Skip to content

chore: promote staging to staging-promote/8fffa879-24726363404 (2026-04-21 17:03 UTC)#2796

Open
ironclaw-ci[bot] wants to merge 1 commit intostaging-promote/8fffa879-24726363404from
staging-promote/c0b4e30c-24735636972
Open

chore: promote staging to staging-promote/8fffa879-24726363404 (2026-04-21 17:03 UTC)#2796
ironclaw-ci[bot] wants to merge 1 commit intostaging-promote/8fffa879-24726363404from
staging-promote/c0b4e30c-24735636972

Conversation

@ironclaw-ci
Copy link
Copy Markdown
Contributor

@ironclaw-ci ironclaw-ci Bot commented Apr 21, 2026 •
edited by github-actions Bot
Loading

Auto-promotion from staging CI

Batch range: 7fb41555a9e55677d1aaea29ca567a5b369c2b05..c0b4e30cf6f07c0852612c9f38d7c1e65ee7eab0
Promotion branch: staging-promote/c0b4e30c-24735636972
Base: staging-promote/8fffa879-24726363404
Triggered by: Staging CI batch at 2026-04-21 17:03 UTC

Commits in this batch (64):

Current commits in this promotion (1)

Current base: staging-promote/8fffa879-24726363404
Current head: staging-promote/c0b4e30c-24735636972
Current range: origin/staging-promote/8fffa879-24726363404..origin/staging-promote/c0b4e30c-24735636972

Auto-updated by staging promotion metadata workflow

Waiting for gates:

  • Tests: pending
  • E2E: pending
  • Claude Code review: pending (will post comments on this PR)

Auto-created by staging-ci workflow

@github-actions github-actions Bot added scope: ci CI/CD workflows size: S 10-49 changed lines risk: medium Business logic, config, or moderate-risk modules contributor: core 20+ merged PRs labels Apr 21, 2026
@claude
Copy link
Copy Markdown

claude Bot commented Apr 21, 2026

Code review

Found 5 issues:

  1. [CRITICAL:95] Authorization bypass - release input exposed in workflow_dispatch. This allows any GitHub contributor with actions:write permission to manually trigger release-style tagging without going through the approved release.yml workflow.

    Fix: Remove release from workflow_dispatch.inputs and only accept it in workflow_call.

    ironclaw/.github/workflows/docker.yml

    Lines 17 to 21 in 5e076d2

    # On-demand builds
    workflow_dispatch:
    inputs:
    release:
    description: "Set true to force release-style tags (:version, :latest, :sha-xxx)"

  2. [HIGH:85] Downstream dispatch silently skips on transient failures. The ironclaw-dind trigger step (line 210-218) has continue-on-error:true on token creation. If gh api fails transiently, dispatch is silently skipped with no notification.

    Fix: Either remove continue-on-error or add explicit logging if dispatch is skipped.

    ironclaw/.github/workflows/docker.yml

    Lines 192 to 218 in 5e076d2

    continue-on-error: true
    uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
    with:
    app-id: ${{ secrets.GH_RELEASES_MANAGER_APP_ID }}
    private-key: ${{ secrets.GH_RELEASES_MANAGER_APP_PRIVATE_KEY }}
    owner: nearai
    repositories: ironclaw-dind
    - name: Trigger ironclaw-dind Build & Push
    if: steps.app-token.outcome == 'success' && steps.check.outputs.skip != 'true'
    continue-on-error: true
    env:
    GH_TOKEN: ${{ steps.app-token.outputs.token }}
    EVENT_NAME: ${{ github.event_name }}
    IS_RELEASE_BUILD: ${{ inputs.release && 'true' || 'false' }}
    INPUT_TAG: ${{ inputs.tag }}
    VERSION: ${{ steps.version.outputs.version }}
    run: |
    if [[ "${IS_RELEASE_BUILD}" == "true" && -n "${VERSION}" ]]; then
    gh api repos/nearai/ironclaw-dind/dispatches \
    --method POST \
    -f event_type="ironclaw_image_published" \
    -f client_payload[version]="${VERSION}"
    elif [[ "${EVENT_NAME}" == "schedule" ]] || [[ "${INPUT_TAG}" == "staging" ]]; then
    gh api repos/nearai/ironclaw-dind/dispatches \
    --method POST \
    -f event_type="ironclaw_image_published"

  3. [MEDIUM:92] Boolean casting via ternary is fragile. Lines 76 and 206 use indirect conversion of the boolean input to shell variable.

    Fix: Use inputs.release directly; GitHub Actions natively coerces to string true/false.

    ironclaw/.github/workflows/docker.yml

    Line 76 in 5e076d2

    IS_RELEASE_BUILD: ${{ inputs.release && 'true' || 'false' }}

  4. [MEDIUM:72] Unused environment variable after refactor. EVENT_NAME is exported (line 75) but no longer referenced.

    Fix: Remove to reduce cognitive load.

    ironclaw/.github/workflows/docker.yml

    Line 75 in 5e076d2

    EVENT_NAME: ${{ github.event_name }}

  5. [MEDIUM:68] Release dispatch lacks VERSION guarantee. The condition at line 210 checks for non-empty VERSION but if version extraction fails, dispatch is silently skipped.

    Fix: Document this dependency or add validation.

    ironclaw/.github/workflows/docker.yml

    Lines 207 to 218 in 5e076d2

    INPUT_TAG: ${{ inputs.tag }}
    VERSION: ${{ steps.version.outputs.version }}
    run: |
    if [[ "${IS_RELEASE_BUILD}" == "true" && -n "${VERSION}" ]]; then
    gh api repos/nearai/ironclaw-dind/dispatches \
    --method POST \
    -f event_type="ironclaw_image_published" \
    -f client_payload[version]="${VERSION}"
    elif [[ "${EVENT_NAME}" == "schedule" ]] || [[ "${INPUT_TAG}" == "staging" ]]; then
    gh api repos/nearai/ironclaw-dind/dispatches \
    --method POST \
    -f event_type="ironclaw_image_published"

@railway-app railway-app Bot temporarily deployed to Ironclaw-QA / production April 21, 2026 17:18 Inactive
@railway-app railway-app Bot temporarily deployed to venice-ironclaw / production April 21, 2026 17:25 Inactive
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

contributor: core 20+ merged PRs risk: medium Business logic, config, or moderate-risk modules scope: ci CI/CD workflows size: S 10-49 changed lines staging-promotion

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@think-in-universe