Record the self-hosted-runner trade-off as an accepted risk

unit-tests.yml moving to [self-hosted, macOS] on a pull_request trigger lets any PR run arbitrary code on novaloop-mac-studio-001 — the same persistent machine, keychain and signing identities the release pipeline uses. The risk was accepted on the strength of the repo being INTERNAL, but that reasoning lived nowhere: nothing in the repo said why it was tolerable, and nothing in CI would ever say it existed. Worth recording because the trade-off is invisible to the required checks. zizmor reports self-hosted-runner only at --persona=auditor; the default persona CI runs suppresses it, so a green build is not evidence of absence. Verified both halves against the fix-fork-ci workflow: auditor reports it at medium severity, the default reports "No findings to report … (3 suppressed)". Records the exits too, so a future reader inheriting this need not rederive them: restrict the trigger to non-fork branches, or return to GitHub-hosted macos-26 with a raised timeout-minutes.
2026-10-31 08:15:24 +00:00 · 2026-07-16 00:17:18 +02:00
parent d9a57e0c03
commit 2387d27f2c
1 changed files with 1 additions and 0 deletions
@@ -448,6 +448,7 @@ upload; review proves nothing extra about the pipeline.
 | **O6** | Cosmetic Element strings ship in a HealthChat binary, e.g. `BGTaskSchedulerPermittedIdentifiers: io.element.elementx.background.refresh` (`ElementX/SupportingFiles/target.yml:102-104`). Working; cosmetic only. |
 | **O7** | **The legacy element-ios pipeline is probably broken right now — unverified, and worth verifying.** It pins `xcodes(version: "26.4")` and runs on this same runner, which carries only **26.6**. Its last green run was 2026-04-15, so the machine plausibly had 26.4 then and lost it to an upgrade since. If so, the next legacy release does not fail — it **hangs** in `before_all` on an authenticated multi-GB download, and only a timeout ends it. **This fork no longer depends on that pipeline** (D3's "the legacy pipeline is proven" means *was* proven, on a toolchain the machine no longer has), so this is not a blocker here. Confirm the pin against `Novaloop-AG/element-ios` and de-pin it there before its next release. Out of scope for these three PRs — raise it. |
 | **O8** | **Whatever Xcode the runner has is what ships**, and no release run records it. The pin is gone (see Runner), so upgrading `/Applications/Xcode.app` silently changes the compiler for every subsequent release, with no tag, diff or review. Mitigated only by documentation in the skill. Adding `xcodebuild -version` to `release-healthchat.yml` would give provenance cheaply — worth doing. |
+| **O9** | **A pull request can execute arbitrary code on the release machine.** `unit-tests.yml` runs on `[self-hosted, macOS]` under a `pull_request` trigger (`.github/workflows/unit-tests.yml:9,20`), so any PR's build scripts run on `novaloop-mac-studio-001` — the same persistent runner, keychain and signing identities the release pipeline uses. **Accepted because the repo is INTERNAL**, which narrows PR authors to org members. The trade-off is invisible to CI: zizmor reports it (`self-hosted-runner`, medium) **only at `--persona=auditor`**, and the default persona CI runs suppresses it — so no required check will ever warn. If org membership stops being a sufficient trust boundary: restrict the trigger to non-fork branches, or move back to GitHub-hosted `macos-26` with a raised `timeout-minutes`. |

 **Closed:** the app-group collision question — container paths are disjoint, and the shared
 `group.ch.healthchat` UserDefaults suite has a verified-empty key intersection. Captured as a standing hazard