Skip to content

Harden StormDNS boundary guard #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AmirrezaFarnamTaheri wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Harden StormDNS boundary guard #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 21 additions & 10 deletions .github/workflows/stormdns-boundary.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,24 @@ jobs:
base_ref="${{ github.event.pull_request.base.sha }}"
head_ref="${{ github.event.pull_request.head.sha }}"

if scripts/check-stormdns-boundary.sh "${base_ref}" "${head_ref}"; then
exit 0
fi

if [[ "${HAS_UPSTREAM_LABEL}" == "true" ]]; then
echo "StormDNS upstream changes are intentionally labeled."
exit 0
fi

exit 1
set +e
scripts/check-stormdns-boundary.sh "${base_ref}" "${head_ref}"
guard_status=$?
set -e

case "${guard_status}" in
0)
exit 0
;;
1)
if [[ "${HAS_UPSTREAM_LABEL}" == "true" ]]; then
echo "StormDNS upstream changes are intentionally labeled."
exit 0
fi
exit 1
;;
*)
echo "StormDNS boundary guard failed before it could evaluate upstream changes." >&2
exit "${guard_status}"
;;
esac
6 changes: 3 additions & 3 deletions docs/STORMDNS_UPSTREAM_POLICY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,11 +34,11 @@ Changes under `third_party/StormDNS` are allowed only when they are intentional
- Syncing a reviewed upstream fix.
- Refreshing native binaries from a documented upstream commit.

Any pull request that changes `third_party/StormDNS` must include the label:
Any pull request that changes `third_party/StormDNS` or `.gitmodules` must include the label:

`allow-stormdns-upstream`

Without that label, CI fails before review to prevent accidental local edits to the upstream engine.
Without that label, CI fails before review to prevent accidental local edits to the upstream engine or its submodule metadata.

## Review Checklist

Expand All @@ -49,4 +49,4 @@ For any pull request touching StormDNS integration:
- Confirm telemetry parsing is tolerant of unknown or changed output.
- Confirm optional behavior is gated by executable version/capability detection when needed.
- Confirm no Android app code imports, parses, or depends on StormDNS Go internals.
- Confirm `third_party/StormDNS` changes are either absent or intentionally labeled and explained.
- Confirm `third_party/StormDNS` and `.gitmodules` changes are either absent or intentionally labeled and explained.
16 changes: 12 additions & 4 deletions scripts/check-stormdns-boundary.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,17 @@ if ! git rev-parse --verify "${base_ref}" >/dev/null 2>&1; then
exit 2
fi

changed_files="$(
git diff --name-only "${base_ref}...${head_ref}" -- 'third_party/StormDNS' || true
)"
if ! git rev-parse --verify "${head_ref}" >/dev/null 2>&1; then
echo "Head ref '${head_ref}' is not available." >&2
exit 2
fi

if ! changed_files="$(
git diff --name-only "${base_ref}...${head_ref}" -- 'third_party/StormDNS' '.gitmodules'
)"; then
echo "Unable to diff '${base_ref}...${head_ref}' for StormDNS boundary changes." >&2
exit 2
fi

if [[ -z "${changed_files}" ]]; then
echo "No StormDNS upstream changes detected."
Expand All @@ -21,6 +29,6 @@ fi
echo "StormDNS upstream changes detected:" >&2
echo "${changed_files}" >&2
echo >&2
echo "WhiteDNS treats third_party/StormDNS as a black-box upstream engine." >&2
echo "WhiteDNS treats third_party/StormDNS and its submodule metadata as a black-box upstream engine." >&2
echo "Add the 'allow-stormdns-upstream' pull request label only when these changes are intentional upstream maintenance." >&2
exit 1
Loading