merge queue: embarking main (8f6b016), #2083, #2077, #2052 and #2073 together#2092
Closed
mergify[bot] wants to merge 29 commits intomainfrom
Closed
merge queue: embarking main (8f6b016), #2083, #2077, #2052 and #2073 together#2092mergify[bot] wants to merge 29 commits intomainfrom
mergify[bot] wants to merge 29 commits intomainfrom
Conversation
Deploy with --coprocessors 2 --coprocessor-threshold 2 so both coprocessors must independently compute identical ciphertext digests for on-chain consensus to be reached. All existing tests pass unchanged — consensus enforcement is transparent. Adds a consensus watchdog (Mocha root hook) that monitors gateway chain events during tests: - Detects ciphertext digest divergence immediately - Detects consensus stalls within 3 minutes - No-op when GATEWAY_RPC_URL is unset (single-coprocessor runs) Closes zama-ai/fhevm-internal#1132
- Add public flush() method instead of casting to any to call private poll() - Add polling guard to prevent overlapping poll cycles from setInterval - Remove non-null assertion on INPUT_VERIFICATION_ADDRESS before null check - Prune resolved entries from maps (delete on consensus + track count via integers) - Remove consensusReached field from interfaces (no longer needed) - Simplify summary() to use map.size and counters instead of 4 array copies
12 tests covering: - Ciphertext digest divergence detection - SNS digest divergence detection - Input verification divergence detection - Consensus stall timeout detection - Map pruning on consensus resolution - Polling guard preventing overlapping polls - Summary output for resolved and pending entries - Graceful no-op when env vars are not set Also exports ConsensusWatchdog class for testability.
- Destroy real ethers provider before replacing with stub in mockWatchdog() - Wrap env var mutation in try/finally to guarantee cleanup on test failure
This reverts commit 3a73efb.
This reverts commit 818e565.
Run the claude-code-action inside a network sandbox to prevent data exfiltration to unauthorized hosts. Two layers of defense: - Squid proxy: L7 domain allowlist (.anthropic.com, .github.com, etc.) - iptables: blocks direct outbound TCP from the runner UID All dependencies (Bun, action node_modules, Claude Code CLI, OIDC token exchange) are pre-installed before lockdown because the action's internal installers use fetch() which ignores HTTP_PROXY. Also switches from --allowedTools to --dangerously-skip-permissions since the network sandbox handles security at the infrastructure level. update claude file with proper container setup fix: shellchecks fix zizmor warning ci(claude): rewrite workflow from template, address PR #1995 security review - Drop action wrapper, run claude CLI directly (avoids MCP stdin blocking) - Remove dead pull_request trigger - Separate GH_TOKEN from system prompt construction step - Tighten iptables: resolve Squid IP dynamically, block UDP/ICMP - Restrict squid allowlist to 3 domains (api.anthropic.com, platform.claude.com, github.com) - Cache Squid Docker image, add iptables save/restore cleanup - Add tracking comment for run visibility - Fix token revocation to use HTTPS_PROXY fix: replace A && B || C with proper if-then-else (SC2015) fix: capture error details instead of silent suppression OIDC exchange and token revocation now log the server response on failure instead of swallowing it with -sf/--silent/2>/dev/null. fix: shellcheck SC2001 and SC2015 in claude workflow Replace sed prompt extraction with parameter expansion (SC2001). chore: harden security practices chore: update claude action from secutiry
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
✨ The merge conditions cannot be satisfied due to failing checks. ✨
Branch main (8f6b016), #2083, #2077, #2052 and #2073 are embarked together for merge.
This pull request has been created by Mergify to speculatively check the mergeability of #2073.
You don't need to do anything. Mergify will close this pull request automatically when it is complete.
Required conditions of queue
mainfor merge:check-success = run-e2e-tests / fhevm-e2e-testcheck-neutral = coprocessor-cargo-test/cargo-tests (bpr)check-skipped = coprocessor-cargo-test/cargo-tests (bpr)check-success = coprocessor-cargo-test/cargo-tests (bpr)#approved-reviews-by >= 1[🛡 GitHub branch protection]#changes-requested-reviews-by = 0[🛡 GitHub branch protection]#review-threads-unresolved = 0[🛡 GitHub branch protection]branch-protection-review-decision = APPROVED[🛡 GitHub branch protection]check-success = common-pull-request/lint (bpr)check-neutral = common-pull-request/lint (bpr)check-skipped = common-pull-request/lint (bpr)check-skipped = coprocessor-cargo-listener-tests/cargo-tests (bpr)check-neutral = coprocessor-cargo-listener-tests/cargo-tests (bpr)check-success = coprocessor-cargo-listener-tests/cargo-tests (bpr)check-success = coprocessor-dependency-analysis/dependencies-check (bpr)check-neutral = coprocessor-dependency-analysis/dependencies-check (bpr)check-skipped = coprocessor-dependency-analysis/dependencies-check (bpr)check-skipped = gateway-contracts-deployment-tests/sc-deploy (bpr)check-neutral = gateway-contracts-deployment-tests/sc-deploy (bpr)check-success = gateway-contracts-deployment-tests/sc-deploy (bpr)check-skipped = kms-connector-tests/test-connector (bpr)check-neutral = kms-connector-tests/test-connector (bpr)check-success = kms-connector-tests/test-connector (bpr)Required conditions to stay in the queue:
#approved-reviews-by >= 1[🛡 GitHub branch protection]#changes-requested-reviews-by = 0[🛡 GitHub branch protection]#review-threads-unresolved = 0[🛡 GitHub branch protection]base = mainbranch-protection-review-decision = APPROVED[🛡 GitHub branch protection]label!=do-not-mergecheck-success = common-pull-request/lint (bpr)check-neutral = common-pull-request/lint (bpr)check-skipped = common-pull-request/lint (bpr)check-skipped = coprocessor-cargo-listener-tests/cargo-tests (bpr)check-neutral = coprocessor-cargo-listener-tests/cargo-tests (bpr)check-success = coprocessor-cargo-listener-tests/cargo-tests (bpr)check-success = coprocessor-cargo-test/cargo-tests (bpr)check-neutral = coprocessor-cargo-test/cargo-tests (bpr)check-skipped = coprocessor-cargo-test/cargo-tests (bpr)check-success = coprocessor-dependency-analysis/dependencies-check (bpr)check-neutral = coprocessor-dependency-analysis/dependencies-check (bpr)check-skipped = coprocessor-dependency-analysis/dependencies-check (bpr)check-skipped = gateway-contracts-deployment-tests/sc-deploy (bpr)check-neutral = gateway-contracts-deployment-tests/sc-deploy (bpr)check-success = gateway-contracts-deployment-tests/sc-deploy (bpr)check-skipped = kms-connector-tests/test-connector (bpr)check-neutral = kms-connector-tests/test-connector (bpr)check-success = kms-connector-tests/test-connector (bpr)