@deployfoundation/foundation-deploy 0.2.46 → 0.2.47

package/agent-image/Dockerfile

@@ -204,6 +204,16 @@ COPY packages/infra/agent-image/bin/git-credential-sky \
 # <app-id>+<app-slug>[bot] is what links a commit to the GitHub App.
 RUN chmod 0755 /opt/sky/bin/git-credential-sky /opt/sky/bin/gh /opt/sky/bin/aws /opt/sky/bin/gh-real \
     && printf '[credential "https://github.com"]\n\thelper = sky\n\tuseHttpPath = true\n[user]\n\tname = sky[bot]\n\temail = %s+sky[bot]@users.noreply.github.com\n' "${FOUNDATION_GITHUB_APP_ID}" > /etc/gitconfig
+# Pushes to main/master: refused unless config.yaml's github.directPush names the
+# repo and every changed path (git-hooks/pre-push; the agent exports the list as
+# FOUNDATION_DIRECT_PUSH each turn). core.hooksPath is set through GIT_CONFIG_*,
+# which git ranks like `-c`, above a cloned repo's own config, so a repo cannot
+# switch the guard off; the hook then runs that repo's own pre-push hook.
+COPY packages/infra/agent-image/git-hooks/pre-push /opt/sky/git-hooks/pre-push
+RUN chmod 0755 /opt/sky/git-hooks/pre-push
+ENV GIT_CONFIG_COUNT=1 \
+    GIT_CONFIG_KEY_0=core.hooksPath \
+    GIT_CONFIG_VALUE_0=/opt/sky/git-hooks
 # --- Ambient AWS (aws-broker.ts) --------------------------------------------
 # AWS CLI v2 as /opt/sky/bin/aws-real, fronted by the wrapper copied above.
 # /opt/sky/aws is where server.ts WRITES the generated profile file at boot,

package/agent-image/git-hooks/pre-push

@@ -0,0 +1,112 @@
+#!/usr/bin/env python3
+"""Foundation's guard on pushes to a default branch (main or master).
+
+git runs this before every push from the agent's sandbox: the image sets
+core.hooksPath through GIT_CONFIG_COUNT/KEY/VALUE, which git treats like `-c`
+and so ranks above a repository's own config. A push that updates
+refs/heads/main or refs/heads/master is refused unless the instance's
+`github.directPush` (FOUNDATION_DIRECT_PUSH, JSON, set by the agent from
+config.yaml every turn) names this repository AND every file the push changes
+sits under one of its paths. Deleting or creating main, or a push that is not a
+fast-forward, is always refused. Pushes to any other branch pass. The
+repository's own pre-push hook, if it has one, runs afterwards.
+
+stdin, one line per ref: <local ref> <local sha> <remote ref> <remote sha>
+argv: <remote name> <remote url>
+"""
+
+import json
+import os
+import re
+import subprocess
+import sys
+
+DEFAULT_BRANCHES = ("refs/heads/main", "refs/heads/master")
+REPO_FROM_URL = re.compile(r"^https://(?:[^@/]+@)?github\.com/([^/]+/[^/]+?)(?:\.git)?/?$")
+
+
+def git(*args: str) -> str:
+    return subprocess.run(["git", *args], capture_output=True, text=True, check=True).stdout
+
+
+def is_zero(sha: str) -> bool:
+    return set(sha) == {"0"}
+
+
+def allowed_paths(repo: str) -> list[str]:
+    try:
+        rules = json.loads(os.environ.get("FOUNDATION_DIRECT_PUSH") or "[]")
+    except ValueError:
+        return []
+    for rule in rules if isinstance(rules, list) else []:
+        if isinstance(rule, dict) and str(rule.get("repo", "")).lower() == repo.lower():
+            return [p for p in rule.get("paths", []) if isinstance(p, str) and p]
+    return []
+
+
+def under(path: str, allowed: list[str]) -> bool:
+    return any(path.startswith(a) if a.endswith("/") else path == a for a in allowed)
+
+
+def refuse(message: str) -> None:
+    print(f"Foundation: {message}", file=sys.stderr)
+    sys.exit(1)
+
+
+def check(remote_url: str, lines: list[str]) -> None:
+    match = REPO_FROM_URL.match(remote_url)
+    repo = match.group(1) if match else ""
+    for line in lines:
+        parts = line.split()
+        if len(parts) != 4:
+            continue
+        _local_ref, local_sha, remote_ref, remote_sha = parts
+        if remote_ref not in DEFAULT_BRANCHES:
+            continue
+        branch = remote_ref.removeprefix("refs/heads/")
+        allowed = allowed_paths(repo) if repo else []
+        if not allowed:
+            refuse(
+                f"never push to {branch}. Push a branch and open a pull request"
+                f" ({repo or remote_url} has no github.directPush exception)."
+            )
+        if is_zero(local_sha) or is_zero(remote_sha):
+            refuse(f"deleting or creating {branch} is never allowed.")
+        try:
+            git("merge-base", "--is-ancestor", remote_sha, local_sha)
+        except subprocess.CalledProcessError:
+            refuse(f"{branch} moved or is not a fast-forward: pull, re-apply your change, push again.")
+        changed = [p for p in git("diff", "--name-only", "-z", remote_sha, local_sha).split("\0") if p]
+        outside = [p for p in changed if not under(p, allowed)]
+        if outside:
+            refuse(
+                f"this push to {branch} changes files outside {', '.join(allowed)}: "
+                f"{', '.join(outside[:5])}. Push a branch and open a pull request."
+            )
+
+
+def run_repository_hook(argv: list[str], stdin: str) -> int:
+    """The repository's own pre-push hook: its core.hooksPath, else .git/hooks."""
+    try:
+        hooks = git("config", "--local", "--get", "core.hooksPath").strip()
+    except subprocess.CalledProcessError:
+        hooks = ""
+    if hooks == "":
+        hooks = os.path.join(git("rev-parse", "--git-common-dir").strip(), "hooks")
+    elif not os.path.isabs(hooks):
+        hooks = os.path.join(git("rev-parse", "--show-toplevel").strip(), hooks)
+    hook = os.path.join(hooks, "pre-push")
+    if os.path.realpath(hook) == os.path.realpath(__file__) or not os.access(hook, os.X_OK):
+        return 0
+    return subprocess.run([hook, *argv], input=stdin, text=True).returncode
+
+
+def main() -> None:
+    argv = sys.argv[1:]
+    stdin = sys.stdin.read()
+    check(argv[1] if len(argv) > 1 else "", stdin.splitlines())
+    sys.exit(run_repository_hook(argv, stdin))
+
+
+if __name__ == "__main__":
+    main()

package/agent-image/security-overlay.yml

@@ -88,13 +88,24 @@ bash:
       action: deny
     - pattern: "gh repo delete*"
       action: deny
-    - pattern: "git push*origin main*"
+    # Pushes to main/master are decided by the image's pre-push hook
+    # (git-hooks/pre-push), which sees the actual refs and changed paths
+    # however the push is spelled, and allows only config.yaml's
+    # github.directPush paths. These rules keep the hook from being skipped
+    # or re-pointed; GitHub branch protection would be the server-side backstop.
+    - pattern: "*--no-verify*"
       action: deny
-    - pattern: "git push*origin master*"
+    - pattern: "*GIT_CONFIG*"
       action: deny
-    - pattern: "git push*HEAD:main*"
+    - pattern: "*hooksPath*"
       action: deny
-    - pattern: "git push*HEAD:master*"
+    - pattern: "*hookspath*"
+      action: deny
+    - pattern: "*HOOKSPATH*"
+      action: deny
+    - pattern: "*FOUNDATION_DIRECT_PUSH*"
+      action: deny
+    - pattern: "*git-hooks*"
       action: deny
     # Ambient AWS (aws-broker.ts). BELT AND BRACES ONLY: the real guard is
     # IAM — every profile fetches credentials for a role carrying AWS's

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-cazzxewf.js";
+} from "../chunk-yn8x77x6.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-32ytmv5k.js";
+} from "../chunk-k6mcv6dk.js";
 import"../chunk-dz91avrb.js";
 
 // bin/app.ts

package/dist/bin/foundation-deploy.js

@@ -22,7 +22,7 @@ import {
   slackCommandPrefix,
   verifyManifest,
   versionedConfigKey
-} from "../chunk-32ytmv5k.js";
+} from "../chunk-k6mcv6dk.js";
 import {
   DEFAULT_RELEASE_BUCKET,
   expectedKeyArn

package/dist/{chunk-32ytmv5k.js → chunk-k6mcv6dk.js}

@@ -1433,6 +1433,14 @@ var RawSubagents = z5.object({
   maxRecursionDepth: z5.number().int().min(1).max(3).default(2),
   effort: z5.boolean().default(true)
 }).strict().default({});
+var GITHUB_REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+var DIRECT_PUSH_PATH_RE = /^(?!\/)(?!.*(?:^|\/)\.\.(?:\/|$))[A-Za-z0-9_.\/-]+$/;
+var RawGithub2 = z5.object({
+  directPush: z5.array(z5.object({
+    repo: z5.string().regex(GITHUB_REPO_RE, "repo must be owner/name"),
+    paths: z5.array(z5.string().regex(DIRECT_PUSH_PATH_RE, "paths are repo-relative folders or files: no leading /, no .., no globs")).min(1)
+  }).strict()).default([])
+}).strict().default({});
 var RawMemory = z5.object({ ompBackend: z5.enum(["off", "local"]).default("off") }).strict().default({});
 var SKILL_SOURCE_SCOPES = ["shared", "instance"];
 var RawSkillSourceMetadata = {
@@ -1467,7 +1475,8 @@ var RawInstanceConfig = z5.object({
   capabilities: RawCapabilities,
   jobs: RawJobs,
   subagents: RawSubagents,
-  memory: RawMemory
+  memory: RawMemory,
+  github: RawGithub2
 }).strict();
 function crmOutreachConfigured(outreach) {
   return outreach.eligibleStatuses.length > 0;
@@ -1522,6 +1531,12 @@ function parseInstanceConfig(yamlText) {
       effort: raw.subagents.effort
     },
     memory: { ompBackend: raw.memory.ompBackend },
+    github: {
+      directPush: raw.github.directPush.map((rule) => ({
+        repo: rule.repo,
+        paths: [...rule.paths]
+      }))
+    },
     capabilities: raw.capabilities,
     jobs: raw.jobs
   };

package/dist/{chunk-cazzxewf.js → chunk-yn8x77x6.js}

@@ -24,7 +24,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-32ytmv5k.js";
+} from "./chunk-k6mcv6dk.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-cazzxewf.js";
+} from "../chunk-yn8x77x6.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -44,7 +44,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-32ytmv5k.js";
+} from "../chunk-k6mcv6dk.js";
 import"../chunk-dz91avrb.js";
 export {
   BUILD_TIMEOUT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.46",
+  "version": "0.2.47",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,