[Security] Make runtime job types semantically safe

.github/workflows/ci.yml

@@ -5,6 +5,9 @@ on:
   push:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   gates:
     runs-on: ubuntu-latest
@@ -56,3 +59,12 @@ jobs:
       - name: Production quality gate
         working-directory: ./frontend
         run: npm run check:quality
+
+  release:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    needs: [gates, controller, frontend]
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    uses: ./.github/workflows/release.yml

.github/workflows/release.yml

@@ -1,39 +1,47 @@
 name: Release
 
 on:
-  workflow_run:
-    workflows: [CI]
-    types: [completed]
-    branches: [main]
+  workflow_call:
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+  queue: max
 
 permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+  contents: read
 
 jobs:
   release:
-    if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event.workflow_run.head_sha }}
-
-      - name: Select tested main revision
-        run: git checkout -B main "${{ github.event.workflow_run.head_sha }}"
+          ref: ${{ github.sha }}
 
       - uses: actions/setup-node@v4
         with:
           node-version: 22.19.0
 
+      - name: Verify tested main revision
+        id: revision
+        env:
+          TESTED_SHA: ${{ github.sha }}
+        run: node scripts/release-revision.mjs
+
       - name: Configure git author
+        if: steps.revision.outputs.current == 'true'
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
       - name: Release
+        if: steps.revision.outputs.current == 'true'
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |

controller/contracts/system.ts

@@ -38,6 +38,10 @@ export type EngineBackend = "vllm" | "sglang" | "llamacpp" | "mlx";
 
 export type RuntimeKind = "venv" | "docker" | "binary" | "system";
 
+export const RUNTIME_JOB_TYPES = ["install", "update"] as const;
+
+export type RuntimeJobType = (typeof RUNTIME_JOB_TYPES)[number];
+
 export interface RuntimeTarget {
   id: string;
   backend: EngineBackend;
@@ -74,7 +78,7 @@ export interface EngineJob {
   id: string;
   backend: EngineBackend;
   targetId?: string;
-  type: "install" | "update" | "download" | "inspect";
+  type: RuntimeJobType;
   status: "queued" | "running" | "success" | "error" | "cancelled";
   progress?: number;
   message: string;

controller/src/modules/engines/runtime-routes.ts

@@ -1,3 +1,4 @@
+import { RUNTIME_JOB_TYPES } from "@local-studio/contracts/system";
 import { Effect, Schema } from "effect";
 import { badRequest, notFound } from "../../core/errors";
 import { decodeJsonBody } from "../../core/validation";
@@ -22,7 +23,6 @@ import {
 import { getVllmConfigHelp, getVllmRuntimeInfo } from "./runtimes/vllm-runtime";
 
 const RUNTIME_JOB_BACKENDS = ["vllm", "sglang", "llamacpp", "mlx", "cuda", "rocm"] as const;
-const RUNTIME_JOB_TYPES = ["install", "update", "download", "inspect"] as const;
 
 type RuntimeJobBody = {
   backend?: (typeof RUNTIME_JOB_BACKENDS)[number];

controller/src/modules/engines/runtimes/engine-jobs.ts

@@ -5,6 +5,7 @@ import type { Config } from "../../../config/env";
 import type {
   EngineBackend,
   EngineJob,
+  RuntimeJobType,
   RuntimeTarget,
   RuntimeUpgradeResult,
 } from "@local-studio/contracts/system";
@@ -31,7 +32,7 @@ type RuntimeJobBackend = EngineBackend | "cuda" | "rocm";
 
 type CreateEngineJobOptions = {
   backend: RuntimeJobBackend;
-  type: EngineJob["type"];
+  type: RuntimeJobType;
   targetId?: string;
   version?: string;
   preferBundled?: boolean;
@@ -151,6 +152,33 @@ const runEngineInstall = (
     );
   });
 
+const unsupportedPlatformInstall = (backend: "cuda" | "rocm"): RuntimeUpgradeResult => ({
+  success: false,
+  version: null,
+  output: null,
+  error: `${backend.toUpperCase()} supports update jobs only.`,
+  used_command: null,
+});
+
+const runJobOperation = (
+  config: Config,
+  job: EngineJob,
+  options: CreateEngineJobOptions,
+  target: RuntimeTarget | null,
+): Effect.Effect<RuntimeUpgradeResult, EngineOperationError> => {
+  switch (options.type) {
+    case "install":
+      if (isPlatformBackend(options.backend)) {
+        return Effect.succeed(unsupportedPlatformInstall(options.backend));
+      }
+      return runEngineInstall(config, job, options, options.backend, target);
+    case "update":
+      return isPlatformBackend(options.backend)
+        ? runPlatformUpgrade(options.backend, {})
+        : runEngineInstall(config, job, options, options.backend, target);
+  }
+};
+
 const runJob = (
   config: Config,
   job: EngineJob,
@@ -175,7 +203,7 @@ const runJob = (
           }),
         );
       }
-      if (options.type !== "inspect" && !target.capabilities.canUpdate) {
+      if (!target.capabilities.canUpdate) {
         return yield* Effect.fail(
           new EngineOperationError({
             operation: "validate-runtime-target",
@@ -188,13 +216,9 @@ const runJob = (
       target = yield* getDefaultRuntimeTarget(config, "vllm", options.runningProcess);
     }
 
-    const result = isPlatformBackend(options.backend)
-      ? yield* runPlatformUpgrade(options.backend, {})
-      : yield* runEngineInstall(config, job, options, options.backend, target);
+    const result = yield* runJobOperation(config, job, options, target);
 
-    if (options.type === "install" || options.type === "update") {
-      clearRuntimeTargetsCache();
-    }
+    clearRuntimeTargetsCache();
     const outputTail = tailOutput(result.output ?? result.error);
     const command = result.used_command ?? job.command;
     if (!result.success) {