fdai-deployment-cli 0.1.2__py3-none-any.whl

fdai_deployment_cli/github_artifact_io.py

@@ -0,0 +1,48 @@
+"""Bounded private artifact and GitHub JSON decoding."""
+
+from __future__ import annotations
+
+import json
+import os
+import stat
+from collections.abc import Mapping
+from pathlib import Path
+
+
+def _private_artifact_json(path: Path, label: str) -> dict[str, object]:
+    return dict(_json_object(_private_artifact_bytes(path, label).decode("utf-8"), label))
+
+
+def _private_artifact_bytes(path: Path, label: str) -> bytes:
+    descriptor = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)
+    with os.fdopen(descriptor, "rb") as stream:
+        details = os.fstat(stream.fileno())
+        if (
+            not stat.S_ISREG(details.st_mode)
+            or details.st_uid != os.geteuid()
+            or details.st_size > 262_144
+        ):
+            raise ValueError(f"github_{label.replace(' ', '_')}_file_invalid")
+        return stream.read(262_145)
+
+
+def _json_array(raw: str, label: str) -> list[Mapping[str, object]]:
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{label} response is invalid") from exc
+    if not isinstance(payload, list) or not all(isinstance(item, dict) for item in payload):
+        raise ValueError(f"{label} response MUST be an array of objects")
+    if len(payload) > 50:
+        raise ValueError(f"{label} response exceeds the requested bound")
+    return payload
+
+
+def _json_object(raw: str, label: str) -> Mapping[str, object]:
+    try:
+        payload = json.loads(raw)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"{label} response is invalid") from exc
+    if not isinstance(payload, dict):
+        raise ValueError(f"{label} response MUST be an object")  # noqa: TRY004
+    return payload

fdai_deployment_cli/github_dispatch.py

@@ -0,0 +1,248 @@
+"""Protected GitHub workflow plan and apply dispatch."""
+
+from __future__ import annotations
+
+from fdai_deployment_cli.github_transport import run_github_cli
+from fdai_deployment_cli.github_workflow_values import (
+    _COMMIT,
+    _DIGEST,
+    _ENVIRONMENTS,
+    _PLAN_ID,
+    _REQUEST_ID,
+    CommandRunner,
+    DeploymentSelection,
+    WorkflowDispatch,
+    _validate_repository,
+    deployment_context_digest,
+    enforce_plan_not_expired,
+    request_id,
+)
+
+
+def dispatch_plan(
+    *,
+    repository: str,
+    environment: str,
+    commit_sha: str,
+    target_binding: str,
+    region: str,
+    run_id: str,
+    selection: DeploymentSelection,
+    attempt: int = 1,
+    run: CommandRunner | None = None,
+) -> WorkflowDispatch:
+    """Dispatch one protected plan-only run."""
+
+    if environment == "prod":
+        raise ValueError("fdaictl production deployment inputs are not implemented")
+    context_digest = deployment_context_digest(
+        environment=environment,
+        commit_sha=commit_sha,
+        selection=selection,
+    )
+    bounded_request_id = request_id(
+        "plan",
+        run_id=run_id,
+        context_digest=context_digest,
+        target_binding=target_binding,
+        region=region,
+        attempt=attempt,
+    )
+    if selection.deploy_rca_reader_identity:
+        bounded_request_id = bounded_request_id.replace("plan-", "plan-rca-", 1)
+    elif selection.deploy_provider_schema:
+        request_prefix = (
+            "plan-provider-cost-"
+            if selection.runtime_image_profile == "cost-governance"
+            else "plan-provider-"
+        )
+        bounded_request_id = bounded_request_id.replace("plan-", request_prefix, 1)
+    elif selection.deploy_identity_migration:
+        bounded_request_id = bounded_request_id.replace("plan-", "plan-identity-", 1)
+    elif selection.deploy_operational_history:
+        bounded_request_id = bounded_request_id.replace("plan-", "plan-history-", 1)
+    elif selection.runtime_image_profile == "cost-governance":
+        bounded_request_id = bounded_request_id.replace("plan-", "plan-cost-", 1)
+    _dispatch(
+        repository=repository,
+        environment=environment,
+        commit_sha=commit_sha,
+        context_digest=context_digest,
+        request_id_value=bounded_request_id,
+        apply=False,
+        plan_id=None,
+        plan_digest=None,
+        resume_verification=False,
+        selection=selection,
+        run=run,
+    )
+    return WorkflowDispatch(
+        request_id=bounded_request_id,
+        run_name=f"deploy-{bounded_request_id}",
+        context_digest=context_digest,
+        mode="plan",
+    )
+
+
+def dispatch_apply(
+    *,
+    repository: str,
+    environment: str,
+    commit_sha: str,
+    target_binding: str,
+    region: str,
+    approval_quorum: int,
+    run_id: str,
+    plan_id: str,
+    plan_digest: str,
+    plan_expires_at: str,
+    resume_verification: bool,
+    selection: DeploymentSelection,
+    attempt: int = 1,
+    run: CommandRunner | None = None,
+) -> WorkflowDispatch:
+    """Dispatch exact-plan apply or verification-only resume."""
+
+    if environment == "prod":
+        raise ValueError("fdaictl production deployment inputs are not implemented")
+    if _PLAN_ID.fullmatch(plan_id) is None:
+        raise ValueError("plan_id is invalid")
+    if _DIGEST.fullmatch(plan_digest) is None:
+        raise ValueError("plan_digest MUST be a lowercase SHA-256")
+    if not resume_verification:
+        enforce_plan_not_expired(plan_expires_at)
+    context_digest = deployment_context_digest(
+        environment=environment,
+        commit_sha=commit_sha,
+        selection=selection,
+    )
+    if _DIGEST.fullmatch(target_binding) is None:
+        raise ValueError("target_binding MUST be a lowercase SHA-256")
+    if approval_quorum < 1:
+        raise ValueError("approval_quorum MUST be positive")
+    runner = run or run_github_cli
+    bounded_request_id = request_id(
+        "resume" if resume_verification else "apply",
+        run_id=run_id,
+        context_digest=context_digest,
+        target_binding=target_binding,
+        region=region,
+        attempt=attempt,
+    )
+    if selection.deploy_rca_reader_identity:
+        bounded_request_id = bounded_request_id.replace("apply-", "apply-rca-", 1)
+    elif selection.deploy_provider_schema:
+        request_prefix = (
+            "apply-provider-cost-"
+            if selection.runtime_image_profile == "cost-governance"
+            else "apply-provider-"
+        )
+        bounded_request_id = bounded_request_id.replace("apply-", request_prefix, 1)
+    elif selection.deploy_identity_migration:
+        bounded_request_id = bounded_request_id.replace("apply-", "apply-identity-", 1)
+    elif selection.deploy_operational_history:
+        bounded_request_id = bounded_request_id.replace("apply-", "apply-history-", 1)
+    elif selection.runtime_image_profile == "cost-governance":
+        bounded_request_id = bounded_request_id.replace("apply-", "apply-cost-", 1)
+    _dispatch(
+        repository=repository,
+        environment=environment,
+        commit_sha=commit_sha,
+        context_digest=context_digest,
+        request_id_value=bounded_request_id,
+        apply=True,
+        plan_id=plan_id,
+        plan_digest=plan_digest,
+        resume_verification=resume_verification,
+        selection=selection,
+        run=runner,
+    )
+    return WorkflowDispatch(
+        request_id=bounded_request_id,
+        run_name=f"deploy-{bounded_request_id}",
+        context_digest=context_digest,
+        mode="resume-verification" if resume_verification else "apply",
+    )
+
+
+def _dispatch(
+    *,
+    repository: str,
+    environment: str,
+    commit_sha: str,
+    context_digest: str,
+    request_id_value: str,
+    apply: bool,
+    plan_id: str | None,
+    plan_digest: str | None,
+    resume_verification: bool,
+    selection: DeploymentSelection,
+    run: CommandRunner | None,
+) -> None:
+    _validate_repository(repository)
+    if environment not in _ENVIRONMENTS:
+        raise ValueError("environment is unsupported")
+    if _COMMIT.fullmatch(commit_sha) is None:
+        raise ValueError("commit_sha MUST be a lowercase git SHA")
+    if _REQUEST_ID.fullmatch(request_id_value) is None:
+        raise ValueError("request_id is invalid")
+    fields: dict[str, str] = {
+        "environment": environment,
+        "apply": str(apply).lower(),
+        "promote_runtime_image": str(bool(selection.runtime_image_revision) and not apply).lower(),
+        "resume_verification": str(resume_verification).lower(),
+        "request_id": request_id_value,
+        "context_digest": context_digest,
+        "commit_sha": commit_sha,
+        **{
+            key: str(value).lower()
+            for key, value in selection.to_mapping().items()
+            if key
+            not in {
+                "deploy_identity_migration",
+                "deploy_operational_history",
+                "deploy_provider_schema",
+                "deploy_rca_reader_identity",
+                "runtime_call_evidence_transition",
+                "runtime_image_profile",
+            }
+        },
+    }
+    if apply:
+        if plan_id is None or plan_digest is None:
+            raise ValueError("exact apply requires plan id and digest")
+        fields["plan_id"] = plan_id
+        fields["plan_digest"] = plan_digest
+    workflow = "deploy-dev.yml"
+    if apply and (selection.deploy_operational_history or selection.deploy_rca_reader_identity):
+        workflow = "request-protected-operation.yml"
+        fields = {
+            "operation": (
+                "operational-history-apply"
+                if selection.deploy_operational_history
+                else "rca-reader-apply"
+            ),
+            "environment": environment,
+            "commit_sha": commit_sha,
+            "request_id": request_id_value,
+            "context_digest": context_digest,
+            "plan_id": fields["plan_id"],
+            "plan_digest": fields["plan_digest"],
+            "resume_verification": str(resume_verification).lower(),
+        }
+        if selection.deploy_operational_history:
+            fields["runtime_image_revision"] = selection.runtime_image_revision
+    arguments = [
+        "workflow",
+        "run",
+        workflow,
+        "--repo",
+        repository,
+        "--ref",
+        "main",
+    ]
+    for key, value in fields.items():
+        arguments.extend(("--field", f"{key}={value}"))
+    result = (run or run_github_cli)(tuple(arguments))
+    if result.returncode != 0:
+        raise ValueError("github_workflow_dispatch_failed")

fdai_deployment_cli/github_plan_artifact.py

@@ -0,0 +1,181 @@
+"""Protected plan artifact download and validation."""
+
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+
+from fdai_deployment_cli.contracts import canonical_digest
+from fdai_deployment_cli.github_artifact_io import _private_artifact_json
+from fdai_deployment_cli.github_workflow_values import (
+    _COMMIT,
+    _DIGEST,
+    _OCI_DIGEST,
+    _PLAN_ID,
+    CommandRunner,
+)
+
+_CORE_POST_APPLY_OBSERVATIONS = [
+    "database-migrations",
+    "runtime-health",
+    "initial-inventory-execution",
+    "canary-publisher",
+    "terraform-zero-change",
+]
+
+_COST_GOVERNANCE_POST_APPLY_OBSERVATIONS = [
+    "terraform-zero-change",
+    "cost-governance-job-image-readback",
+]
+
+_PROVIDER_SCHEMA_POST_APPLY_OBSERVATIONS = [
+    "terraform-zero-change",
+    "provider-schema-core-baseline",
+    "provider-schema-job-execution",
+    "provider-schema-durable-generation",
+    "provider-schema-agent-review",
+]
+
+
+def _download_plan_metadata(
+    *,
+    repository: str,
+    workflow_run_id: int,
+    request_id_value: str,
+    expected_commit: str,
+    expected_context_digest: str,
+    run: CommandRunner,
+) -> dict[str, object]:
+    with tempfile.TemporaryDirectory(prefix="fdai-plan-status-") as raw_directory:
+        directory = Path(raw_directory)
+        result = run(
+            (
+                "run",
+                "download",
+                str(workflow_run_id),
+                "--repo",
+                repository,
+                "--name",
+                f"deployment-plan-metadata-{request_id_value}",
+                "--dir",
+                str(directory),
+            )
+        )
+        if result.returncode != 0:
+            raise ValueError("github_plan_metadata_unavailable")
+        payload = _private_artifact_json(directory / "plan-metadata.json", "plan metadata")
+    required = {
+        "schema_version": "fdai.deployment-plan.v1",
+        "request_id": request_id_value,
+        "commit_sha": expected_commit,
+        "context_digest": expected_context_digest,
+        "status": "ready",
+    }
+    if any(payload.get(key) != value for key, value in required.items()):
+        raise ValueError("github_plan_metadata_context_mismatch")
+    plan_id = payload.get("plan_id")
+    plan_digest = payload.get("plan_digest")
+    context_digest = payload.get("context_digest")
+    expires_at = payload.get("expires_at")
+    if (
+        not isinstance(plan_id, str)
+        or _PLAN_ID.fullmatch(plan_id) is None
+        or not isinstance(plan_digest, str)
+        or _DIGEST.fullmatch(plan_digest) is None
+        or not isinstance(context_digest, str)
+        or _DIGEST.fullmatch(context_digest) is None
+        or not isinstance(expires_at, str)
+    ):
+        raise ValueError("github_plan_metadata_invalid")
+    summary = _plan_summary(payload.get("plan_summary"))
+    observations = payload.get("post_apply_observations")
+    provider_schema = request_id_value.startswith("plan-provider-")
+    cost_governance = request_id_value.startswith("plan-cost-")
+    expected_observations = (
+        _PROVIDER_SCHEMA_POST_APPLY_OBSERVATIONS
+        if provider_schema
+        else (
+            _COST_GOVERNANCE_POST_APPLY_OBSERVATIONS
+            if cost_governance
+            else _CORE_POST_APPLY_OBSERVATIONS
+        )
+    )
+    if observations != expected_observations:
+        raise ValueError("github_plan_metadata_observations_invalid")
+    runtime_image = payload.get("runtime_image")
+    expected_profile = (
+        "cost-governance"
+        if cost_governance or request_id_value.startswith("plan-provider-cost-")
+        else "core-control-plane"
+    )
+    if (cost_governance or provider_schema) and (
+        not isinstance(runtime_image, dict)
+        or set(runtime_image) != {"source_revision", "digest", "profile"}
+        or not isinstance(runtime_image.get("source_revision"), str)
+        or _COMMIT.fullmatch(runtime_image["source_revision"]) is None
+        or not isinstance(runtime_image.get("digest"), str)
+        or _OCI_DIGEST.fullmatch(runtime_image["digest"]) is None
+        or runtime_image.get("profile") != expected_profile
+    ):
+        raise ValueError("github_plan_metadata_runtime_image_invalid")
+    projected: dict[str, object] = {
+        "plan_id": plan_id,
+        "plan_digest": plan_digest,
+        "context_digest": context_digest,
+        "expires_at": expires_at,
+        "status": "ready",
+        "plan_summary": summary,
+        "post_apply_observations": observations,
+    }
+    if provider_schema and isinstance(runtime_image, dict):
+        projected["runtime_image"] = dict(runtime_image)
+    return projected
+
+
+def _plan_summary(value: object) -> dict[str, object]:
+    """Validate one address-free protected-plan action summary."""
+
+    if not isinstance(value, dict) or set(value) != {
+        "schema_version",
+        "action_counts",
+        "resource_type_counts",
+        "managed_resources",
+        "destructive",
+        "summary_digest",
+    }:
+        raise ValueError("github_plan_summary_invalid")
+    digest = value.get("summary_digest")
+    body = {key: item for key, item in value.items() if key != "summary_digest"}
+    if (
+        value.get("schema_version") != "fdai.deployment-plan-summary.v1"
+        or not isinstance(digest, str)
+        or _DIGEST.fullmatch(digest) is None
+        or canonical_digest(body) != digest
+        or type(value.get("managed_resources")) is not int
+        or int(value["managed_resources"]) < 0
+        or type(value.get("destructive")) is not bool
+    ):
+        raise ValueError("github_plan_summary_invalid")
+    actions = value.get("action_counts")
+    expected_actions = {"create", "update", "delete", "replace", "no_op", "read"}
+    if (
+        not isinstance(actions, dict)
+        or set(actions) != expected_actions
+        or any(type(count) is not int or count < 0 for count in actions.values())
+        or sum(actions.values()) != value["managed_resources"]
+    ):
+        raise ValueError("github_plan_summary_invalid")
+    resource_types = value.get("resource_type_counts")
+    if not isinstance(resource_types, dict) or len(resource_types) > 256:
+        raise ValueError("github_plan_summary_invalid")
+    for resource_type, counts in resource_types.items():
+        if (
+            not isinstance(resource_type, str)
+            or not resource_type
+            or len(resource_type) > 128
+            or not isinstance(counts, dict)
+            or not set(counts).issubset(expected_actions)
+            or any(type(count) is not int or count <= 0 for count in counts.values())
+        ):
+            raise ValueError("github_plan_summary_invalid")
+    return {str(key): item for key, item in value.items()}

fdai_deployment_cli/github_provider_artifact.py

@@ -0,0 +1,170 @@
+"""Provider-schema deployment evidence validation."""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+
+from fdai_deployment_cli.github_workflow_values import (
+    _DIGEST,
+    _OCI_DIGEST,
+    _PROVIDER_SOURCE_REVISION,
+)
+
+
+def _validate_provider_schema_core_baseline(
+    value: Mapping[str, object],
+    *,
+    expected_source_revision: str,
+    expected_image_digest: str,
+) -> None:
+    """Reject a provider baseline that does not prove the exact healthy Core image."""
+
+    max_inactive_revisions = value.get("max_inactive_revisions")
+    if (
+        set(value)
+        != {
+            "schema_version",
+            "source_revision",
+            "image_digest",
+            "core_app_ref_digest",
+            "active_revision_ref_digest",
+            "max_inactive_revisions",
+            "health_state",
+            "provisioning_state",
+            "observed_at",
+            "grants_authority",
+        }
+        or value.get("schema_version") != "fdai.provider-schema-core-baseline.v1"
+        or value.get("source_revision") != expected_source_revision
+        or value.get("image_digest") != expected_image_digest
+        or value.get("health_state") != "Healthy"
+        or value.get("provisioning_state") != "Provisioned"
+        or value.get("grants_authority") is not False
+        or not isinstance(max_inactive_revisions, int)
+        or isinstance(max_inactive_revisions, bool)
+        or max_inactive_revisions < 1
+        or not isinstance(value.get("observed_at"), str)
+    ):
+        raise ValueError("github_provider_schema_core_baseline_invalid")
+    for field in ("core_app_ref_digest", "active_revision_ref_digest"):
+        digest = value.get(field)
+        if not isinstance(digest, str) or _DIGEST.fullmatch(digest) is None:
+            raise ValueError("github_provider_schema_core_baseline_invalid")
+
+
+def _validate_provider_schema_evidence(
+    value: Mapping[str, object],
+    *,
+    expected_application_source: str,
+    expected_runtime_revision: str,
+    expected_plan_id: str,
+) -> dict[str, object]:
+    """Validate durable provider generation and conditional agent-review evidence."""
+
+    expected_fields = {
+        "schema_version",
+        "application_source_commit",
+        "runtime_image_revision",
+        "plan_id",
+        "job_execution_ref_digest",
+        "job_execution_status",
+        "checked_at",
+        "provider_source_revision",
+        "baseline_digest",
+        "observed_digest",
+        "drift_digest",
+        "disposition",
+        "durable_generation_digest",
+        "durable_generation_revision",
+        "run_receipt_digest",
+        "review_package_digest",
+        "heimdall_review_dispatched",
+        "review_evidence_status",
+        "correlation_id",
+        "forseti_risk_verdict",
+        "forseti_reason",
+        "saga_audit_entry_hash",
+        "grants_authority",
+    }
+    generation_revision = value.get("durable_generation_revision")
+    if (
+        set(value) != expected_fields
+        or value.get("schema_version") != "fdai.provider-schema-deployment-evidence.v1"
+        or value.get("application_source_commit") != expected_application_source
+        or value.get("runtime_image_revision") != expected_runtime_revision
+        or value.get("plan_id") != expected_plan_id
+        or value.get("job_execution_status") != "Succeeded"
+        or value.get("grants_authority") is not False
+        or not isinstance(value.get("checked_at"), str)
+        or value.get("disposition") not in {"unchanged", "compatible", "breaking"}
+        or not isinstance(generation_revision, int)
+        or isinstance(generation_revision, bool)
+        or generation_revision < 1
+    ):
+        raise ValueError("github_provider_schema_evidence_invalid")
+    job_execution_digest = value.get("job_execution_ref_digest")
+    if not isinstance(job_execution_digest, str) or _DIGEST.fullmatch(job_execution_digest) is None:
+        raise ValueError("github_provider_schema_evidence_invalid")
+    drift_digest = value.get("drift_digest")
+    if drift_digest is not None and (
+        not isinstance(drift_digest, str) or _DIGEST.fullmatch(drift_digest) is None
+    ):
+        raise ValueError("github_provider_schema_evidence_invalid")
+    provider_revision = value.get("provider_source_revision")
+    if (
+        not isinstance(provider_revision, str)
+        or _PROVIDER_SOURCE_REVISION.fullmatch(provider_revision) is None
+    ):
+        raise ValueError("github_provider_schema_evidence_invalid")
+    for field in (
+        "baseline_digest",
+        "observed_digest",
+        "durable_generation_digest",
+        "run_receipt_digest",
+    ):
+        digest = value.get(field)
+        if not isinstance(digest, str) or _OCI_DIGEST.fullmatch(digest) is None:
+            raise ValueError("github_provider_schema_evidence_invalid")
+    review_status = value.get("review_evidence_status")
+    if review_status == "verified":
+        if (
+            value.get("disposition") != "breaking"
+            or value.get("heimdall_review_dispatched") is not True
+            or not isinstance(drift_digest, str)
+            or _DIGEST.fullmatch(drift_digest) is None
+            or value.get("correlation_id") != f"provider-schema:azure:{drift_digest}"
+            or value.get("forseti_risk_verdict") != "hil"
+            or value.get("forseti_reason") != "no_rule_match"
+            or not isinstance(value.get("review_package_digest"), str)
+            or _OCI_DIGEST.fullmatch(str(value["review_package_digest"])) is None
+            or not isinstance(value.get("saga_audit_entry_hash"), str)
+        ):
+            raise ValueError("github_provider_schema_evidence_invalid")
+    elif review_status == "not_applicable":
+        if (
+            value.get("disposition") == "breaking"
+            or value.get("heimdall_review_dispatched") is not False
+            or any(
+                value.get(field) is not None
+                for field in (
+                    "review_package_digest",
+                    "correlation_id",
+                    "forseti_risk_verdict",
+                    "forseti_reason",
+                    "saga_audit_entry_hash",
+                )
+            )
+        ):
+            raise ValueError("github_provider_schema_evidence_invalid")
+    else:
+        raise ValueError("github_provider_schema_evidence_invalid")
+    return {
+        "provider_source_revision": provider_revision,
+        "durable_generation_digest": value["durable_generation_digest"],
+        "durable_generation_revision": value["durable_generation_revision"],
+        "disposition": value["disposition"],
+        "review_evidence_status": review_status,
+        "heimdall_review_dispatched": value["heimdall_review_dispatched"],
+        "forseti_risk_verdict": value["forseti_risk_verdict"],
+        "saga_audit_entry_hash": value["saga_audit_entry_hash"],
+    }

fdai_deployment_cli/github_transport.py

@@ -0,0 +1,46 @@
+"""Bounded GitHub CLI process transport."""
+
+from __future__ import annotations
+
+import shutil
+import subprocess
+
+from fdai_deployment_cli.github_workflow_values import CommandResult, CommandRunner
+
+_ARTIFACT_DOWNLOAD_TIMEOUT = 90
+
+_DEFAULT_GH_TIMEOUT = 30
+
+
+def run_github_cli(
+    arguments: tuple[str, ...],
+    timeout: int = _DEFAULT_GH_TIMEOUT,
+) -> CommandResult:
+    """Execute one fixed GitHub CLI command with bounded output and duration."""
+
+    executable = shutil.which("gh")
+    if executable is None:
+        raise OSError("GitHub CLI is unavailable")
+    try:
+        completed = subprocess.run(
+            [executable, *arguments],
+            check=False,
+            capture_output=True,
+            text=True,
+            timeout=timeout,
+        )
+    except subprocess.TimeoutExpired:
+        return CommandResult(returncode=124, stdout="", stderr="")
+    return CommandResult(
+        returncode=completed.returncode,
+        stdout=completed.stdout[:65_536],
+        stderr=completed.stderr[:65_536],
+    )
+
+
+def _artifact_runner(base: CommandRunner) -> CommandRunner:
+    """Wrap the real runner with a longer timeout for artifact downloads."""
+
+    if base is not run_github_cli:
+        return base  # Test runners handle their own timing.
+    return lambda args: run_github_cli(args, timeout=_ARTIFACT_DOWNLOAD_TIMEOUT)