteLLM credential/auto/App integration은 기존 #2560 담당 경계를 유지합니다. 키 중복 발급, secret dump, runner/ACL/VM 변경, 보호 완화, 미리 정한 승인 결과를 수행하지 않았습니다. 이 PR의 stack base 병합은 main 배포 완료가 아닙니다.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7e8496d4-e8bb-4863-a233-56848f8098d9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[seonghobae]

Exact-head self-hosted migration triage: inherited schema NONPASS

Fresh observed head: d2c96e687f55a194bcfe5ac3db647f47684fce25, still OPEN. Actual base is #2573 at 41e9c45407e3f72d138da2ad24cdf934aa42fbe1; this is not a six-path standalone shipment to main.

Exact-head actionlint 1.7.12 returned exit 1 for four expressions in .github/workflows/package-description-boundary.yml: job.workflow_repository at lines 152/167 and job.workflow_sha at 153/168. The diagnostic says those properties are not defined in the job object. These expressions are inherited unchanged from #2573; runner capacity does not resolve this source-validation failure. Shellcheck/pyflakes were not executed in this text-only validation. An actionlint failure alone is not a demonstrated GitHub runtime failure, so the missing acceptance is supported immutable reusable-workflow identity plus actual cross-repository checkout evidence.

Existing #2608/#2573 source owner: repair that identity/checkout boundary without an expression-ignore, mutable-main checkout, or confusing caller identity with the central supplier; preserve producer/inspector separation and validate the actual cross-repository route. Re-run focused boundary/audit/sandbox contracts normally and with GITHUB_ACTIONS=true on the exact repaired successor. The full current-main stack has 71 paths; do not certify original #2261 carryover from the narrow runner-routing patch alone.

Historical failures are separate recovery nodes: CodeQL job115132781543 was billing-locked before execution; Strix115134289514 reported gh: command not found; Noema115134423687 refused independent issuer/custody input; OpenCode115134086035 lacked a current-head substantive App verdict. Those jobs predate newer main review repairs and are not proof that the same defects remain in the current deployed route. No retry, runner mutation, key change, Ready transition, approval or merge was performed by this follow-up.

Retained evidence: /Users/seonghobae/orca/reports/pr-triage-selfhosted-20261013/lane-central/2608-actionlint.txt (SHA-256 846021d0160c67c430dc32b5a42e10f6c8d0ebdac1033a467b35bad5944dfdfc), exact workflow bytes, three-dot diff and manifest. All 78 manifest entries were independently hash-verified by the parent. This is a source-validation finding, not formal App APPROVED.

[cwl-noema-review]

Noema LLM review

Approve the source-level changes: the CodeQL selectors preserve trusted-main control routing while moving other revisions to the isolated pool, and both package-gate jobs consistently require that pool (.github/workflows/codeql-pr.yml:64 RIGHT; .github/workflows/package-description-boundary.yml:66 and 136 RIGHT). Static adversarial checks falsified routing, fallback, and test-fixture regression hypotheses. One non-blocking routing comment is stale; runtime isolation and capacity remain unverified.

Reviewed changed lines

• .github/actionlint.yaml:1 (RIGHT): Correctly distinguishes lint acceptance of custom labels from runtime isolation. This configuration does not grant runner-group access or establish disposable execution.
• .github/workflows/codeql-pr.yml:64 (RIGHT): The trusted-main predicate retains the existing control-group selection. Nonmatching workflow references now select CWL CI isolated with the isolation label rather than a hosted runner.
• .github/workflows/codeql-pr.yml:170 (RIGHT): The analysis job uses the same predicate and alternatives as language detection, keeping routing consistent across the required-check flow.
• .github/workflows/codeql-pr.yml:376 (RIGHT): The coordinator's labels expression duplicates its group expression's predicate and JSON alternatives, so splitting the selector into explicit properties does not introduce a group/label mismatch.
• .github/workflows/package-description-boundary.yml:66 (RIGHT): Caller-controlled build execution is restricted to the named isolated group and all four required labels; the selector contains no hosted alternative.
• .github/workflows/package-description-boundary.yml:136 (RIGHT): The inspector uses the same restricted selector as the producer. Its existing dependency and failed-producer rejection remain intact.
• docs/doctoring/package-description-boundary.md:182 (RIGHT): Appropriately states that routing changes neither provision runners nor prove cleanup, and identifies operational evidence required before accepting a real caller.
• tests/test_audit_org_codeql_coverage.py:267 (RIGHT): The default-clock test now supplies a genuinely current timestamp instead of allowing the fixed September fixture to age out.
• tests/test_audit_org_codeql_coverage.py:316 (RIGHT): The CLI fixture receives its matching reference clock through pytest's scoped monkeypatch, without changing production clock behavior or permanently modifying other tests.
• tests/test_codeql_pr_workflow_contract.py:1161 (RIGHT): The parsed fallback assertion checks the complete isolated group and label set rather than merely accepting any self-hosted selector.
• tests/test_package_description_boundary.py:351 (RIGHT): The new contract compares both jobs' full runs-on mappings against the same expected selector and separately excludes the previous hosted labels.
• tests/test_required_review_runner_image_contract.py:104 (RIGHT): Checks that all three selectors have corresponding labels expressions and retain the trusted-reference predicate in both properties.
• tests/test_sandboxed_web_e2e.py:1716 (RIGHT): The scoped synthetic-home fixture separates the modeled home from the sandbox workspace, making the path tests independent of whether the host scratch directory lies beneath the real home.
• tests/test_scheduler_and_codeql_dispatch_runner_image_contract.py:67 (RIGHT): Updates the scheduler contract to require the complete isolated fallback while retaining its existing trusted-main control assertions.

Adversarial validation

• .github/workflows/codeql-pr.yml:64 (RIGHT) falsified: A PR workflow reference still selects the restricted central-control group or falls back to a hosted runner. — Static expression evaluation makes the comparison false and selects the literal object containing group CWL CI isolated and labels self-hosted, linux, x64, and cwlab-ci-isolated. Neither alternative is hosted.
• .github/workflows/codeql-pr.yml:376 (RIGHT) falsified: Splitting runs-on into group and labels changes trusted-main behavior or combines a group with the wrong branch's labels. — Each property uses the same predicate and identical JSON alternatives. Trusted main yields CWL central control with the original three labels; the other branch yields CWL CI isolated with four labels. Only the final property dereference differs.
• .github/workflows/package-description-boundary.yml:136 (RIGHT) falsified: Unavailable isolated capacity allows the inspector to escape to hosted execution or publish a successful gate without its producer. — Both jobs have a single fixed isolated selector with no fallback. A queued producer does not satisfy the inspector's needs dependency; after an unsuccessful producer, the existing Reject a failed input producer step remains. always() does not substitute another runner or bypass that rejection.
• tests/test_audit_org_codeql_coverage.py:316 (RIGHT) falsified: The clock repair still ages with the fixed fixture or leaks its frozen clock into the real-default-clock test. — The CLI test binds datetime.now to NOW through the scoped monkeypatch fixture, matching its analysis fixture. The separate default-clock test generates its timestamp with datetime.now(timezone.utc), and pytest restores the patched audit attribute after the CLI test.
• tests/test_sandboxed_web_e2e.py:1716 (RIGHT) falsified: The synthetic-home change permanently alters Path.home or accidentally places the sandbox workspace beneath the modeled home. — The modeled home is tmp_path/synthetic-home, while the workspace is tmp_path/sandbox/repo, so the workspace is not beneath the modeled home. The change uses pytest monkeypatch rather than permanent assignment and is restored after the test.
• Residual risk: Validation was static; no pytest, actionlint, live scheduling, or cleanup canary was executed. Runner-group access, available capacity, installed tooling, organization workflow restrictions, and disposable cleanup cannot be established from this diff. The documentation correctly keeps those operational prerequisites separate from source routing.

Findings

• [low] .github/workflows/codeql-pr.yml:64 (RIGHT): The file header still says that PR-authored workflow revisions 'retain hosted execution', but all three changed selectors now route those revisions to CWL CI isolated. Update that comment to describe isolated self-hosted execution so the documented runner boundary matches the implementation.

• Result: APPROVE
• Head SHA: 51711760d1644acf5d866c9b4c7fd6064101cc4f
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]