Fix watchdog artifact download across GitHub redirect - #48
Open
hiidkaboutyou-spec wants to merge 1 commit into
Open
Fix watchdog artifact download across GitHub redirect#48hiidkaboutyou-spec wants to merge 1 commit into
hiidkaboutyou-spec wants to merge 1 commit into
Conversation
…ects The watchdog's production-outcome artifact download always failed with 401: the artifact ZIP endpoint (api.github.com) 302-redirects to a pre-signed Azure Blob URL, and Python's urllib forwards the Authorization header on redirect, which Azure rejects (InvalidAuthenticationInfo). The watchdog therefore never consumed a real outcome and silently fell back to legacy workflow-conclusion logic. - Add _NoAuthRedirectHandler: strips Authorization only on cross-host redirects; same-host GitHub API auth is untouched - Add _download_artifact_zip helper used by fetch_latest_production_outcome - 16 regression tests covering cross-host redirect auth stripping, same-host auth retention, bounded 401/403 failure, invalid ZIP, secret-free error summaries, and safe legacy fallback Verified against the real production artifact (run 33418239126): before 401/HTTPError, after schema_version=1, outcome_status=healthy. 🤖 Generated with Codebuff Co-Authored-By: Codebuff <noreply@codebuff.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Authorizationheader on redirect, which Azure rejects_NoAuthRedirectHandler(strips Authorization only on cross-host redirects; same-host GitHub API auth untouched) and_download_artifact_ziphelperschema_version=1, outcome_status=healthyRedirect security behavior
This hotfix is required for PR #47 (Structured Production Outcome Contract) to work end-to-end: without it the watchdog can never consume a real outcome artifact.