fix(ci): never answer a repository of the server from github.com

When the owner is ERMITE_OWNER and the repository exists on ermite, github.com
no longer answers for that name: a pusher who cannot read it gets "repository
not found" at the first resolution and when the answer comes from a stored
resolution of the attempt, whatever source that stored. Only a repository that
does not exist here is github.com's. One function decides the source.

commit: 89ff433aeaa3bb73d2a719b2e44cfdc18dfed4f0
author: brice · 9d ago · 2026-10-13 11:34 UTC
parent: d024c7f
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

1 file · +65 -38

M internal/usecase/ci_actions.go +65 -38


@@ -172,6 +172,24 @@ func (c CI) answer(ctx context.Context, rs runState, j *domain.CIJob, p action
172	172		ra := ports.ResolvedAction{
173	173		Ref: p.uses, NameWithOwner: res.NameWithOwner, Path: p.path, ResolvedSHA: res.ResolvedSHA, Source: res.Source,
174	174		}
	175	+	notFound := ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}
	176	+
	177	+	// A repository of this server that the pusher cannot read is never served
	178	+	// from anywhere else: not from github.com under the same name, whatever
	179	+	// source an earlier resolution of the attempt stored. It answers as a
	180	+	// repository that does not exist. (When it does not exist on this server, a
	181	+	// stored ermite resolution has nothing to serve either.)
	182	+	repo, onErmite, err := c.ermiteRepoOf(ctx, p)
	183	+	if err != nil {
	184	+	return ports.ResolvedAction{}, err
	185	+	}
	186	+	if onErmite {
	187	+	if ok, err := c.pusherCanRead(ctx, by, rs.run.Repo, repo); err != nil {
	188	+	return ports.ResolvedAction{}, err
	189	+	} else if !ok {
	190	+	return notFound, nil
	191	+	}
	192	+	}
175	193		switch res.Source {
176	194		case domain.CIActionGitHub:
177	195		// The case the workflow wrote: the stored resolution is shared by

@@ -179,23 +197,11 @@ func (c CI) answer(ctx context.Context, rs runState, j *domain.CIJob, p action
179	197		ra.NameWithOwner = p.owner + "/" + p.repo
180	198		ra.TarballURL = "https://codeload.github.com/" + ra.NameWithOwner + "/tar.gz/" + res.ResolvedSHA
181	199		case domain.CIActionErmite:
182		-	name, err := domain.ParseRepoName(strings.ToLower(p.repo))
183		-	if err != nil {
184		-	return ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}, nil
185		-	}
186		-	repo, err := c.cfg.Meta.Get(ctx, name)
187		-	if errors.Is(err, domain.ErrNotFound) {
188		-	return ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}, nil
189		-	} else if err != nil {
190		-	return ports.ResolvedAction{}, err
191		-	}
192		-	if ok, err := c.pusherCanRead(ctx, by, rs.run.Repo, repo); err != nil {
193		-	return ports.ResolvedAction{}, err
194		-	} else if !ok {
195		-	return ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}, nil
	200	+	if !onErmite {
	201	+	return notFound, nil
196	202		}
197	203		ra.TarballURL = c.cfg.PublicURL + apiPath + "/repos/" + res.NameWithOwner + "/tarball/" + res.ResolvedSHA
198		-	ra.Token = c.archiveToken(rs, j, name, res.ResolvedSHA)
	204	+	ra.Token = c.archiveToken(rs, j, repo.Name, res.ResolvedSHA)
199	205		}
200	206		return ra, nil
201	207		}

@@ -221,6 +227,29 @@ func (c CI) archiveToken(rs runState, j *domain.CIJob, repo domain.RepoName, s
221	227		return tok
222	228		}
223	229
	230	+	// ermiteRepoOf finds the repository of this server that a reference names: the
	231	+	// owner is ERMITE_OWNER (without regard to case) and the repository exists. ok
	232	+	// is false for any other reference, which github.com serves. It is the one
	233	+	// place that decides the source of an action, for a first resolution and for the
	234	+	// answer from a stored one.
	235	+	func (c *CI) ermiteRepoOf(ctx context.Context, a actionRef) (repo domain.Repo, ok bool, err error) {
	236	+	if !domain.OwnerMatches(c.cfg.Owner, a.owner) {
	237	+	return domain.Repo{}, false, nil
	238	+	}
	239	+	name, perr := domain.ParseRepoName(strings.ToLower(a.repo))
	240	+	if perr != nil {
	241	+	return domain.Repo{}, false, nil // not a name ermite can hold
	242	+	}
	243	+	repo, err = c.cfg.Meta.Get(ctx, name)
	244	+	switch {
	245	+	case errors.Is(err, domain.ErrNotFound):
	246	+	return domain.Repo{}, false, nil
	247	+	case err != nil:
	248	+	return domain.Repo{}, false, err
	249	+	}
	250	+	return repo, true, nil
	251	+	}
	252	+
224	253		// pusherAccess is who the actions of a run are resolved on behalf of: the
225	254		// pusher recorded with the run.
226	255		type pusherAccess struct{ pusher domain.CIPusher }

@@ -343,30 +372,28 @@ func errUnresolvedRepo(a actionRef) string {
343	372		// does not resolve; err is a failure of the call.
344	373		func (c CI) resolveAction(ctx context.Context, j domain.CIJob, a actionRef, remote remoteRefs, by pusherAccess) (res domain.CIActionResolution, msg string, err error) {
345	374		res = domain.CIActionResolution{RunID: j.RunID, RunAttempt: j.RunAttempt, Key: a.key()}
346		-	if domain.OwnerMatches(c.cfg.Owner, a.owner) {
347		-	if name, perr := domain.ParseRepoName(strings.ToLower(a.repo)); perr == nil {
348		-	if repo, gerr := c.cfg.Meta.Get(ctx, name); gerr == nil {
349		-	// A repository the pusher may not read answers as one that does
350		-	// not exist, before any ref is looked at, so that the texts leak
351		-	// nothing about it.
352		-	if ok, err := c.pusherCanRead(ctx, by, j.Repo, repo); err != nil {
353		-	return res, "", err
354		-	} else if !ok {
355		-	return res, errUnresolvedRepo(a), nil
356		-	}
357		-	sha, found, err := c.resolveOnErmite(ctx, name, a.ref)
358		-	if err != nil {
359		-	return res, "", err
360		-	}
361		-	if !found {
362		-	return res, errUnresolvedRef(a), nil
363		-	}
364		-	res.NameWithOwner, res.ResolvedSHA, res.Source = c.cfg.Owner+"/"+name.String(), sha, domain.CIActionErmite
365		-	return res, "", nil
366		-	} else if !errors.Is(gerr, domain.ErrNotFound) {
367		-	return res, "", gerr
368		-	}
	375	+	repo, onErmite, err := c.ermiteRepoOf(ctx, a)
	376	+	if err != nil {
	377	+	return res, "", err
	378	+	}
	379	+	if onErmite {
	380	+	// The repository exists here, so github.com never answers for it. A
	381	+	// repository the pusher may not read answers as one that does not exist,
	382	+	// before any ref is looked at, so that the texts leak nothing about it.
	383	+	if ok, err := c.pusherCanRead(ctx, by, j.Repo, repo); err != nil {
	384	+	return res, "", err
	385	+	} else if !ok {
	386	+	return res, errUnresolvedRepo(a), nil
369	387		}
	388	+	sha, found, err := c.resolveOnErmite(ctx, repo.Name, a.ref)
	389	+	if err != nil {
	390	+	return res, "", err
	391	+	}
	392	+	if !found {
	393	+	return res, errUnresolvedRef(a), nil
	394	+	}
	395	+	res.NameWithOwner, res.ResolvedSHA, res.Source = c.cfg.Owner+"/"+repo.Name.String(), sha, domain.CIActionErmite
	396	+	return res, "", nil
370	397		}
371	398		res.NameWithOwner, res.Source = a.owner+"/"+a.repo, domain.CIActionGitHub
372	399		if low := strings.ToLower(a.ref); isHex40(low) {

 	ra := ports.ResolvedAction{
 		Ref: p.uses, NameWithOwner: res.NameWithOwner, Path: p.path, ResolvedSHA: res.ResolvedSHA, Source: res.Source,
 	}
+	notFound := ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}
+	// A repository of this server that the pusher cannot read is never served
+	// from anywhere else: not from github.com under the same name, whatever
+	// source an earlier resolution of the attempt stored. It answers as a
+	// repository that does not exist. (When it does not exist on this server, a
+	// stored ermite resolution has nothing to serve either.)
+	repo, onErmite, err := c.ermiteRepoOf(ctx, p)
+	if err != nil {
+		return ports.ResolvedAction{}, err
+	}
+	if onErmite {
+		if ok, err := c.pusherCanRead(ctx, by, rs.run.Repo, repo); err != nil {
+			return ports.ResolvedAction{}, err
+		} else if !ok {
+			return notFound, nil
+		}
+	}
 	switch res.Source {
 	case domain.CIActionGitHub:
 		// The case the workflow wrote: the stored resolution is shared by
 		ra.NameWithOwner = p.owner + "/" + p.repo
 		ra.TarballURL = "https://codeload.github.com/" + ra.NameWithOwner + "/tar.gz/" + res.ResolvedSHA
 	case domain.CIActionErmite:
-		name, err := domain.ParseRepoName(strings.ToLower(p.repo))
+		if !onErmite {
-		if err != nil {
+			return notFound, nil
-			return ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}, nil
-		}
-		repo, err := c.cfg.Meta.Get(ctx, name)
-		if errors.Is(err, domain.ErrNotFound) {
-			return ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}, nil
-		} else if err != nil {
-			return ports.ResolvedAction{}, err
-		}
-		if ok, err := c.pusherCanRead(ctx, by, rs.run.Repo, repo); err != nil {
-			return ports.ResolvedAction{}, err
-		} else if !ok {
-			return ports.ResolvedAction{Ref: p.uses, Error: errUnresolvedRepo(p)}, nil
 		}
 		ra.TarballURL = c.cfg.PublicURL + apiPath + "/repos/" + res.NameWithOwner + "/tarball/" + res.ResolvedSHA
-		ra.Token = c.archiveToken(rs, j, name, res.ResolvedSHA)
+		ra.Token = c.archiveToken(rs, j, repo.Name, res.ResolvedSHA)
 	}
 	return ra, nil
 }
 	return tok
 }
+// ermiteRepoOf finds the repository of this server that a reference names: the
+// owner is ERMITE_OWNER (without regard to case) and the repository exists. ok
+// is false for any other reference, which github.com serves. It is the one
+// place that decides the source of an action, for a first resolution and for the
+// answer from a stored one.
+func (c *CI) ermiteRepoOf(ctx context.Context, a actionRef) (repo domain.Repo, ok bool, err error) {
+	if !domain.OwnerMatches(c.cfg.Owner, a.owner) {
+		return domain.Repo{}, false, nil
+	}
+	name, perr := domain.ParseRepoName(strings.ToLower(a.repo))
+	if perr != nil {
+		return domain.Repo{}, false, nil // not a name ermite can hold
+	}
+	repo, err = c.cfg.Meta.Get(ctx, name)
+	switch {
+	case errors.Is(err, domain.ErrNotFound):
+		return domain.Repo{}, false, nil
+	case err != nil:
+		return domain.Repo{}, false, err
+	}
+	return repo, true, nil
+}
 // pusherAccess is who the actions of a run are resolved on behalf of: the
 // pusher recorded with the run.
 type pusherAccess struct{ pusher domain.CIPusher }
 // does not resolve; err is a failure of the call.
 func (c *CI) resolveAction(ctx context.Context, j domain.CIJob, a actionRef, remote *remoteRefs, by pusherAccess) (res domain.CIActionResolution, msg string, err error) {
 	res = domain.CIActionResolution{RunID: j.RunID, RunAttempt: j.RunAttempt, Key: a.key()}
-	if domain.OwnerMatches(c.cfg.Owner, a.owner) {
+	repo, onErmite, err := c.ermiteRepoOf(ctx, a)
-		if name, perr := domain.ParseRepoName(strings.ToLower(a.repo)); perr == nil {
+	if err != nil {
-			if repo, gerr := c.cfg.Meta.Get(ctx, name); gerr == nil {
+		return res, "", err
-				// A repository the pusher may not read answers as one that does
+	}
-				// not exist, before any ref is looked at, so that the texts leak
+	if onErmite {
-				// nothing about it.
+		// The repository exists here, so github.com never answers for it. A
-				if ok, err := c.pusherCanRead(ctx, by, j.Repo, repo); err != nil {
+		// repository the pusher may not read answers as one that does not exist,
-					return res, "", err
+		// before any ref is looked at, so that the texts leak nothing about it.
-				} else if !ok {
+		if ok, err := c.pusherCanRead(ctx, by, j.Repo, repo); err != nil {
-					return res, errUnresolvedRepo(a), nil
+			return res, "", err
-				}
+		} else if !ok {
-				sha, found, err := c.resolveOnErmite(ctx, name, a.ref)
+			return res, errUnresolvedRepo(a), nil
-				if err != nil {
-					return res, "", err
-				}
-				if !found {
-					return res, errUnresolvedRef(a), nil
-				}
-				res.NameWithOwner, res.ResolvedSHA, res.Source = c.cfg.Owner+"/"+name.String(), sha, domain.CIActionErmite
-				return res, "", nil
-			} else if !errors.Is(gerr, domain.ErrNotFound) {
-				return res, "", gerr
-			}
 		}
+		sha, found, err := c.resolveOnErmite(ctx, repo.Name, a.ref)
+		if err != nil {
+			return res, "", err
+		}
+		if !found {
+			return res, errUnresolvedRef(a), nil
+		}
+		res.NameWithOwner, res.ResolvedSHA, res.Source = c.cfg.Owner+"/"+repo.Name.String(), sha, domain.CIActionErmite
+		return res, "", nil
 	}
 	res.NameWithOwner, res.Source = a.owner+"/"+a.repo, domain.CIActionGitHub
 	if low := strings.ToLower(a.ref); isHex40(low) {