Forbid unsafe workspace-wide, alert on process death, run Docker tests in CI#127
Merged
Conversation
…s in CI Three hardening gaps closed in one pass: The workspace now carries [workspace.lints.rust] unsafe_code = "forbid", inherited by every crate; pb-types alone overrides to deny for its four SAFETY-documented from_utf8_unchecked serializer sites, each #[allow]- scoped and miri-verified in CI. Ten of eleven crates are provably unsafe-free at compile time; SECURITY.md records the policy. Total process death was the one failure mode no alert could see: rate()/increase() over an absent series returns an empty vector, so FeedSilent and friends all go quiet exactly when the process dies. TargetDown (up == 0 for 1m) and IngestAbsent (absent ingest series) close that hole, with promtool incident tests and runbook sections. The #[ignore]d Docker-backed integration cases — ClickHouse roundtrips, Parquet-vs-ClickHouse cross-backend equivalence, and the MinIO S3 roundtrip, the strongest consistency evidence in the suite — now run on every PR in a new integration-docker CI job via testcontainers. TESTING.md's matrix row and known-gaps section are updated accordingly.
weiminglong
force-pushed
the
feat/hardening-bundle
branch
from
July 6, 2026 12:59
4e3fa3d to
7a40414
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Three independent hardening gaps, one pass:
[workspace.lints.rust] unsafe_code = "forbid", inherited by every crate ([lints] workspace = true). pb-types alone overrides todenyfor its four SAFETY-documentedfrom_utf8_uncheckedserializer sites, each#[allow]-scoped and miri-verified in CI. Verified by a negative probe (anunsafeblock in pb-book fails compilation). Policy recorded in SECURITY.md.rate()/increase()over an absent series evaluates to an empty vector, so every existing alert goes quiet exactly when the process dies.TargetDown(up == 0for 1m, critical) andIngestAbsent(absent ingest series, belt-and-braces for job-label drift) close the hole, with three new promtool incident scenarios (fires-on-incident + does-not-fire-on-healthy) and RUNBOOK.md sections.integration-dockerCI job: the#[ignore]d Docker-backed cases — 5 ClickHouse roundtrips, 3 Parquet-vs-ClickHouse cross-backend equivalence tests, the MinIO S3 roundtrip — now run on every PR via testcontainers (ubuntu runners ship Docker). This was the suite's strongest consistency evidence and it never ran in CI. TESTING.md matrix row 7 flips to covered and the known-gaps entry is removed.Verification
monitoringCI job (promtool check + test, amtool routing asserts —criticalroutes to pagerduty-critical unchanged)