marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-18 20:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plane): prepare workspaces only after the start request

Browse Source 
On the live cluster the case clone ran at boot: the golden boot had no egress
policy, and the real actor was still being restored, so both TLS handshakes to
GitHub were cut. After the start the actor is RUNNING under its policy (the
delivery the same minute went through). Adds the one-case check Run (a subset
of validation-46) and re-pins the task manifests to the current runner digest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-29 21:23:25 +02:00
co-authored by Claude Opus 5.5
parent 344df61fc1
commit 3d0d83c585
8 changed files with 147 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plane/runs/check-lmdeploy.yaml
+44
View File
@@ -0,0 +1,44 @@
# one-case check before the validation-46 measurement (task 8); a subset of runs/validation-46.yaml
apiVersion: openultrasast.io/v1alpha1
kind: Run
metadata:
name: check-lmdeploy
spec:
tasks:
- name: lmdeploy-media-url-ssrf-facts
task: repo-facts-lmdeploy-media-url-ssrf
outputs:
- facts.json
budget: &id001
usd: 0
calls: 0
serialize: repo-facts
- name: lmdeploy-media-url-ssrf-va
task: verify-a-lmdeploy-media-url-ssrf
inputs:
facts: lmdeploy-media-url-ssrf-facts/facts.json
outputs:
- units.jsonl
- summary.json
budget:
usd: 0.02
calls: 8
- name: lmdeploy-media-url-ssrf-vb
task: verify-b-lmdeploy-media-url-ssrf
inputs:
facts: lmdeploy-media-url-ssrf-facts/facts.json
outputs:
- units.jsonl
- summary.json
budget:
usd: 0.02
calls: 8
- name: lmdeploy-media-url-ssrf-agree
task: agree-lmdeploy-media-url-ssrf
inputs:
pass_a: lmdeploy-media-url-ssrf-va/units.jsonl
pass_b: lmdeploy-media-url-ssrf-vb/units.jsonl
outputs:
- agreed.json
- disputed.json
budget: *id001
plane/tasks/agree.yaml
+1 -1
View File
@@ -7,7 +7,7 @@ metadata:
name: agree name: agree
atespace: default atespace: default
spec: spec:
image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4" image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
command: ["agree"] command: ["agree"]
resources: resources:
requests: requests:
plane/tasks/repo-facts.yaml
+1 -1
View File
@@ -8,7 +8,7 @@ metadata:
name: repo-facts name: repo-facts
atespace: default atespace: default
spec: spec:
image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4" image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
command: ["repo-facts"] command: ["repo-facts"]
resources: resources:
requests: requests:
plane/tasks/validation-46.yaml
+60 -60
View File
@@ -5,7 +5,7 @@ metadata:
name: repo-facts-budibase-mongo-template-nosqli name: repo-facts-budibase-mongo-template-nosqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -34,7 +34,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -65,7 +65,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -94,7 +94,7 @@ metadata:
name: agree-budibase-mongo-template-nosqli name: agree-budibase-mongo-template-nosqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -121,7 +121,7 @@ metadata:
name: repo-facts-cct-studio-server-cmdi name: repo-facts-cct-studio-server-cmdi
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -150,7 +150,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -181,7 +181,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -210,7 +210,7 @@ metadata:
name: agree-cct-studio-server-cmdi name: agree-cct-studio-server-cmdi
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -237,7 +237,7 @@ metadata:
name: repo-facts-contextforge-prompt-ssti name: repo-facts-contextforge-prompt-ssti
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -266,7 +266,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -297,7 +297,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -326,7 +326,7 @@ metadata:
name: agree-contextforge-prompt-ssti name: agree-contextforge-prompt-ssti
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -353,7 +353,7 @@ metadata:
name: repo-facts-froxlor-admin-ip-second-order-sqli name: repo-facts-froxlor-admin-ip-second-order-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -382,7 +382,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -413,7 +413,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -442,7 +442,7 @@ metadata:
name: agree-froxlor-admin-ip-second-order-sqli name: agree-froxlor-admin-ip-second-order-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -469,7 +469,7 @@ metadata:
name: repo-facts-fuxa-tdengine-escape-sqli name: repo-facts-fuxa-tdengine-escape-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -498,7 +498,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -529,7 +529,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -558,7 +558,7 @@ metadata:
name: agree-fuxa-tdengine-escape-sqli name: agree-fuxa-tdengine-escape-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -585,7 +585,7 @@ metadata:
name: repo-facts-lmdeploy-media-url-ssrf name: repo-facts-lmdeploy-media-url-ssrf
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -614,7 +614,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -645,7 +645,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -674,7 +674,7 @@ metadata:
name: agree-lmdeploy-media-url-ssrf name: agree-lmdeploy-media-url-ssrf
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -701,7 +701,7 @@ metadata:
name: repo-facts-medplum-external-auth-open-redirect name: repo-facts-medplum-external-auth-open-redirect
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -730,7 +730,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -761,7 +761,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -790,7 +790,7 @@ metadata:
name: agree-medplum-external-auth-open-redirect name: agree-medplum-external-auth-open-redirect
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -817,7 +817,7 @@ metadata:
name: repo-facts-pgadmin-maintenance-sqli name: repo-facts-pgadmin-maintenance-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -846,7 +846,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -877,7 +877,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -906,7 +906,7 @@ metadata:
name: agree-pgadmin-maintenance-sqli name: agree-pgadmin-maintenance-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -933,7 +933,7 @@ metadata:
name: repo-facts-qwed-sympy-eval name: repo-facts-qwed-sympy-eval
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -962,7 +962,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -993,7 +993,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1022,7 +1022,7 @@ metadata:
name: agree-qwed-sympy-eval name: agree-qwed-sympy-eval
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -1049,7 +1049,7 @@ metadata:
name: repo-facts-reactpress-findall-column-sqli name: repo-facts-reactpress-findall-column-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -1078,7 +1078,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1109,7 +1109,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1138,7 +1138,7 @@ metadata:
name: agree-reactpress-findall-column-sqli name: agree-reactpress-findall-column-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -1165,7 +1165,7 @@ metadata:
name: repo-facts-unleash-addon-webhook-ssrf name: repo-facts-unleash-addon-webhook-ssrf
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -1194,7 +1194,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1225,7 +1225,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1254,7 +1254,7 @@ metadata:
name: agree-unleash-addon-webhook-ssrf name: agree-unleash-addon-webhook-ssrf
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -1281,7 +1281,7 @@ metadata:
name: repo-facts-winml-cli-serve-cors name: repo-facts-winml-cli-serve-cors
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -1310,7 +1310,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1341,7 +1341,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1370,7 +1370,7 @@ metadata:
name: agree-winml-cli-serve-cors name: agree-winml-cli-serve-cors
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -1397,7 +1397,7 @@ metadata:
name: repo-facts-wp-directorist-avatar-ssrf name: repo-facts-wp-directorist-avatar-ssrf
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -1426,7 +1426,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1457,7 +1457,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1486,7 +1486,7 @@ metadata:
name: agree-wp-directorist-avatar-ssrf name: agree-wp-directorist-avatar-ssrf
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -1513,7 +1513,7 @@ metadata:
name: repo-facts-wp-gopay-log-filter-sqli name: repo-facts-wp-gopay-log-filter-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -1542,7 +1542,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1573,7 +1573,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1602,7 +1602,7 @@ metadata:
name: agree-wp-gopay-log-filter-sqli name: agree-wp-gopay-log-filter-sqli
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
@@ -1629,7 +1629,7 @@ metadata:
name: repo-facts-wp-groundhogg-confirm-redirect name: repo-facts-wp-groundhogg-confirm-redirect
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- repo-facts - repo-facts
env: env:
@@ -1658,7 +1658,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1689,7 +1689,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- verify - verify
env: env:
@@ -1718,7 +1718,7 @@ metadata:
name: agree-wp-groundhogg-confirm-redirect name: agree-wp-groundhogg-confirm-redirect
atespace: default atespace: default
spec: spec:
image: localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4 image: localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76
command: command:
- agree - agree
env: env:
plane/tasks/verify.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ metadata:
annotations: annotations:
openultrasast.io/model: deepseek-flash openultrasast.io/model: deepseek-flash
spec: spec:
image: "localhost:5001/ousast-runner@sha256:055ef8581911fbe9c3a3eb97b78b8a7206723460238aed52ce25b3d04756b3f4" image: "localhost:5001/ousast-runner@sha256:c58503666eee0bf296d44a7326862b8e7207edf397f4fdf1d02c3c2f27373e76"
command: ["verify"] command: ["verify"]
resources: resources:
requests: requests:
src/openultrasast/plane/runner.py
+23 -9
View File
@@ -751,17 +751,15 @@ def _finish(session: _Session, env: Mapping[str, str], exit_code: int | None, su
def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threading.Event, gate: StartGate) -> int: def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threading.Event, gate: StartGate) -> int:
"""Materialise, wait for the start request, run the command once, deliver; on a resumed volume, only what the """Wait for the start request, then materialise, run the command once and deliver; on a resumed volume, only
marker says is left. A boot whose marker records a delivered run refuses every start request.""" what the marker says is left. A boot whose marker records a delivered run refuses every start request.
Workspaces are prepared only after the start: Substrate's golden boot never gets one, so it touches no network,
and a started actor is RUNNING with its egress policy in force (a clone at boot failed on the live cluster
while the actor was still being restored, 2026-09-29)."""
session: _Session | None = None session: _Session | None = None
try: try:
session = _prepare(env) session = _prepare(env)
if session.prepared.exists():
log.info("workspaces were prepared on an earlier boot; keeping them")
else:
cache_dir = env.get("OUSAST_CASE_CACHE")
materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", "")))
session.prepared.touch()
done = _read_marker(session.marker) done = _read_marker(session.marker)
if done is not None and done.get("delivered"): if done is not None and done.get("delivered"):
gate.refuse(f"task {session.task.metadata.name} already ran and was delivered ({done.get('status')})") gate.refuse(f"task {session.task.metadata.name} already ran and was delivered ({done.get('status')})")
@@ -773,7 +771,7 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
if env.get("AX_RUNNER_AUTOSTART") == "1": if env.get("AX_RUNNER_AUTOSTART") == "1":
start: Start | None = gate.autostart() start: Start | None = gate.autostart()
else: else:
log.info("workspaces ready; waiting for the start request on %s", START_PATH) log.info("waiting for the start request on %s", START_PATH)
start = gate.wait(stop) start = gate.wait(stop)
if start is None: if start is None:
return 0 return 0
@@ -785,6 +783,13 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
return _exit_of(_finish(session, env, done.get("exit"), kept)) return _exit_of(_finish(session, env, done.get("exit"), kept))
if stop.is_set(): if stop.is_set():
return 0 return 0
try:
_materialise_once(session, env)
except RunnerError as exc:
log.error("runner failed: %s", exc)
failed = _failed(f"runner failed: {exc}", read_summary(session.output_dir))
write_summary(session.output_dir, failed)
return _exit_of(_finish(session, env, None, failed))
log.info("workspaces ready; running task %s: %s", session.task.metadata.name, list(session.task.command)) log.info("workspaces ready; running task %s: %s", session.task.metadata.name, list(session.task.command))
grace = float(env.get("OUSAST_TERM_GRACE") or TERM_GRACE) grace = float(env.get("OUSAST_TERM_GRACE") or TERM_GRACE)
code, summary = run_command(session.task, session.output_dir, env, stop, grace, start.credentials) code, summary = run_command(session.task, session.output_dir, env, stop, grace, start.credentials)
@@ -809,6 +814,15 @@ def _run_once(env: MutableMapping[str, str], ready: threading.Event, stop: threa
return _exit_of(_finish(session, env, None, summary)) return _exit_of(_finish(session, env, None, summary))
def _materialise_once(session: _Session, env: Mapping[str, str]) -> None:
if session.prepared.exists():
log.info("workspaces were prepared on an earlier boot; keeping them")
return
cache_dir = env.get("OUSAST_CASE_CACHE")
materialise(session.task, session.workspaces, Path(cache_dir) if cache_dir else None, load_pins(env.get("OUSAST_GIT_PINS", "")))
session.prepared.touch()
def _read_marker(path: Path) -> dict[str, Any] | None: def _read_marker(path: Path) -> dict[str, Any] | None:
try: try:
loaded = json.loads(path.read_text(encoding="utf-8")) loaded = json.loads(path.read_text(encoding="utf-8"))
tests/test_plane_increment.py
+4 -1
View File
@@ -38,7 +38,10 @@ def test_every_manifest_under_plane_loads() -> None:
manifests = load_manifests(paths) manifests = load_manifests(paths)
assert set(manifests.models) == {"deepseek-flash"} assert set(manifests.models) == {"deepseek-flash"}
assert set(TEMPLATES) <= set(manifests.tasks) assert set(TEMPLATES) <= set(manifests.tasks)
assert len(manifests.workspaces) == 30 and set(manifests.runs) == {"validation-46"} assert len(manifests.workspaces) == 30 and "validation-46" in manifests.runs
full = {t.name for t in manifests.runs["validation-46"].tasks}
for name, other in manifests.runs.items(): # check Runs (e.g. check-lmdeploy) are subsets of the measurement
assert {t.name for t in other.tasks} <= full, name
def test_model_prices_are_the_endpoint_prices() -> None: def test_model_prices_are_the_endpoint_prices() -> None:
tests/test_plane_runner.py
+13
View File
@@ -758,3 +758,16 @@ def test_the_golden_boot_never_runs_the_command(env: dict[str, str], receiver: R
proc.wait() proc.wait()
assert len(counter.read_text().splitlines()) == 1 assert len(counter.read_text().splitlines()) == 1
assert files_containing(tmp_path, SECRET) == [], "no log, workspace, output or state file holds the credential" assert files_containing(tmp_path, SECRET) == [], "no log, workspace, output or state file holds the credential"
def test_workspaces_are_prepared_only_after_the_start_request(env: dict[str, str], receiver: Receiver, tmp_path: Path) -> None:
"""Substrate's golden boot never gets a start, so it must touch no workspace (and no network): a clone at boot
failed on the live cluster while the actor was still being restored (2026-09-29)."""
thread, environ, codes = main_in_thread(tmp_path, OUSAST_ARTIFACT_URL=receiver.url)
time.sleep(0.5)
written = [p for p in (tmp_path / "ws").rglob("*") if p.is_file()] if (tmp_path / "ws").exists() else []
assert written == [], "nothing is materialised before the start request"
assert post_start(environ["AX_RUNNER_BOUND_PORT"], {"run": "run-1", "task": "stub"})[0] == 202
thread.join(timeout=30)
assert codes == [0]
assert [p for p in (tmp_path / "ws").rglob("*") if p.is_file()], "the start materialises the workspace"