ci: run the Testbox broker guard on every pull request

[lawrencecchen]

Follow-up to #10303.

tests/test_ci_testbox_broker_guard.py is wired into ci.yml, but ci.yml is currently dispatch-only ("CI pause"), so the guard would not have run on a pull request that weakened the very lane it protects. This gives it a small always-on workflow.

It runs on every pull request with no path filter, on purpose: a change that renames or moves the guard is exactly what a path filter would let through. The job also shellchecks the four scripts/blacksmith-*.sh helpers and actionlints the warmup workflow, neither of which any existing job covers.

actionlint is downloaded pinned by version and verified against a sha256 I checked against the real release artifact (023070a2...0757 for actionlint_1.7.7_linux_amd64.tar.gz).

The ci.yml entry from #10303 stays, so the guard still runs with the full suite whenever CI resumes.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Run the Testbox broker guard on every pull request and pushes to main to prevent trust-boundary regressions while CI is dispatch-only. Previously the guard ran only in ci.yml; now a dedicated workflow enforces it and adds linting.

• Adds testbox-broker-guard.yml that triggers on pull_request and push to main with no path filter.
• Uses concurrency to cancel superseded runs per ref.
• Executes tests/test_ci_testbox_broker_guard.py on Python 3.12 with PyYAML==6.0.3.
• Shellchecks the four Testbox helper scripts; updates blacksmith-cmux-tui-testbox-stage.sh to disable both SC2317 and SC2329 for trap-invoked helpers to satisfy ShellCheck 0.9/0.10.
• Runs actionlint on the warmup and guard workflows, downloading actionlint 1.7.7 and verifying it via SHA-256.
• Keeps the ci.yml entry so the guard still runs with the full suite when CI resumes.

^{Written for commit 86f14c0. Summary will update on new commits.}

Summary by CodeRabbit

• Chores
  • Added automated validation for Testbox broker trust-boundary protections.
  • Pull requests and changes to the main branch now receive consistent security checks.
  • Added workflow linting and verification to help detect configuration errors before changes are integrated.
  • Superseded checks are canceled automatically to keep validation results current.
  • Updated shell-script validation compatibility across supported ShellCheck versions without changing runtime behavior.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 63627b02-19c4-4c65-97d8-aac64d837fc3

📥 Commits

Reviewing files that changed from the base of the PR and between 8ebd307 and 86f14c0.

📒 Files selected for processing (1)

• scripts/blacksmith-cmux-tui-testbox-stage.sh

Included review availability: Your plan includes up to 10 reviews per rolling hour; 6 remain after this review.

---

📝 Walkthrough

Walkthrough

Added an always-on GitHub Actions workflow for Testbox broker trust-boundary validation. The workflow runs on pull requests and pushes to main, uses restricted permissions, cancels superseded runs, executes tests and linting, verifies actionlint, and updates ShellCheck suppressions.

Changes

Testbox broker guard CI

Layer / File(s)	Summary
Broker guard workflow enforcement .github/workflows/testbox-broker-guard.yml, scripts/blacksmith-cmux-tui-testbox-stage.sh	The workflow runs broker guard tests, ShellCheck for Testbox helpers, and checksum-verified actionlint for both Testbox workflows. It defines pull request and main push triggers, concurrency cancellation, restricted permissions, pinned setup, and a configurable runner. The helper script suppresses both SC2317 and SC2329 for indirect trap handlers.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 86f14

This PR adds pull-request coverage for the Testbox broker guard and related validation without any actionable merge-blocking risk remaining.

🚥 Pre-merge checks | ✅ 25

✅ Passed checks (25 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Cmux Swift Actor Isolation	✅ Passed	The PR diff contains only one GitHub Actions YAML file and one shell script; it introduces no Swift production changes, so Swift actor-isolation criteria do not apply.
Cmux Swift Blocking Runtime	✅ Passed	The complete PR diff changes only one GitHub workflow and one shell script; it contains no .swift files or production Swift synchronization changes.
Cmux Browser Automation Off-Main	✅ Passed	The PR changes only a GitHub workflow and ShellCheck comments; rule-scoped browser router, policy, and policy tests are unchanged from origin/main.
Cmux Expensive Synchronous Load	✅ Passed	The merge-base diff adds one workflow and edits ShellCheck comments only; it contains no Swift files or expensive synchronous agent-history load changes.
Cmux Cache Substitution Correctness	✅ Passed	The available PR range changes only a GitHub Actions workflow and a ShellCheck comment; it introduces no production Swift, TypeScript, or JavaScript cache substitution.
Cmux No Hacky Sleeps	✅ Passed	The diff adds only ShellCheck comments in the shell script; it introduces no sleep or fixed-delay synchronization. The workflow is explicitly out of scope under the rule.
Cmux Algorithmic Complexity	✅ Passed	The PR adds a workflow and changes only ShellCheck comments in the shell script; it introduces no production algorithm or scalable-collection scan.
Cmux Swift Concurrency	✅ Passed	The PR diff changes only a GitHub Actions workflow and a shell script; it contains no Swift files or additions of the specified Swift concurrency patterns.
Cmux Swift @Concurrent	✅ Passed	The PR changes only a YAML workflow and a shell script; diff review across both commits found no .swift files or Swift isolation changes.
Cmux Swift Package Boundaries	✅ Passed	The PR diff from origin/main changes only one GitHub Actions workflow and one shell script; it contains no Swift or Package.swift production changes, so the boundary rule is not applicable.
Cmux Swiftpm Lockfiles	✅ Passed	The PR changes only one workflow and ShellCheck comments; it changes no Package.swift, Package.resolved, .gitignore, or Xcode project package references.
Cmux Swift Logging	✅ Passed	The PR changes only one GitHub Actions workflow and one Bash script; the merge-base diff contains no Swift, Objective-C, or logging changes.
Cmux User-Facing Error Privacy	✅ Passed	The changed files are a GitHub Actions workflow and ShellCheck suppressions; they add no production user-facing errors, alerts, command output, or recovery copy.
Cmux Full Internationalization	✅ Passed	The PR adds only a CI workflow and ShellCheck comments. These are operational/developer-only changes, with no user-facing Swift, web, metadata, API, or catalog text.
Cmux Swiftui State Layout	✅ Passed	The complete PR diff adds a workflow and updates ShellCheck comments only; it contains no Swift, SwiftUI, or state-layout changes.
Cmux Architecture Rethink	✅ Passed	The PR diff changes only a GitHub Actions workflow and shellcheck comments; it contains no Swift or UI architecture changes covered by this check.
Cmux Swift Auxiliary Window Close Shortcuts	✅ Passed	The complete PR diff adds only a workflow and modifies a shell script; it contains no Swift or window-related changes, so this check is inapplicable.
Cmux Source Artifacts	✅ Passed	The PR adds an intentional workflow config and updates an existing shell script; the diff adds no local output, generated artifact, cache, temp directory, or broad artifact path.
Cmux No Test Or Debug Seam In Production Source	✅ Passed	The whole PR changes only one workflow and one shell script; no Swift file under a production Sources path is changed.
Cmux No Ambient Global State	✅ Passed	The diff from origin/main changes only one GitHub Actions YAML file and one shell script; it contains no production Swift changes, so this check is inapplicable.
Title check	✅ Passed	The title clearly and concisely identifies the main change: running the Testbox broker guard on every pull request.
Description check	✅ Passed	The description explains what changed, why it changed, and key verification details; omitted template sections are non-critical for this workflow-only change.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat-testbox-guard-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}