Make trusting a repository something you can do in one command #23

2026-08-31T22:58:35-07:00

dejima-agent commented

2026-08-31 22:58:35 -07:00

Summary generated by LLM agent

All from one reported session on a live host: a new project declared domains and got none of them, and everything that followed from trying to fix it.

A comment in `base-domains` killed the render

base_file was cat'd raw, while repos_file one loop below was comment-stripped, and install.sh strips comments when it reads that same file back. So a # line reached valid_domain and the run died with:

refusing a malformed entry: #namesallowedregardlessofanyprojectdeclaration

which names no file. The operator went to /etc/dejima-ci/config, which legitimately has a comment at the top that install.sh put there, and which was never the problem. Stripped now, and the message names both files an entry can come from.

Stripped in one place, after a second report. The first version of this fix stripped base-domains and stopped there, and the next run on the same host died identically on a bare # from a repository's own declaration, because a fetched body was cat'd raw too. Comments are now stripped where every name arrives, which covers both sources and any added later. A bare # is not an odd thing to write: it is the separator line in a comment block, which is how the generated files in these repositories are written.

The per-repository count was of lines rather than names, so a comment block counted as declarations: "15 name(s) declared" for a file declaring fewer.

Trusting a repository is one command

sudo dejima-ci-allowlist repos add owner/repo

list, add and remove. Adding one project meant re-running the installer, whose prompt offered "keep this list?" and treated no as "type all nine again, from memory, in a prompt with no way back".

It deliberately needs no forge and no token: it edits a list of names, and requiring a working configuration to do that would make it useless on the host whose configuration is the thing being diagnosed.

Collection says what each repository gave

"My project declared domains and got none of them" had no diagnostic anywhere. A repository absent from repos_file is never fetched, so it produced no line, no error and no trace: the operator had to already suspect the list existed to find it. Every consulted repository now reports its count, and a missing one is missing from a printed list rather than from memory.

install.sh

Keep, add, or replace, and it points at the new command first.

And it no longer claims no runner is configured. That was printed unconditionally, without checking, on a re-run. Re-running to change one setting is the normal way to use the installer, so the claim was most likely to be read by somebody it was false for, and it reads as the installer having undone something. It now counts the compose projects under the invoking user's runners/ and says the true thing.

Found while testing

repos consumed the rest of the command line where it was seen, so a following --config was swallowed and the edit landed in the file named by the default config instead. Silently, on the file that decides whose branch may widen an allowlist.

Tested: 151 passing, up from 136. Twelve of the fifteen new tests were run against main and fail on it, and the two-source case was also run end to end against a stubbed forge. bats had vanished from this sandbox partway through the session; it was reinstalled from the npm registry, and the suite was run for real.

**Summary generated by LLM agent** All from one reported session on a live host: a new project declared domains and got none of them, and everything that followed from trying to fix it. ## A comment in `base-domains` killed the render `base_file` was `cat`'d raw, while `repos_file` one loop below was comment-stripped, and `install.sh` strips comments when it reads that same file back. So a `#` line reached `valid_domain` and the run died with: ``` refusing a malformed entry: #namesallowedregardlessofanyprojectdeclaration ``` which names no file. The operator went to `/etc/dejima-ci/config`, which legitimately has a comment at the top that `install.sh` put there, and which was never the problem. Stripped now, and the message names both files an entry can come from. **Stripped in one place, after a second report.** The first version of this fix stripped `base-domains` and stopped there, and the next run on the same host died identically on a bare `#` from a repository's own declaration, because a fetched body was `cat`'d raw too. Comments are now stripped where every name arrives, which covers both sources and any added later. A bare `#` is not an odd thing to write: it is the separator line in a comment block, which is how the generated files in these repositories are written. The per-repository count was of lines rather than names, so a comment block counted as declarations: "15 name(s) declared" for a file declaring fewer. ## Trusting a repository is one command ```sh sudo dejima-ci-allowlist repos add owner/repo ``` `list`, `add` and `remove`. Adding one project meant re-running the installer, whose prompt offered "keep this list?" and treated *no* as "type all nine again, from memory, in a prompt with no way back". It deliberately needs no forge and no token: it edits a list of names, and requiring a working configuration to do that would make it useless on the host whose configuration is the thing being diagnosed. ## Collection says what each repository gave "My project declared domains and got none of them" had no diagnostic anywhere. A repository absent from `repos_file` is never fetched, so it produced no line, no error and no trace: the operator had to already suspect the list existed to find it. Every consulted repository now reports its count, and a missing one is missing from a printed list rather than from memory. ## install.sh Keep, **add**, or replace, and it points at the new command first. And it no longer claims no runner is configured. That was printed unconditionally, without checking, on a re-run. Re-running to change one setting is the normal way to use the installer, so the claim was most likely to be read by somebody it was false for, and it reads as the installer having undone something. It now counts the compose projects under the invoking user's `runners/` and says the true thing. ## Found while testing `repos` consumed the rest of the command line where it was seen, so a following `--config` was swallowed and the edit landed in the file named by the *default* config instead. Silently, on the file that decides whose branch may widen an allowlist. Tested: 151 passing, up from 136. Twelve of the fifteen new tests were run against `main` and fail on it, and the two-source case was also run end to end against a stubbed forge. `bats` had vanished from this sandbox partway through the session; it was reinstalled from the npm registry, and the suite was run for real.

dejima-agent added 1 commit 2026-08-31 22:58:35 -07:00

Make trusting a repository something you can do in one command

tests / runner-env (confined) (pull_request_target) Successful in 38s

Details

tests / tests (pull_request_target) Successful in 1m19s

Details

tests / compose-schema (pull_request_target) Successful in 45s

Details

tests / runner-env (privileged) (pull_request_target) Successful in 36s

Details

11b841500e

Reported from a real host. A new project added .dejima/allowed-domains and got
none of its names, with nothing anywhere saying why; the operator had to
remember that a fixed list of repositories exists at all. Fixing it meant
re-running install.sh, whose prompt offered "keep this list?" and treated no as
"type all nine again, from memory". Then the run claimed no runners were
configured, on a host with runners running. Then the allowlist refused to
render, complaining about a `#` that was not where it pointed.

Five things, all of them that one session.

A COMMENT IN base-domains KILLED THE RENDER. It was cat'd raw while the repos
file one loop below was comment-stripped, and install.sh strips comments when
it reads the same file back. So a `#` line reached valid_domain and died with
"refusing a malformed entry: #namesallowedregardless...", which names no file.
The operator looked at /etc/dejima-ci/config, which has a comment at the top
that install.sh put there and which was never the problem. Stripped now, and
the message names both files an entry can come from.

`repos list|add|remove` on dejima-ci-allowlist, so adding a project is one
command rather than a pass through the installer. It needs no forge and no
token: it edits a list of names, and requiring a working configuration to do
that makes it useless on the host whose configuration is being diagnosed.

COLLECTION SAYS WHAT EACH REPOSITORY GAVE. A repository absent from repos_file
is never fetched, so it produced no line, no error and no trace - the operator
had to already suspect the list to find it. Every consulted repository now
reports its count, and one that is missing is missing from a printed list.

install.sh offers keep, add or replace, and points at the new command first.

And it no longer asserts that no runner is configured. That was printed without
checking, on a re-run, which is the normal way to change one setting - so the
claim was most likely to be read by somebody it was false for, and it reads as
the installer having undone something.

Found while testing: `repos` consumed the rest of the command line where it was
seen, so a following --config was swallowed and the edit landed in the file
named by the default config instead. Silently, on the file deciding whose
branch may widen an allowlist.

branderson approved these changes 2026-08-31 23:04:17 -07:00

branderson merged commit 9ae7bb982a into main

2026-08-31 23:04:30 -07:00

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dejima/dejima-ci-hardener#23

Make trusting a repository something you can do in one command #23

A comment in base-domains killed the render

Trusting a repository is one command

Collection says what each repository gave

install.sh

Found while testing

A comment in `base-domains` killed the render