PB-3005: Run source-checked local actions from public reusable workflows

[zhming0]

Why

GitHub resolves ./... actions inside remote reusable workflows against the caller job workspace. SLSA v2.1.0 checks its pinned builder repository out to the literal __BUILDER_CHECKOUT_DIR__ path before invoking local actions there, but eager composite traversal tried to read that future path from the caller checkout and failed.

Resolves PB-3005.

What

• Recognize source-checked local actions by their general workspace alias and repository-relative path, and bind their locks to the remote workflow's repository, exact commit, resolved branch or tag namespace, and tree digest.
• Rewrite the matching public checkout to the pinned commit, require the populated workspace action to match immutable source, and execute the verified source-store copy.
• Add hermetic SLSA-shaped coverage for deferred needs inputs, nested composites, checkout, top-level and nested local actions, unavailable paths, tampering, and branch/tag ambiguity.
• Document caller-workspace resolution and the immutable source boundary.

[buildsworth-bk-app]

The inline comments are non-blocking. This changes the immutable-source execution and checkout credential boundary, so it still needs human approval.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18197, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. Unless repository policy already allows L2 approval, grant it by mentioning @buildsworth-bk (see approval ceiling and L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only when repository policy or a verified grant allows it; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

[zhming0]

Addressed Buildsworth review 4970335564 in f82c129: source checkouts now reject case-insensitive duplicate inputs before lookup, and the security documentation includes the anonymous provenance-bound checkout boundary.

[zhming0]

Fixed in f82c129 for review 4970335564: reject case-insensitive duplicate source-checkout inputs before lookup and document the anonymous provenance-bound checkout boundary.

[buildsworth-bk-app]

One blocking case remains: a checkout authored directly in the remote reusable-workflow job still fails compiler adapter validation. Details inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18201, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[zhming0]

Fixed in 596f8db for review 4970395103: compiler adapter validation now admits provenance-bound direct source checkouts and hermetic coverage exercises direct checkout → local action.

Previous concerns have been addressed.

[buildsworth-bk-app]

The previous blocking checkout-validation concern is resolved. I left one non-blocking documentation note. This still changes the immutable-source execution and checkout credential boundary, so it remains above the L2 approval ceiling.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18202, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[zhming0]

Addressed Buildsworth review 4970490842 in 700c1c1: clarified the provenance-bound checkout exception in the checkout contract, replied inline, and resolved the thread.

[buildsworth-bk-app]

One blocking provenance case remains: bare remote-workflow refs currently make branch and tag checkouts indistinguishable. Details inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18203, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The previous namespace-provenance concern is still open because shared repository memoization can drop the resolved namespace. The existing thread has the order-dependent failure.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18205, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The memoized namespace propagation is fixed, but the existing provenance thread remains open because a bound alias can still fall through to event-checkout semantics.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18207, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The bound-alias provenance concern remains open on case-insensitive macOS workspaces; details are in the existing thread.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18208, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

[buildsworth-bk-app]

The previous case-only alias issue is fixed. Two blocking alias-classification cases remain; details inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18209, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The empty-alias case is fixed. The normalization concern remains open at runtime for a non-ASCII checkout spelling that aliases an ASCII source path; details are in the existing thread. This still changes immutable-source execution and checkout credential boundaries, so it needs human approval.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18211, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The runtime alias-normalization concern remains open in the existing thread; I found no new issues in this pass.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18211, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The latest change catches the Kelvin-sign case, but the existing alias-normalization concern remains open for canonical equivalents that aren't case folds; details are in the thread. I found no new issues in this pass.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18216, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The NFD change covers canonical equivalence, but the existing alias-classification concern remains open for APFS's multi-rune case folds; details are in the thread. I found no new issues in this pass.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18218, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

[buildsworth-bk-app]

The previous alias-normalization concern is fixed. I left one non-blocking input-name ambiguity. The immutable-source execution and checkout credential boundary remains above the L2 approval ceiling.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18219, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

[buildsworth-bk-app]

The previous input-name ambiguity is fixed. One new blocking resource-bound issue remains; details inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18224, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

[buildsworth-bk-app]

The previous input-validation resource bound is fixed, and I found no new issues in this pass. This still changes immutable-source execution and checkout credential boundaries, so it needs human approval.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 18228, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.