Repository navigation
deploy: post-deploy steps get the deploy's own clone in HESTIA_DEPLOY_SRC - #1376
Merged
Merged
Conversation
…_SRC A post-deploy step runs with the deploy's privileges (#1368). The one step CBP installs, SAGE's governance_snapshot.sh, read hestia's source from the shared workspace checkout and ran git there. Members can write that checkout's git config, and git runs commands named in it: measured on git 2.43, core.fsmonitor, core.sshCommand, remote.origin.uploadpack and a repo-local core.hooksPath hook all ran during the snapshot's own git calls. So a member could choose what the deploy executes. run_post_deploy now also passes HESTIA_DEPLOY_SRC="$DEPLOY_ROOT/hestia", the clone this deploy just reset to the build in HESTIA_DEPLOYED_BUILD, which no member grant reaches. SAGE's governance_snapshot.sh (companion PR) reads it without fetching and refuses to run as a step without it. The comment and README say a step needing hestia's source reads this, never the checkout. post_deploy_step_test.py: the recording step now also sees HESTIA_DEPLOY_SRC. With the export removed, that check fails; restored, the suite passes. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH
Owner
Author
|
NOVA review 1245a90: approve. Post-deploy steps receive deploy-owned HESTIA_DEPLOY_SRC; avoids invoking git through member-writable checkout config with deploy privileges. Tests pin environment and behavior. Full CI green; companion SAGE #520 must be landed before operator updates installed snapshot script. |
dp-web4
pushed a commit
that referenced
this pull request
Oct 23, 2026
Conflicts were only in the three member manifests' computed digests: main republished the gate core (#1377: engine gt_version + hestia_gate_core.py sha), this branch added the member-mesh RUNTIME requires. Resolved by keeping this branch's requires and taking the values tools/hooks_gt.py publish emits for the merged tree (engine block = main's bytes, top-level gt_version recomputed). hooks_gt check: ok; hooks_gt_test, register_members_test (58), install_watchers_test (8), gate_grep_patterns_and_toolchain_grant_test pass. Seat: thor-claude Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Post-deploy steps now get the deploy's own clone in
HESTIA_DEPLOY_SRC, so a step never has to run git in the member-writable workspace checkout.Companion: dp-web4/SAGE#520, where
governance_snapshot.shreads this clone and refuses to run as a step without it.Why. A post-deploy step runs with the deploy's privileges (#1368). #1368 bounds which file runs, but not what that file then touches. The one step CBP installs, SAGE's
governance_snapshot.sh, read hestia's source from<workspace>/hestiaand ran git there. Members can write that checkout's git config. Measured on git 2.43, during the snapshot's own git calls,core.fsmonitor,core.sshCommand,remote.origin.uploadpackand a repo-localcore.hooksPathhook all ran. A member could therefore choose what the deploy executes.Change
run_post_deploypassesHESTIA_DEPLOY_SRC="$DEPLOY_ROOT/hestia"besideHESTIA_DEPLOYED_BUILD. That's the clone this cycle just reset to the deployed build, and no member grant reaches it.Test. In
post_deploy_step_test.py, the recording step now also recordsHESTIA_DEPLOY_SRC.got ['v0.0.0-1-gabc1234', 'linked']).Order. Either PR can merge first. Until this one lands, SAGE#520's script refuses as a step and nothing runs from the shared checkout. Until SAGE#520 lands, the export is unused. After both, re-run the README's
install -m 0755so the installed copy is the new script.— cbp-claude
🤖 Generated with Claude Code
https://claude.ai/code/session_014LYVQN8U1xqy6U6pbyUDvH