Skip to content

ci: add optional CortexTrace Free execution review #269

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Maurice Witten (blocksifrdev) wants to merge 2 commits into
base: main
Choose a base branch
from
+100 −0
Open

ci: add optional CortexTrace Free execution review #269

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
4ed4459
ci: add optional CortexTrace Free execution review
blocksifrdev Jun 20, 2026
c40aba1
ci: harden CortexTrace advisory workflow
blocksifrdev Jun 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .cortextrace/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
{
"mode": "free",
"project": "ordvec",
"executionSurface": "github_pr",
"language": "rust",
"policy": {
"failClosed": false,
"commentOnPr": false,
"generateReceipts": true,
"detect": [
"github_actions_change",
"release_pipeline_change",
"dependency_change",
"unsafe_rust_change",
"ffi_boundary_change",
"serialized_index_parser_change",
"fuzz_surface_change",
"security_policy_change"
]
},
"receipts": {
"localOnly": true,
"path": ".cortextrace/reports"
}
}
75 changes: 75 additions & 0 deletions .github/workflows/cortextrace-free.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
name: CortexTrace Free

on:
pull_request:
branches: [main]
push:
branches: [main]
workflow_dispatch:

permissions:
contents: read

jobs:
cortextrace:
name: Execution consequence review
runs-on: ubuntu-latest
timeout-minutes: 10

steps:
- name: Checkout
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
with:
persist-credentials: false

- name: Setup Node for CortexTrace CLI
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
with:
node-version: "20"

- name: Run CortexTrace Free advisory review
shell: bash
run: |

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pass the GitHub token to the CLI step

The CortexTrace commands run as plain shell commands, but this step never exposes secrets.GITHUB_TOKEN as an environment variable; the package docs advertise GITHUB_TOKEN for GitHub usage, and the workflow grants PR/actions read scopes that the process cannot use unless the token is passed. On PR or push runs where the tool needs GitHub PR/action metadata, doctor, run, and report can fail unauthenticated and still leave a green job because every command is followed by || true and missing artifacts are ignored.

Useful? React with 👍 / 👎.

set +e

mkdir -p .cortextrace/reports

CORTEXTRACE_VERSION="0.1.0"

@github-actions github-actions Bot Jun 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Note: The CortexTrace CLI supports GITHUB_TOKEN for API-based features, but this workflow intentionally omits it for read-only advisory mode. If the tool gains write capabilities in the future, ensure this is reconsidered.

@github-actions github-actions Bot Jun 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Note: The CortexTrace CLI supports GITHUB_TOKEN for API-based features, but this workflow intentionally omits it for read-only advisory mode. If the tool gains write capabilities in the future, ensure this is reconsidered.


npm_config_ignore_scripts=true npx -y @blocksifr/cortextrace@${CORTEXTRACE_VERSION} doctor
doctor_status=$?

npm_config_ignore_scripts=true npx -y @blocksifr/cortextrace@${CORTEXTRACE_VERSION} run
run_status=$?

npm_config_ignore_scripts=true npx -y @blocksifr/cortextrace@${CORTEXTRACE_VERSION} report
report_status=$?

{
echo "### CortexTrace Free advisory run"
echo
echo "| Command | Exit status |"
echo "|---|---:|"
echo "| doctor | ${doctor_status} |"
echo "| run | ${run_status} |"
echo "| report | ${report_status} |"
echo
echo "This workflow is advisory-only. It does not receive a GitHub token and does not block merges."
} >> "$GITHUB_STEP_SUMMARY"

exit 0

- name: Upload CortexTrace reports
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
if: always()
with:
name: cortextrace-free-report
path: |
.cortextrace/reports/**

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 20, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Include hidden report directories in the artifact

The reports configured in .cortextrace/config.json are written under .cortextrace/reports, but actions/upload-artifact v4.4+ ignores hidden files and files inside dot-prefixed folders by default unless include-hidden-files: true is set. In the normal report path, this upload step will silently omit the CortexTrace reports while if-no-files-found: ignore still leaves the workflow green, so reviewers will have no artifact to inspect.

Useful? React with 👍 / 👎.

cortextrace-report.*
!.cortextrace/**/*.env
!.cortextrace/**/*token*
!.cortextrace/**/*secret*
!.cortextrace/**/*credential*
include-hidden-files: true
if-no-files-found: warn
Loading