risk tier: the pre-push hook's trust boundary grades high

Merged
LA
3d ago
+37-1

Summary

The pre-push hook runs check code on every contributor's machine before a push. Changing the code that decides which code the hook runs can make it run code that a push controls, and a revert cannot undo code that has already run. #34124 finds and closes several such routes, but the classifier grades it normal by path.

These files now grade high, in scripts/ci/risk_tier.py, under the kind "the pre-push hook's trust boundary":

  • scripts/web_lint_prepush.py and scripts/cmux-next/prepush-gate.py: which check code runs. The gate picks the reviewed copy or the pushed code for each of its checks.
  • scripts/cmux-next/push_range.py: which commits a push owns, and so which changes to check code the hook sees.
  • scripts/git-hooks/pre-push: the hook.
  • scripts/install-git-hooks.sh, scripts/git-hooks/refresh_checks.py and scripts/git-hooks/post-merge: how the reviewed copy of the checks is installed and refreshed. post-merge decides when a checkout reinstalls it.

The lint rules that the hook runs (scripts/cmux-next/check-*.py, guardrails.py, the package check scripts, config/vite-plus/, run-check-pieces.py) stay normal. The hook never runs run-check-pieces.py, which only runs bun run check by hand and in CI. docs/ci/risk-tiers.md gets the matching row.

Over the last 30 days these seven files changed in about 80 commits. A high pull request needs an independent SHIP at the exact head, which every pull request gets anyway. It does not wait for a person.

This PR changes the risk gate itself, so it grades high ("the risk gate itself").

Testing

Each fix has a red test commit before it. On the base, the first test commit (6f97c59ffa9) gives 5 failures; after the review, the second test commit gives 3 more failures (on 39ec8cab9ca). All pass on the head:

(cd tests && python3 -m unittest -k pre_push_trust -k lint_rules_stay test_risk_tier)
  • Base 51fad067074: 5 failures, one per trust-boundary file.
  • Head: all pass. test_the_hooks_lint_rules_stay_normal passes on both, as a guard that the rule does not reach the lint rules.

Observed / Not run

Observed:

  • python3 tests/test_risk_tier.py: 69 tests OK.
  • risk_tier.classify on this PR's files gives risk:high ("the risk gate itself").
  • python3 scripts/cmux-next/prepush-gate.py: no new violations.

Not run:

  • Compile: this PR changes only Python, tests and docs, so the compile lanes skip.

Changelog

none

Proof

No capture: CI tooling only.