feat: implement issue #2143 — dev-lead test-regression guard runs PR test code as the harness user: job secrets are still readable via /proc and the real checkout

Merged
DO
11d ago
+1167-4

Problem

The test-regression guard runs a repo's test suite, which is code from the PR branch, inside the job that holds secrets.GH_PAT_DON_PETRY, the engine tokens and the API keys. PR #2019 limited what that code can reach, but it still runs as the same OS user as the harness, so it can read the secrets from an ancestor process's environment or from the real checkout (issue #2143).

Per the maintainer's decision in the issue, this PR moves the suite into a separate job with no secrets:

  • dispatch (work): the model runs and commits as today, then writes a handoff artifact and exits without pushing.
  • test-suite (new): permissions: {}, no secrets.*, no checkout. It rebuilds a throwaway repo from the artifact, runs the unchanged trg_scan_pass, and outputs only a verdict.
  • push (new, if: always()): restores the exact result commits, reads the verdict, and does everything that follows a push today, including the claim-retraction sweep on every outcome.

Provenance: this branch is dev-lead's checkpoint from run 37982565082, which hit the 45-minute action budget before it could open a PR. The commit is marked INCOMPLETE and has not been reviewed. Opened by the maintainer so CI and review can finish it.

Risk

High. It restructures dev-lead-reusable.yml, which eight consumer repos pin through the channel tags, and it changes the path every pushing pass takes. A fault here could stop dev-lead pushing, or push without a verdict. It must go through the canary rings, and it adds status checks (dev-lead / test-suite, dev-lead / push) whose names rulesets and the canary registry need to be checked against.

Test plan

New tests/dev-lead/unit/test_test_job_handoff.bats and additions to test_fix_reviews.bats (24 new tests), including the structure test over the workflow and the leak test. CI runs them; they have not been run since the checkpoint. Still to confirm against the issue: every acceptance criterion, in particular fail-closed behaviour when the test job is cancelled or reports nothing, and that non-guard intents stay single-job.

Rollback

Revert this PR, or roll the channel back with canary-rollout (command=rollback). No migrations or external state.

Monitoring

On ring0 after promotion: a pushing pass should show three jobs, a verdict in the run summary, and a verified push; a refused or failed test job should show no push and retracted claims.

Closes #2143

🤖 Generated with Claude Code