From 3d0d83c5857f6098829510bcbba679968d155df0 Mon Sep 17 00:00:00 2001 From: Marius Ciepluch <11855163+norandom@users.noreply.github.com> Date: Tue, 29 Sep 2026 21:23:25 +0200 Subject: [PATCH] fix(plane): prepare workspaces only after the start request On the live cluster the case clone ran at boot: the golden boot had no egress policy, and the real actor was still being restored, so both TLS handshakes to GitHub were cut. After the start the actor is RUNNING under its policy (the delivery the same minute went through). Adds the one-case check Run (a subset of validation-46) and re-pins the task manifests to the current runner digest. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo --- plane/runs/check-lmdeploy.yaml | 44 +++++++++++ plane/tasks/agree.yaml | 2 +- plane/tasks/repo-facts.yaml | 2 +- plane/tasks/validation-46.yaml | 120 +++++++++++++++--------------- plane/tasks/verify.yaml | 2 +- src/openultrasast/plane/runner.py | 32 +++++--- tests/test_plane_increment.py | 5 +- tests/test_plane_runner.py | 13 ++++ 8 files changed, 147 insertions(+), 73 deletions(-) create mode 100644 plane/runs/check-lmdeploy.yaml diff --git a/plane/runs/check-lmdeploy.yaml b/plane/runs/check-lmdeploy.yaml new file mode 100644 index 0000000..ce60f66 --- /dev/null +++ b/plane/runs/check-lmdeploy.yaml @@ -0,0 +1,44 @@ +# one-case check before the validation-46 measurement (task 8); a subset of runs/validation-46.yaml +apiVersion: openultrasast.io/v1alpha1 +kind: Run +metadata: + name: check-lmdeploy +spec: + tasks: + - name: lmdeploy-media-url-ssrf-facts + task: repo-facts-lmdeploy-media-url-ssrf + outputs: + - facts.json + budget: &id001 + usd: 0 + calls: 0 + serialize: repo-facts + - name: lmdeploy-media-url-ssrf-va + task: verify-a-lmdeploy-media-url-ssrf + inputs: + facts: lmdeploy-media-url-ssrf-facts/facts.json + outputs: + - units.jsonl + - summary.json + budget: + usd: 0.02 + calls: 8 + - name: lmdeploy-media-url-ssrf-vb + task: verify-b-lmdeploy-media-url-ssrf + inputs: + facts: lmdeploy-media-url-ssrf-facts/facts.json + outputs: + - units.jsonl + - summary.json + budget: + usd: 0.02 + calls: 8 + - name: lmdeploy-media-url-ssrf-agree + task: agree-lmdeploy-media-url-ssrf + inputs: + pass_a: lmdeploy-media-url-ssrf-va/units.jsonl + pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl + outputs: + - agreed.json + - disputed.json + budget: *id001 diff --git a/plane/tasks/agree.yaml b/plane/tasks/agree.yaml index 010b303..bd286d9 100644 --- a/plane/tasks/agree.yaml +++ b/plane/tasks/agree.yaml @@ -7,7 +7,7 @@ metadata: name: agree atespace: default spec: - image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4" + image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76" command: ["agree"] resources: requests: diff --git a/plane/tasks/repo-facts.yaml b/plane/tasks/repo-facts.yaml index d629b10..07c91cb 100644 --- a/plane/tasks/repo-facts.yaml +++ b/plane/tasks/repo-facts.yaml @@ -8,7 +8,7 @@ metadata: name: repo-facts atespace: default spec: - image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4" + image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76" command: ["repo-facts"] resources: requests: diff --git a/plane/tasks/validation-46.yaml b/plane/tasks/validation-46.yaml index 5de0bb7..e0cf8ab 100644 --- a/plane/tasks/validation-46.yaml +++ b/plane/tasks/validation-46.yaml @@ -5,7 +5,7 @@ metadata: name: repo-facts-budibase-mongo-template-nosqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -34,7 +34,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -65,7 +65,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -94,7 +94,7 @@ metadata: name: agree-budibase-mongo-template-nosqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -121,7 +121,7 @@ metadata: name: repo-facts-cct-studio-server-cmdi atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -150,7 +150,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -181,7 +181,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -210,7 +210,7 @@ metadata: name: agree-cct-studio-server-cmdi atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -237,7 +237,7 @@ metadata: name: repo-facts-contextforge-prompt-ssti atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -266,7 +266,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -297,7 +297,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -326,7 +326,7 @@ metadata: name: agree-contextforge-prompt-ssti atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -353,7 +353,7 @@ metadata: name: repo-facts-froxlor-admin-ip-second-order-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -382,7 +382,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -413,7 +413,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -442,7 +442,7 @@ metadata: name: agree-froxlor-admin-ip-second-order-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -469,7 +469,7 @@ metadata: name: repo-facts-fuxa-tdengine-escape-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -498,7 +498,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -529,7 +529,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -558,7 +558,7 @@ metadata: name: agree-fuxa-tdengine-escape-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -585,7 +585,7 @@ metadata: name: repo-facts-lmdeploy-media-url-ssrf atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -614,7 +614,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -645,7 +645,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -674,7 +674,7 @@ metadata: name: agree-lmdeploy-media-url-ssrf atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -701,7 +701,7 @@ metadata: name: repo-facts-medplum-external-auth-open-redirect atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -730,7 +730,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -761,7 +761,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -790,7 +790,7 @@ metadata: name: agree-medplum-external-auth-open-redirect atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -817,7 +817,7 @@ metadata: name: repo-facts-pgadmin-maintenance-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -846,7 +846,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -877,7 +877,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -906,7 +906,7 @@ metadata: name: agree-pgadmin-maintenance-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -933,7 +933,7 @@ metadata: name: repo-facts-qwed-sympy-eval atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -962,7 +962,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -993,7 +993,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1022,7 +1022,7 @@ metadata: name: agree-qwed-sympy-eval atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -1049,7 +1049,7 @@ metadata: name: repo-facts-reactpress-findall-column-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -1078,7 +1078,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1109,7 +1109,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1138,7 +1138,7 @@ metadata: name: agree-reactpress-findall-column-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -1165,7 +1165,7 @@ metadata: name: repo-facts-unleash-addon-webhook-ssrf atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -1194,7 +1194,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1225,7 +1225,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1254,7 +1254,7 @@ metadata: name: agree-unleash-addon-webhook-ssrf atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -1281,7 +1281,7 @@ metadata: name: repo-facts-winml-cli-serve-cors atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -1310,7 +1310,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1341,7 +1341,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1370,7 +1370,7 @@ metadata: name: agree-winml-cli-serve-cors atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -1397,7 +1397,7 @@ metadata: name: repo-facts-wp-directorist-avatar-ssrf atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -1426,7 +1426,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1457,7 +1457,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1486,7 +1486,7 @@ metadata: name: agree-wp-directorist-avatar-ssrf atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -1513,7 +1513,7 @@ metadata: name: repo-facts-wp-gopay-log-filter-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -1542,7 +1542,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1573,7 +1573,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1602,7 +1602,7 @@ metadata: name: agree-wp-gopay-log-filter-sqli atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: @@ -1629,7 +1629,7 @@ metadata: name: repo-facts-wp-groundhogg-confirm-redirect atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - repo-facts env: @@ -1658,7 +1658,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1689,7 +1689,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - verify env: @@ -1718,7 +1718,7 @@ metadata: name: agree-wp-groundhogg-confirm-redirect atespace: default spec: - image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 + image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76 command: - agree env: diff --git a/plane/tasks/verify.yaml b/plane/tasks/verify.yaml index 7752921..9ee583b 100644 --- a/plane/tasks/verify.yaml +++ b/plane/tasks/verify.yaml @@ -10,7 +10,7 @@ metadata: annotations: openultrasast.io/model: deepseek-flash spec: - image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4" + image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76" command: ["verify"] resources: requests: diff --git a/src/openultrasast/plane/runner.py b/src/openultrasast/plane/runner.py index 1ef5c25..85c7ae3 100644 --- a/src/openultrasast/plane/runner.py +++ b/src/openultrasast/plane/runner.py @@ -751,17 +751,15 @@ def _finish(session: _Session, env: Mapping[str, str], exit_code: int | None, su def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threading.Event, gate: StartGate) -> int: - """Materialise, wait for the start request, run the command once, deliver; on a resumed volume, only what the - marker says is left. A boot whose marker records a delivered run refuses every start request.""" + """Wait for the start request, then materialise, run the command once and deliver; on a resumed volume, only + what the marker says is left. A boot whose marker records a delivered run refuses every start request. + + Workspaces are prepared only after the start: Substrate's golden boot never gets one, so it touches no network, + and a started actor is RUNNING with its egress policy in force (a clone at boot failed on the live cluster + while the actor was still being restored, 2026-09-29).""" session: _Session | None = None try: session = _prepare(env) - if session.prepared.exists(): - log.info("workspaces were prepared on an earlier boot; keeping them") - else: - cache_dir = env.get("OUSAST_CASE_CACHE") - materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", ""))) - session.prepared.touch() done = _read_marker(session.marker) if done is not None and done.get("delivered"): gate.refuse(f"task {session.task.metadata.name} already ran and was delivered ({done.get('status')})") @@ -773,7 +771,7 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa if env.get("AX_RUNNER_AUTOSTART") == "1": start: Start | None = gate.autostart() else: - log.info("workspaces ready; waiting for the start request on %s", START_PATH) + log.info("waiting for the start request on %s", START_PATH) start = gate.wait(stop) if start is None: return 0 @@ -785,6 +783,13 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa return _exit_of(_finish(session, env, done.get("exit"), kept)) if stop.is_set(): return 0 + try: + _materialise_once(session, env) + except RunnerError as exc: + log.error("runner failed: %s", exc) + failed = _failed(f"runner failed: {exc}", read_summary(session.output_dir)) + write_summary(session.output_dir, failed) + return _exit_of(_finish(session, env, None, failed)) log.info("workspaces ready; running task %s: %s", session.task.metadata.name, list(session.task.command)) grace = float(env.get("OUSAST_TERM_GRACE") or TERM_GRACE) code, summary = run_command(session.task, session.output_dir, env, stop, grace, start.credentials) @@ -809,6 +814,15 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa return _exit_of(_finish(session, env, None, summary)) +def _materialise_once(session: _Session, env: Mapping[str, str]) -> None: + if session.prepared.exists(): + log.info("workspaces were prepared on an earlier boot; keeping them") + return + cache_dir = env.get("OUSAST_CASE_CACHE") + materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", ""))) + session.prepared.touch() + + def _read_marker(path: Path) -> dict[str, Any] | None: try: loaded = json.loads(path.read_text(encoding="utf-8")) diff --git a/tests/test_plane_increment.py b/tests/test_plane_increment.py index d59c46a..c37f6ad 100644 --- a/tests/test_plane_increment.py +++ b/tests/test_plane_increment.py @@ -38,7 +38,10 @@ def test_every_manifest_under_plane_loads() -> None: manifests = load_manifests(paths) assert set(manifests.models) == {"deepseek-flash"} assert set(TEMPLATES) <= set(manifests.tasks) - assert len(manifests.workspaces) == 30 and set(manifests.runs) == {"validation-46"} + assert len(manifests.workspaces) == 30 and "validation-46" in manifests.runs + full = {t.name for t in manifests.runs["validation-46"].tasks} + for name, other in manifests.runs.items(): # check Runs (e.g. check-lmdeploy) are subsets of the measurement + assert {t.name for t in other.tasks} <= full, name def test_model_prices_are_the_endpoint_prices() -> None: diff --git a/tests/test_plane_runner.py b/tests/test_plane_runner.py index 06953c6..645f5fd 100644 --- a/tests/test_plane_runner.py +++ b/tests/test_plane_runner.py @@ -758,3 +758,16 @@ def test_the_golden_boot_never_runs_the_command(env: dict[str, str], receiver: R proc.wait() assert len(counter.read_text().splitlines()) == 1 assert files_containing(tmp_path, SECRET) == [], "no log, workspace, output or state file holds the credential" + + +def test_workspaces_are_prepared_only_after_the_start_request(env: dict[str, str], receiver: Receiver, tmp_path: Path) -> None: + """Substrate's golden boot never gets a start, so it must touch no workspace (and no network): a clone at boot + failed on the live cluster while the actor was still being restored (2026-09-29).""" + thread, environ, codes = main_in_thread(tmp_path, OUSAST_ARTIFACT_URL=receiver.url) + time.sleep(0.5) + written = [p for p in (tmp_path / "ws").rglob("*") if p.is_file()] if (tmp_path / "ws").exists() else [] + assert written == [], "nothing is materialised before the start request" + assert post_start(environ["AX_RUNNER_BOUND_PORT"], {"run": "run-1", "task": "stub"})[0] == 202 + thread.join(timeout=30) + assert codes == [0] + assert [p for p in (tmp_path / "ws").rglob("*") if p.is_file()], "the start materialises the workspace"