You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix(identity): publish a verified Dex security distribution - #5814
The shared sign-in broker needs a source-bound security correction before fresh adoption, including the portal's dedicated broker.
What
Build and publish a minimal, reviewed distribution with the dependency correction and verified secure connections. Keep runtime adoption as a separate reviewed change.
Evaluation at a4efba7c3861c47e870c6ef5c181558f6efba1d8, based on current main 84977ddd692110a9d7a1f9bc728531d085bb75e9:
Root-cause dependency correction is generated by Go and confined to the exact upstream release, with independent patch replay and a fixed patched-tree check. The selected dependency and scanner releases pass the normal age policy.
The complete Platform root Go suite passed before the base advance. After integration, the new base's 12 module-guard controls, all 11 module tidiness checks and changed merge-heal regressions pass. ShellCheck, Actionlint and the new command's vet/tests pass.
Actual upstream command/server/memory-store/OIDC tests pass with normal CGO. The new checker has observed RED controls for unexamined reports, new findings and changed primary advisory metadata. Its native paired control reaches the actual weaker-protocol check; SQLite, allowed/refused HTTPS and gRPC handshakes, certificate reload, wrong CA and wrong hostname controls pass.
Repeated native execution exposed a transient SQLite-journal/certificate-watch collision. Certificates and database files now occupy separate fixture directories; ten full repeated controls pass. Endpoint reservations and bounded fictional failure diagnostics are retained. Both earlier failed fixture attempts remain separate adverse evidence.
Linux workflow 41602208351/1 completed the actual musl-linked distribution build, scanner/native controls, non-root read-only container execution and packaged-byte recheck. Its publication job correctly stayed skipped on this PR. Wider CI remains a separate gate.
This is evaluation evidence, not an independent review, promotion, deployed adoption or portal activation. Raw scanner details remain private; the specific historical disposition is supported by primary ranges, source-fix ancestry and actual executable behavior. #5811 retains signed publication/admission, digest adoption and the real broker path; business-site #491 retains its dedicated customer scope.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
The change adds a patched, source-built Dex image and checks its executable, packaged files, and TLS behavior. A GitHub Actions workflow builds and verifies an image archive, then publishes that same archive on pushes to main with an SBOM, signature, and attestations. The documentation describes the image contents, admission checks, and the separate steps required to adopt the image at runtime.
Document the workflow permissions and include all identified inputs in its triggers before merging; otherwise the lint gate can fail, and input-only changes can go unverified.
Pre-merge checks: 4 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Docstring Coverage
Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…
Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title names the main change: publishing a verified Dex security distribution. The changeset adds a build script, a Dockerfile, a verify/publish workflow, a dependency patch bumping golang.org/x/ne…
Description check
The description states the purpose: a source-bound security correction for the shared sign-in broker, delivered as a minimal, reviewed distribution with a dependency correction and verified secure con…
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Title check
Explanation
The title names the main change: publishing a verified Dex security distribution. The changeset adds a build script, a Dockerfile, a verify/publish workflow, a dependency patch bumping golang.org/x/net to v0.60.0, and a binary checker that performs TLS and certificate validation. The title's conventional-commit 'fix(identity)' scope and the 'verified' wording fit the change. It is concise, specific, and free of file lists or vague terms.
Full details: Description check
Explanation
The description states the purpose: a source-bound security correction for the shared sign-in broker, delivered as a minimal, reviewed distribution with a dependency correction and verified secure connections. Runtime adoption is deferred to a separate change. These points match the changeset, which adds the Dex image build, the golang.org/x/net bump, and the TLS checks. The description is brief but specific enough to relate to the changes.
Full details: Docstring Coverage
Explanation
Docstring coverage is 57.14% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 14 functions across 4 files. (5 skipped: 5 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.
Recent review details
Additional context used
Code guidelines: 1
AGENTS.md — auto-discovered
Path-based instructions: 2
Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.
Source excerpt: Resources under `k8s/bases/infrastructure/` are **component-folder-first**: a component's HelmRelease/HelmRepository and its own CRs live together in a folder named after the component — `controllers//` in the con...
Re-evaluated a4b6dec7c1cc2719e9fe2306330c05d618f80988 after addressing both review findings:
CI 41611639250/1 and Linux image verification 41611639239/1 completed successfully. All 58 native contexts and eight matching workflows are settled; the publication job correctly stayed skipped on this PR.
The actual producer/consumer workflow regression was RED for a publish-only retry before repair. Both partial and full retry cases now select the producing job's exact archive. Hash and image identity checks remain required.
The previous certificate check incorrectly admitted a controlled stale-certificate build (RED). The repaired control requires both endpoints to present the renewed leaf under distinct trust, repeats the protocol/CA/hostname controls, and rejects retired trust. Linux CI builds this adversarial control separately, restores the source, then compiles the shipping executable.
Independently downloaded the resulting native image artifact (13219671231), verified its archive hash, image configuration and all 16 layers, inspected the packaged executable and passive source offer, and confirmed the source contains the restored upstream reloader. The actual executable still binds the reviewed compiler, upstream revision and dependency correction. Fresh scanner output is retained privately.
Assessed the ancillary static-analysis report against the implementation. Its file/process warnings concern explicitly selected build tools and generated disposable fixture paths, not request-controlled paths or a deployed service boundary. The fixture has bounded process, HTTP and TLS operations. The remaining reported close/context/style and documentation-permission observations do not invalidate these controls; no check was disabled or waived.
This is evaluation evidence, not substantive review, signed main publication, deployed adoption or portal activation. Both original review threads are resolved. #5811 and business-site #491 retain their remaining publication/admission/adoption obligations.
Evaluated signed head 2b998a52af4f99ffe8836b494be93bf8273b4ff1, integrated with main 7d38b1bce1f0612f84a9df1d1b115e7abab3aa3e:
The full root Go suite passes across 90 packages. All 11 tracked modules pass the actual tidiness command. Native TLS-floor, real certificate-renewal and deliberately stale-certificate controls pass in this round; the complete checker package took 6.445s.
Six parsed-workflow controls were independently RED for omitted checker-module and signing-installer inputs, then GREEN after fixing both event filters. The producing-attempt archive retry controls remain green. Publication permissions now document their consumers without changing the grants.
Actionlint, ShellCheck, changed-package vet, diff checks and installed Zizmor 1.31.1 offline validation pass. The ancillary file/process/context/style report was assessed against the bounded build-tool and disposable-fixture boundaries; no scanner or gate was disabled.
Hosted CI 41628212290/1 and native Linux image verification 41628212626/1 succeeded. The complete current-head census contains 58 settled successful/skipped contexts and eight successful workflows. The PR's image-publication job correctly stays skipped; this is not main publication or deployed adoption.
All four review threads are resolved. Fix confirmations and their empty reply-review containers are not a green substantive review of this head.
The portable review cycle is now at the second repaired head; any further findings must be assessed against the complete set under the convergence rule. #5811 and business-site #491 retain actual signed publication/admission/adoption. Portal activation remains separate and disabled.
Your included review limit is currently reached under our Fair Usage Limits Policy. This review may still proceed through usage-based billing if eligible. Your next included review will be available in 48 minutes.
CodeRabbit explicitly declined the current-head full-review request at 11:47:02 UTC: its included allowance is exhausted, with a stated 48-minute recovery window. Primary response: #5814 (comment). With the minute-window safety margin, do not retry before 12:36:02 UTC. No usage-based billing or credit reset is authorized.
The current-head no-gate guard returns ADMIT; this is not a review verdict. The ordered sequence advances to Codex, preserving all review and merge gates.
Readiness at 2b998a52af4f99ffe8836b494be93bf8273b4ff1, base 7d38b1bce1f0612f84a9df1d1b115e7abab3aa3e:
All eight exact-head workflow runs have succeeded, including CI and the actual Linux distribution verification. The latter built the real shipping executable and separate adverse control, exercised TLS and certificate renewal, scanned the resulting distribution, and retained its verified archive; PR publication was correctly skipped. Native checks are complete; CodeRabbit is neutral because of its explicitly reported allowance limit. Configured native code_quality remains UNVERIFIED, not waived; GitHub reports CLEAN.
Full comments, reviews, inline findings and four native threads were re-read: every reported finding is addressed and all four threads are resolved. Ordered review progressed only after CodeRabbit's explicit refusal. Codex's substantive current-head review is green, with its completed exact-head summary reporting no findings.
Actual native host controls independently observed allowed TLS, rejected lower protocols and incorrect trust/hostname, genuine certificate replacement, and refusal of the deliberately stale-certificate executable. All 90 root Go packages, all 11 module-tidy checks, six RED-before/GREEN-after workflow-selection controls and changed-file lint passed. This is distribution readiness; no production adoption or portal login is claimed.
Fresh holder read reports none, the isolated checkout is owned by this invocation and clean, and the reviewed head is unchanged. Promote this source-only prerequisite; keep production/queue admission separate while the independent platform recovery is unfinished. No health or deployment gate is waived.
Cleared 2026-11-03: Fresh current live-health read exits 0 (PLATFORM-HEALTH=OK); the recovery outcome has cleared. Current exact head 2b998a5 retains complete green native/workflow checks, resolved findings and its applicable Codex green. Continue normal head-pinned queue admission.
Previous record (historical):
> 🤖 Generated by the Agentic Engineer
<!-- pr-blocker-record -->
**Blocker:** current-main production recovery reaches verified healthy state | outcome | last-verified 2026-11-03: Source CI and current-head substantive Codex review are green at 2b998a52af4f99ffe8836b494be93bf8273b4ff1; all four threads are resolved and the PR is promoted. Independent current-main recovery run 41617563309 ended unsuccessfully; a separate normal merge-group run 41634010849 is active. Fresh live health is UNHEALTHY. Queue admission remains held; no recovery takeover, cancellation or protection override.
Any commits made after this event will not be merged.
This branch has not been deployed
No deployments
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Why
The shared sign-in broker needs a source-bound security correction before fresh adoption, including the portal's dedicated broker.
What
Build and publish a minimal, reviewed distribution with the dependency correction and verified secure connections. Keep runtime adoption as a separate reviewed change.
Part of #5811