Repository navigation
test(e2e): give the BEP grant seeds a GitHub scope and proxy_env steering - #2765
Conversation
…ring Five live Box Egress Proxy cases declared `source = "broker"` with no `github:` scope. SecretGrant::is_github needs that scope, so these boxes were credentialed upstreams but not GitHub grants: nothing was minted, and with no steering declared they resolved to `dns`, which has no box-zone resolver yet. None of them could pass on a lane that runs them. - bep_second_box_needs_no_sign_in, bep_box_env_holds_sealed_value_only: add the scope and proxy_env, and start the boxes own_ip with --credentialed-upstream as bep_first_slice_end_to_end does. - bep_git_and_gh_against_private_repo, bep_git_credential_helper_sends_header: add the scope, and admit uploads.github.com, which a GitHub grant's egress must admit (BEP-008). - bep_trust_box_files (the trust-store cases): add the scope and proxy_env. Also corrects two comments that said no box ships a git credential helper; #2547 shipped it.
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Grant scopes and proxy settings scripts/session-e2e.sh |
Grant fixtures add the github:user-token scope, proxy_env steering, and credentialed own-IP network settings. The private-repository and credential-helper fixtures retain their package and GitHub DNS allowlist settings. |
Trust-store fixture and credential-helper descriptions scripts/session-e2e.sh |
The trust-store grant fixture adds the token scope, proxy steering, a credentialed upstream, and GitHub DNS-host allowances. Plain boxes retain an empty egress-argument list. Two proof descriptions state that cloning and pushing use the shipped Git credential helper. |
Estimated code review effort: 2 (Simple) | ~10 minutes
Change: Other
Possibly related issues
- T78 — Run bep_git_credential_helper_sends_header on the macOS lane #2563 — The credential-helper case adds the token scope and GitHub host configuration; this PR does not run the case on macOS.
- Local box egress proxy — sealed GitHub credentials and host-store secrets without Gatehouse #1501 — The grant fixtures configure parts of the Box Egress Proxy flow; the PR does not complete the epic’s remaining requirements.
- S11 — macOS lane proofs #2590 — The fixtures add settings used by the Box Egress Proxy cases; the PR does not run those cases on macOS.
Suggested reviewers: evanspearman
Merge Risk: 
8d6f4
-
The fixture updates match the required GitHub grant, proxy, networking, and credential-helper contracts. No merge-blocking risk remains.
Pre-merge checks: 
-
Check name Status Explanation Title check The title clearly and concisely describes the main E2E fixture changes. It uses a valid Conventional Commit format, imperative wording, lower-case subject text, and no trailing period. Description check The description provides detailed change context, affected cases, verification results, unverified live testing status, and known residual issues. It does not use the template headings exactly and omi… Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Description check
-
Explanation
The description provides detailed change context, affected cases, verification results, unverified live testing status, and known residual issues. It does not use the template headings exactly and omits the checklist, but the required information is mostly complete.
Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 too large.)
-
Finishing Touches
-
Generate docstrings
-
- Commit to this branch
- Create a new PR
Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
A rabbit checks the grants at dawn,
The token scope is now switched on.
Proxy paths guide each GitHub hop,
While helper notes describe the shop.
The box can clone and push with care,
Then thumps a happy paw in air.
|
Approved: no findings at Nothing to do. Clobber: none seen. |
|
Live run of the reseeded cases (2026-10-31) Setup:
The three trust-store cases start their grant box with |
Part of #1501. Found during the epic close-out audit.
Situation
Five live Box Egress Proxy cases in
scripts/session-e2e.shdeclared a grant assource = "broker"with nogithub:scope.SecretGrant::is_github(crates/boxes/src/core/bep.rs:201) needs that scope. So these boxes counted as credentialed upstreams but not as GitHub grants, and nothing was minted for them. Most also declared no steering, so steering resolved todns(BEP-016), and no host has a box-zone resolver yet (BEP-017). Some also started on the default--network host_ip. Ahost_ipbox on a VM host refuses hostname rules at the start, and the credentialed-upstream lane is in effect only forown_ip. Off the macOS lane that runs them (#2500, #2563), every one records NOT RUN, which is why CI never showed the problem.Change
bep_second_box_needs_no_sign_in(BEP-003),bep_box_env_holds_sealed_value_only(BEP-007)scopes = ["github:user-token"]andsteering = "proxy_env". Start the boxes with--network own_ip --credentialed-upstream, asbep_first_slice_end_to_enddoesbep_git_and_gh_against_private_repo,bep_git_credential_helper_sends_header(BEP-015)uploads.github.com, which a GitHub grant's egress must admit (BEP-008)bep_trust_box_files, which starts the grant box for every trust-store case (BEP-011)proxy_env, and start the grant box with--network own_ip --credentialed-upstream. The plain box is unchanged. Every caller is already behindbep_live_gate, which needs a sign-inIt also corrects two comments that said no box ships a git credential helper. #2547 shipped it, and #2499 is closed.
This PR fixes the seeds and flags these cases declare. It does not show that the cases pass: see below.
Verification
bash -n scripts/session-e2e.sh: syntax okjust lint-shell: 49 scripts pass shellcheckscopes = ["github:user-token"]in the script is now paired with--network own_ip --credentialed-upstreamat itsmin session activate(checked by grep).Not verified
None of these cases has been run live. They need the macOS VM lane with a GitHub sign-in and
E2E_BEP_PRIVATE_REPO. The proxy cannot start on the author's Mac, and on any other host the cases record NOT RUN. Whether they pass end to end is still open.Known residual
The audit also found that
min box audit< 8000 /code> shows no record for real boxes. It looks a box up by its hyphenated id, and the proxy writes the plain-hex id (BEP-042). This PR does not fix that. The cases that read the audit log will still fail at that step until it is fixed:bep_first_slice_end_to_end, the destroy-revocation cases, and BEP-070.b.Summary by CodeRabbit