Skip to content

development.md

Latest commit

 

History

History
56 lines (34 loc) · 3.19 KB

development.md

File metadata and controls

56 lines (34 loc) · 3.19 KB
Raw

Local Development 🛠️

Fence keeps its Rust dependencies in the repository, so normal development commands run offline after you prepare the toolchain.

Get Started

script/prepare-rust
script/bootstrap
script/test
script/lint
script/build

script/prepare-rust is the only normal setup step that needs the network. It downloads the pinned Rust toolchain and verifies its checksums before installing it.

Once the toolchain is ready, script/bootstrap, script/test, script/lint, and script/build run offline using the checked-in dependencies and toolchain locks.

script/test includes offline tests for the hosted blocked-event check. That check allows a bounded wait for all test events so DNS refreshes and security checks can finish between batches. Missing events still fail the check; enforcement and the protected-finalization deadline are unchanged.

Update Dependencies

These update scripts need network access:

  • script/update updates Rust dependencies.
  • script/vendor-rust updates the pinned Rust toolchain.
  • script/vendor-update-tools updates dependency-audit tools.
  • script/vendor-release-tools updates retained release tools.
  • script/vendor-test-tools updates retained test tools.

Builds and tests must not install or download tools.

Build The GitHub Action

script/assemble-action-bundle builds an Action bundle from an existing agent artifact. It does not download an agent or policy.

The main branch does not contain generated Action binaries. Release automation adds the agent and its manifest to a separate signed distribution commit.

When The Release Canary Fails

The scheduled check opens an issue on the first failure. Aim to give people a useful update the same working day, even if it's just "no safe workaround yet." The issue is a record of what failed, not a claim that every runner is affected. Report a possible security bypass privately.

Keep the issue open until we can explain the first failure. For a Fence fix, reproduce the runner condition, show that a safe variation works and an unsafe one is still rejected, then record the verified release pin. A green run elsewhere isn't that evidence, and publishing a fix doesn't update anyone's pin.

If reporting failed, rerun release canary report to recover the original result. If the problem was missing evidence rather than Fence, record what happened and how you verified it; no release is needed.

After a month, count every scheduled first attempt, including refusals and missing results. Compare when we first saw the failure, when we gave useful guidance, and when a verified pin was available. Record downstream recovery only if someone volunteers it; these checks don't measure customer availability.

Temporary Files

Local builds and tool preparation use target/tmp unless TMPDIR or RUNNER_TEMP is already set.

Warning

Do not run hosted-runner or lockdown tests on your computer or a reusable runner. They change host settings and are intended for disposable GitHub-hosted runners.

For the complete build and test contracts, see AGENTS.md and the v0 specification.