fix(template): verify required-check application bindings on readback #27

New Issue

2026-10-10T23:40:32Z

KofTwentyTwo commented

2026-10-10 23:40:32 +00:00

(Migrated from github.com)

Problem

The starter administration tool's Validate mode reports SettingsVerified = true after required-check integration_id bindings are removed or changed to another application. Its expected offline plan contains only context names, so subset comparison does not verify the trusted check producer. Apply also modifies the caller's nested plan in place, preventing reliable reuse of that reviewed plan.

Reproduced on signed starter head 49df490: focused tests pass 14 cases and fail three new regressions (wrong binding, missing binding, caller-plan mutation). Retained evidence: artifacts/readiness-issues/application-bindings-red.xml.

GitHub's actual read-only /apps/github-actions response identifies app ID 15368, slug github-actions, owner github. The official ruleset API defines integration_id as the required status check's originating integration; app lookup supplies its identity. No settings were changed during discovery.

Acceptance criteria

Resolve and validate the trusted GitHub Actions application identity for both Apply and Validate; fail on invalid/missing identity.
Require every planned status context to bind to that application during existing-policy preflight and final readback. Reject wrong/missing bindings without overwriting conflicting policy.
Verify successful bootstrap check records come from the same application before writes.
Preserve the original offline/caller plan so repeat apply/validate can reuse it.
Cover correct bindings, wrong/missing bindings, invalid application identity and a bootstrap producer mismatch; verify actual packed/renamed CLI and GUI templates retain the fix.
Preserve authorization boundaries and update onboarding/threat-model evidence; broader live disposable-repository acceptance remains in #10.

Related: #10, #13, #20. Substantial implementation/review assistance: Codex (GPT-6). No push, repository creation, live settings change, merge or release is authorized by this issue.

## Problem The starter administration tool's `Validate` mode reports `SettingsVerified = true` after required-check `integration_id` bindings are removed or changed to another application. Its expected offline plan contains only context names, so subset comparison does not verify the trusted check producer. `Apply` also modifies the caller's nested plan in place, preventing reliable reuse of that reviewed plan. Reproduced on signed starter head 49df490: focused tests pass 14 cases and fail three new regressions (wrong binding, missing binding, caller-plan mutation). Retained evidence: `artifacts/readiness-issues/application-bindings-red.xml`. GitHub's actual read-only `/apps/github-actions` response identifies app ID 15368, slug github-actions, owner github. The official [ruleset API](https://docs.github.com/en/rest/repos/rules#create-a-repository-ruleset) defines integration_id as the required status check's originating integration; [app lookup](https://docs.github.com/en/rest/apps/apps#get-an-app) supplies its identity. No settings were changed during discovery. ## Acceptance criteria - Resolve and validate the trusted GitHub Actions application identity for both Apply and Validate; fail on invalid/missing identity. - Require every planned status context to bind to that application during existing-policy preflight and final readback. Reject wrong/missing bindings without overwriting conflicting policy. - Verify successful bootstrap check records come from the same application before writes. - Preserve the original offline/caller plan so repeat apply/validate can reuse it. - Cover correct bindings, wrong/missing bindings, invalid application identity and a bootstrap producer mismatch; verify actual packed/renamed CLI and GUI templates retain the fix. - Preserve authorization boundaries and update onboarding/threat-model evidence; broader live disposable-repository acceptance remains in #10. Related: #10, #13, #20. Substantial implementation/review assistance: Codex (GPT-6). No push, repository creation, live settings change, merge or release is authorized by this issue.

KofTwentyTwo commented

2026-10-10 23:46:48 +00:00

(Migrated from github.com)

Completed the focused onboarding fix in signed/DCO starter commit bb310f3208c9e4203ad42c007bf1671933a843be (local fix/template-onboarding; not published).

Apply and read-only Validate now resolve the official GitHub Actions app and require its ID on every required context. Missing/wrong bindings and another bootstrap producer fail before writes. The reviewed caller plan stays unchanged and reusable. Existing conflicting rules are preserved.

Evidence: retained RED reproduces wrong/missing bindings and input mutation (3 failures); full source and both actual packed/generated CLI and GUI-only variants each pass 54/54 Pester cases, zero failures/skips. Both changed PowerShell files pass the configured full analyzer rules; both docs pass Markdown lint; diff checks and signed-commit hooks pass. The generated-test processes ended exit 0. Official app lookup was read-only (github-actions, owner github, ID 15368).

This proves the local tool behavior, not a live repository bootstrap. No GitHub settings were changed and the starter has no public remote. Live apply/readback, whole-starter review, owner acknowledgement and publication remain outstanding. No release/signing claim or broad issue closure.

Completed the focused onboarding fix in signed/DCO starter commit bb310f3208c9e4203ad42c007bf1671933a843be (local fix/template-onboarding; not published). Apply and read-only Validate now resolve the official GitHub Actions app and require its ID on every required context. Missing/wrong bindings and another bootstrap producer fail before writes. The reviewed caller plan stays unchanged and reusable. Existing conflicting rules are preserved. Evidence: retained RED reproduces wrong/missing bindings and input mutation (3 failures); full source and both actual packed/generated CLI and GUI-only variants each pass 54/54 Pester cases, zero failures/skips. Both changed PowerShell files pass the configured full analyzer rules; both docs pass Markdown lint; diff checks and signed-commit hooks pass. The generated-test processes ended exit 0. Official app lookup was read-only (github-actions, owner github, ID 15368). This proves the local tool behavior, not a live repository bootstrap. No GitHub settings were changed and the starter has no public remote. Live apply/readback, whole-starter review, owner acknowledgement and publication remain outstanding. No release/signing claim or broad issue closure.

KofTwentyTwo commented

2026-10-11 00:06:08 +00:00

(Migrated from github.com)

New publication/setup evidence under the owner's explicit commit/push/configure authorization:

Created public KofTwentyTwo/windows-app-template, initial main bb310f3 and signed onboarding topic now 758e773. Draft PR #1: https://github.com/KofTwentyTwo/windows-app-template/pull/1.
Marked as a template; applied 13 restrictive repository/security/Actions/environment/ruleset requests. Official GitHub Actions producer IDs bind all 17 required contexts. Read-only Validate returned SettingsVerified=true; release allows only v* tags; NUGET_USER is set to KofTwentyTwo.
Hosted initial-main CI run 38096509791 passed build/core coverage, format, UI, actual template generation and installed stable/dev updates. PR fac10a7 CI 38096578936 also completed SUCCESS. Current 758e773 scripts run 38097053573 passes.
Live selected-actions policy initially rejected the two digest-pinned scanner containers. Fixed the plan/tests/guide in 758e773 and configured only the exact published Gitleaks/Trivy references. Source and generated Windows application each pass 55/55 script cases; changed files pass full analyzer rules, guide lint and signed hooks. Current security run 38097053934 and dispatch 38097129462 succeed, all three security jobs. Earlier startup failures retained; no policy broadening to arbitrary containers.

The required-check readback defect (#27) is implemented and published on starter main; its scoped acceptance is complete. Broader #10/#20 acceptance still includes owner review acknowledgement, remaining hosted bootstrap/negative-PR evidence, inventory and publication conditions. No merge, tag/release, NuGet template publication, signing proof or claim of full standards compliance.

The owner explicitly cleared the old all-AppKit-issues goal and set a new goal: build MarkdownViewr.Windows using AppKit. The new public GUI-only scaffold is at https://github.com/KofTwentyTwo/MarkdownViewr.Windows; its build has zero warnings, 20 core tests pass at 100% coverage and the feature plan is recorded. Its greeting remains scaffold content, not a finished Markdown viewer. Azure retries remain deferred.

New publication/setup evidence under the owner's explicit commit/push/configure authorization: - Created public KofTwentyTwo/windows-app-template, initial main bb310f3 and signed onboarding topic now 758e773. Draft PR #1: https://github.com/KofTwentyTwo/windows-app-template/pull/1. - Marked as a template; applied 13 restrictive repository/security/Actions/environment/ruleset requests. Official GitHub Actions producer IDs bind all 17 required contexts. Read-only Validate returned SettingsVerified=true; release allows only v* tags; NUGET_USER is set to KofTwentyTwo. - Hosted initial-main CI run 38096509791 passed build/core coverage, format, UI, actual template generation and installed stable/dev updates. PR fac10a7 CI 38096578936 also completed SUCCESS. Current 758e773 scripts run 38097053573 passes. - Live selected-actions policy initially rejected the two digest-pinned scanner containers. Fixed the plan/tests/guide in 758e773 and configured only the exact published Gitleaks/Trivy references. Source and generated Windows application each pass 55/55 script cases; changed files pass full analyzer rules, guide lint and signed hooks. Current security run 38097053934 and dispatch 38097129462 succeed, all three security jobs. Earlier startup failures retained; no policy broadening to arbitrary containers. The required-check readback defect (#27) is implemented and published on starter main; its scoped acceptance is complete. Broader #10/#20 acceptance still includes owner review acknowledgement, remaining hosted bootstrap/negative-PR evidence, inventory and publication conditions. No merge, tag/release, NuGet template publication, signing proof or claim of full standards compliance. The owner explicitly cleared the old all-AppKit-issues goal and set a new goal: build MarkdownViewr.Windows using AppKit. The new public GUI-only scaffold is at https://github.com/KofTwentyTwo/MarkdownViewr.Windows; its build has zero warnings, 20 core tests pass at 100% coverage and the feature plan is recorded. Its greeting remains scaffold content, not a finished Markdown viewer. Azure retries remain deferred.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/AppKit#27