Repository navigation
Conversation
Runs cargo check + lib tests on the tempsdev1 self-hosted runner for pushes to main/feature/**/fix/** and manual dispatch. Scoped to push and workflow_dispatch only (never pull_request/pull_request_target) so fork PRs can never execute on the self-hosted host. Uses a persistent, isolated CARGO_TARGET_DIR outside the runner work dir so the build cache survives checkout cleans and is reused across runs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A warm CARGO_TARGET_DIR caches the example plugins' build-script fingerprint,
so after actions/checkout git-cleans the source tree the script is skipped and
include_dir!(".../web/dist") panics on the missing dir. Recreate the debug
placeholder assets up front so the check is independent of build-script cache.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
temps-cli embeds crates/temps-cli/dist via include_dir!; like the example plugins its build.rs placeholder is skipped on a warm cache, so generalize the prep step to cover every include_dir! dist target, not just the plugins. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…vy crates cargo test --lib --workspace pulled in temps-domains' real-Pebble ACME tests, which need a challenge-responder network this box can't provide. Match the unit-a/unit-b crate list from rust-tests.yml instead (Docker+networking-heavy crates run in hosted's dedicated integration jobs, not here). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Its local_provider tests launch a real bundled Chromium against live example.com/github.com. The hosted ubuntu-latest image ships google-chrome system-wide so headless_chrome reuses it; this self-hosted box has no system browser, so headless_chrome auto-downloads one and the parallel tests race on the binary (Text file busy) and debug ports (no available ports between 8000 and 9000). It is a live-network browser integration test, not a unit test, and hosted CI already covers it. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The tempsdev1 EC2 runner it targeted has been decommissioned (no self-hosted runners are registered on this repo anymore), so every push to main/feature/**/fix/** was queuing a job with nothing to pick it up. Hosted CI (rust-tests.yml) already covers push and PR on ubuntu-latest.
cargo fetch --locked warms the registry/deps cache synchronously, then a full `cargo build --workspace --all-targets` kicks off in the background (nohup, disowned) so opening the codespace isn't blocked on it -- by the time you start editing, the workspace is already compiled or close to it.
Full workspace builds/tests can pin every core and several GB of RAM for minutes on this 51-crate workspace. Check load/memory before running them locally, and prefer pushing to let hosted CI validate when the box is already under load.
…ents A single load check right before launching a build isn't enough when multiple worktrees or subagents share a box -- builds kicked off seconds apart can each pass the check and then land together, and a few concurrent full/release builds is enough to thrash a shared host (swap, OOM, runaway load). Re-check right before the build starts and default to assuming something else may already be building.
bherila
force-pushed
the
codex/fix-project-membership-check-bypass
branch
from
August 15, 2026 07:45
a704a5f to
e3294fc
Compare
📓 Changelog previewThis is what your commits will add to the generated ## [Unreleased]
### Added
- **devcontainer:** Prefetch cargo deps and background-build on create
### CI
- **self-hosted:** Add build/test workflow on push to bherila fork
- **self-hosted:** Recreate example-plugin web/dist before cargo check
- **self-hosted:** Also recreate temps-cli/dist placeholder
- **self-hosted:** Run hosted unit-test crate set, skip integration-heavy crates
- **self-hosted:** Exclude temps-screenshots live-browser tests
### Documentation
- Add local resource-awareness guidance to CLAUDE.md
- Emphasize local resource awareness with concurrent worktrees/agents
### Fixed
- **auth:** Preserve coarse project access fallback
### Miscellaneous
- **ci:** Remove dead self-hosted-ci workflow |
Owner
Author
|
The functional change was carried into upstream security-hardening PR gotempsh#676 and its merged replacement gotempsh#677. Upstream gotempsh#676 explicitly lists this fork PR in its source coverage. Fork main has now been fast-forwarded to upstream main at |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
project_permission_guard!treatedOk(None)fromeffective_project_permissions()as unrestricted and therefore skipped legacy coarseuser_can_access_project()checks, allowing instance-level permissions to operate on projects a user should not touch.Description
project_permission_guard!so that wheneffective_project_permissions()returnsOk(None)it falls back to callingProjectAccessChecker::user_can_access_project(user_id, project_id)and enforces deny/fail-closed semantics.permission_guard_preserves_legacy_coarse_project_denialthat provides aLegacyDenyChecker(calls counter) to verify the fallback is invoked and denies access.UnreleasedCHANGELOG.mdentry describing the fix for the project-permission guard membership fallback.Testing
cargo check -p temps-auth --liband it completed successfully.cargo fmt --all -- --checkand it passed with no formatting changes required.cargo test -p temps-auth permission_guard::tests -- --nocaptureand the suite (22 tests) passed successfully, including the newpermission_guard_preserves_legacy_coarse_project_denialtest.permission_guard_preserves_legacy_coarse_project_denialwhich passed, validating the legacy fallback behavior.Codex Task