diff --git a/apps/api/src/services/gitea_workflow_runner_owner_attestation_request.py b/apps/api/src/services/gitea_workflow_runner_owner_attestation_request.py index 82cf1a5eb..6c626e54c 100644 --- a/apps/api/src/services/gitea_workflow_runner_owner_attestation_request.py +++ b/apps/api/src/services/gitea_workflow_runner_owner_attestation_request.py @@ -14,7 +14,11 @@ from src.services.gitea_workflow_runner_health import ( ) _SCHEMA_VERSION = "gitea_workflow_runner_owner_attestation_request_v1" -_CONTRACT_ID = "ubuntu_latest_gitea_runner_label" +_LEGACY_CONTRACT_ID = "ubuntu_latest_gitea_runner_label" +_CONTROLLED_CONTRACT_IDS = ( + "awoooi_non110_host_runner", + "awoooi_non110_ubuntu_runner", +) _REQUIRED_FIELDS = [ "runner_label", "actual_runner_mapping_ref", @@ -53,47 +57,71 @@ def load_latest_gitea_workflow_runner_owner_attestation_request() -> dict[str, A and contract.get("contract_id") in set(_strings(rollups.get("runner_contracts_requiring_action"))) ] - target_contract = next( + legacy_contract = next( ( contract for contract in action_contracts - if contract.get("contract_id") == _CONTRACT_ID + if contract.get("contract_id") == _LEGACY_CONTRACT_ID ), {}, ) + controlled_contracts = [ + contract + for contract in health.get("runner_contracts", []) + if isinstance(contract, dict) + and contract.get("contract_id") in set(_CONTROLLED_CONTRACT_IDS) + ] + target_contract = legacy_contract or _first_dict(controlled_contracts) workflow_ids = _strings(rollups.get("workflow_ids_requiring_runner_attestation")) - request_ready = bool(target_contract) and bool(workflow_ids) + attestation_required = bool(legacy_contract) and bool(workflow_ids) + attestation_not_required = ( + bool(controlled_contracts) and not action_contracts and not workflow_ids + ) + request_packet_ready = attestation_required or attestation_not_required active_blockers = [] - if not request_ready: + if not request_packet_ready: active_blockers.append("runner_attestation_request_source_missing") - active_blockers.append("owner_attestation_response_not_received") + if attestation_required: + active_blockers.append("owner_attestation_response_not_received") + + status = "blocked_owner_attestation_request_source_missing" + if attestation_required: + status = "owner_attestation_request_ready_waiting_response" + elif attestation_not_required: + status = "owner_attestation_not_required_controlled_runner_contracts_mapped" return { "schema_version": _SCHEMA_VERSION, "priority": "P1-002", "scope": "gitea_workflow_runner_owner_attestation_request", - "status": ( - "owner_attestation_request_ready_waiting_response" - if request_ready - else "blocked_owner_attestation_request_source_missing" - ), + "status": status, "readback": { "workplan_id": "P1-002-GITEA-RUNNER-OWNER-ATTESTATION", "source_health_schema_version": health.get("schema_version"), "source_health_endpoint": "/api/v1/agents/gitea-workflow-runner-health", - "contract_id": _CONTRACT_ID, + "contract_id": str(target_contract.get("contract_id") or ""), "runner_label": _first_string(target_contract.get("runner_labels")), - "request_packet_id": "gitea_runner_owner_attestation_request::ubuntu_latest", + "attestation_required": attestation_required, + "attestation_not_required": attestation_not_required, + "request_packet_id": ( + "gitea_runner_owner_attestation_request::controlled_non110" + if attestation_not_required + else "gitea_runner_owner_attestation_request::ubuntu_latest" + ), "safe_next_step": ( - "collect_redacted_owner_attestation_response_then_validate_no_runner_mutation" + "continue_public_gitea_queue_and_production_readback_without_runner_mutation" + if attestation_not_required + else "collect_redacted_owner_attestation_response_then_validate_no_runner_mutation" ), }, "request_packet": { - "request_template_ready": request_ready, + "request_template_ready": request_packet_ready, + "attestation_required": attestation_required, + "attestation_not_required": attestation_not_required, "request_sent": False, "owner_response_received": False, "owner_response_accepted": False, - "contract_id": _CONTRACT_ID, + "contract_id": str(target_contract.get("contract_id") or ""), "display_name": str(target_contract.get("display_name") or ""), "risk_level": str(target_contract.get("risk_level") or "high"), "runner_labels": _strings(target_contract.get("runner_labels")), @@ -127,8 +155,11 @@ def load_latest_gitea_workflow_runner_owner_attestation_request() -> dict[str, A ], }, "rollups": { - "request_template_ready": request_ready, - "request_packet_count": int(request_ready), + "request_template_ready": request_packet_ready, + "attestation_required": attestation_required, + "attestation_not_required": attestation_not_required, + "request_packet_count": int(request_packet_ready), + "controlled_runner_contract_count": len(controlled_contracts), "workflow_requiring_attestation_count": len(workflow_ids), "runner_contracts_requiring_action_count": len(action_contracts), "required_owner_field_count": len(_REQUIRED_FIELDS), @@ -170,3 +201,12 @@ def _strings(value: Any) -> list[str]: def _first_string(value: Any) -> str: values = _strings(value) return values[0] if values else "" + + +def _first_dict(value: Any) -> dict[str, Any]: + if not isinstance(value, list): + return {} + for item in value: + if isinstance(item, dict): + return item + return {} diff --git a/apps/api/tests/test_delivery_closure_workbench_api.py b/apps/api/tests/test_delivery_closure_workbench_api.py index a03acde50..0ae11198c 100644 --- a/apps/api/tests/test_delivery_closure_workbench_api.py +++ b/apps/api/tests/test_delivery_closure_workbench_api.py @@ -486,15 +486,17 @@ def _assert_delivery_workbench_shape(data: dict): assert data["summary"]["github_lane_status"] == "stopped_retired_do_not_use" assert data["summary"]["github_lane_excluded_from_p0_blocker_count"] is True assert data["summary"]["gitea_runner_attestation_request_status"] == ( - "owner_attestation_request_ready_waiting_response" + "owner_attestation_not_required_controlled_runner_contracts_mapped" ) assert data["summary"]["gitea_runner_attestation_request_ready"] is True - assert data["summary"]["gitea_runner_attestation_request_active_blocker_count"] == 1 + assert data["summary"]["gitea_runner_attestation_request_active_blocker_count"] == 0 assert data["summary"]["gitea_runner_attestation_contract_id"] == ( - "ubuntu_latest_gitea_runner_label" + "awoooi_non110_host_runner" ) - assert data["summary"]["gitea_runner_attestation_runner_label"] == "ubuntu-latest" - assert data["summary"]["gitea_runner_attestation_workflow_count"] == 8 + assert data["summary"]["gitea_runner_attestation_runner_label"] == ( + "awoooi-non110-host" + ) + assert data["summary"]["gitea_runner_attestation_workflow_count"] == 0 assert data["summary"]["gitea_runner_attestation_required_owner_field_count"] >= 10 assert data["summary"]["gitea_runner_attestation_forbidden_action_count"] >= 8 assert data["summary"]["gitea_runner_attestation_owner_response_received_count"] == 0 diff --git a/apps/api/tests/test_gitea_workflow_runner_owner_attestation_request_api.py b/apps/api/tests/test_gitea_workflow_runner_owner_attestation_request_api.py index 15178fcf4..9214c1cbd 100644 --- a/apps/api/tests/test_gitea_workflow_runner_owner_attestation_request_api.py +++ b/apps/api/tests/test_gitea_workflow_runner_owner_attestation_request_api.py @@ -22,22 +22,29 @@ def test_gitea_workflow_runner_owner_attestation_request_endpoint(): == "gitea_workflow_runner_owner_attestation_request_v1" ) assert data["priority"] == "P1-002" - assert data["status"] == "owner_attestation_request_ready_waiting_response" - assert data["readback"]["contract_id"] == "ubuntu_latest_gitea_runner_label" - assert data["readback"]["runner_label"] == "ubuntu-latest" + assert data["status"] == ( + "owner_attestation_not_required_controlled_runner_contracts_mapped" + ) + assert data["readback"]["contract_id"] == "awoooi_non110_host_runner" + assert data["readback"]["runner_label"] == "awoooi-non110-host" + assert data["readback"]["attestation_required"] is False + assert data["readback"]["attestation_not_required"] is True assert data["request_packet"]["request_template_ready"] is True + assert data["request_packet"]["attestation_required"] is False + assert data["request_packet"]["attestation_not_required"] is True assert data["request_packet"]["request_sent"] is False assert data["request_packet"]["owner_response_received"] is False assert data["request_packet"]["owner_response_accepted"] is False assert ( len(data["request_packet"]["workflow_ids_requiring_attestation"]) == data["rollups"]["workflow_requiring_attestation_count"] - == 8 + == 0 ) + assert data["rollups"]["controlled_runner_contract_count"] == 2 assert data["rollups"]["required_owner_field_count"] >= 10 assert data["rollups"]["owner_response_received_count"] == 0 assert data["rollups"]["owner_response_accepted_count"] == 0 - assert "owner_attestation_response_not_received" in data["active_blockers"] + assert data["active_blockers"] == [] boundaries = data["operation_boundaries"] assert boundaries["read_only_api_allowed"] is True