[ci] Make typed workflow bridges fail closed

Derive Miri job eligibility from the projected matrix instead of
repeating the event policy in workflow YAML. Publish the same gate to
the required-check aggregate so policy changes cannot select work that
the workflow silently skips.

Run the planner with an absolute privileged Bash, neutralized
startup controls, and a command-local fixed PATH. Invoke an explicit
child Bash so the cargo wrapper cannot select an ambient interpreter.

Run typed cells with absolute Docker, a fixed /bin/bash entrypoint,
privileged no-startup arguments, and an option terminator. Use absolute
jq in the final gate. These bridges now fail if PATH, image startup
state, or Bash startup state attempts to replace their commands.

This changes transport and eligibility wiring, not selected
coverage: pull requests still run 60 build and zero Miri cells. Full
events still run 182 build cells and 64 Miri cells.

Tests: offline zc tests
Tests: ci/check_actions.sh
Tests: cargo fmt --check
Tests: git diff --check

*Authored by an agent, posting via joshlf's account*

gherrit-pr-id: Gg5onzlaf6nsoqoubbjg43tdiuxvvjrbc

Author: joshlf

.github/workflows/ci.yml

@@ -15,11 +15,9 @@ name: Build & Tests
       - main
   pull_request:
   merge_group:
-  # Useful for manually testing changes to this workflow. Because we check for
-  # the merge queue by doing `github.event_name != 'pull_request'` rather than
-  # `github.event_name == 'merge_group'`, triggering via workflow dispatch has
-  # the effect of running all jobs, including those which would normally only be
-  # run in the merge queue.
+  # Useful for manually testing changes to this workflow. The typed planner
+  # classifies this as a full event, so its plan enables all ordinary CI work,
+  # including Miri.
   workflow_dispatch:
 
 permissions:
@@ -61,8 +59,8 @@ jobs:
   # jobs consume only the checked selectors from each matrix cell and pass them
   # back to `cargo-zerocopy`, which reconstructs and executes the complete
   # command without interpreting matrix data as shell text. Keep the output
-  # names coordinated with `tools/zc/src/github.rs` and the two `fromJSON`
-  # expressions below.
+  # names coordinated with `tools/zc/src/github.rs`, the two `fromJSON`
+  # expressions below, and the Miri eligibility consumers below.
   plan_ci:
     name: Plan ordinary CI work
     runs-on: ubuntu-latest
@@ -71,9 +69,10 @@ jobs:
     outputs:
       build_matrix: ${{ steps.plan.outputs.build_matrix }}
       miri_matrix: ${{ steps.plan.outputs.miri_matrix }}
-    defaults:
-      run:
-        working-directory: zerocopy
+      # This gate is derived from the projected Miri matrix, not independently
+      # from the event name. Keep it coordinated with `tools/zc/src/github.rs`,
+      # the Miri job condition, and the required-check aggregation.
+      miri_enabled: ${{ steps.plan.outputs.miri_enabled }}
     env:
       # upload-file-artifact requires its name to equal the path basename.
       # Keep this one value coordinated with the planner invocation and upload
@@ -86,11 +85,21 @@ jobs:
 
       - name: Validate inputs and project the plan
         id: plan
+        # The absolute custom shell removes Bash startup-control variables and
+        # enables privileged mode so inherited startup files, shell options,
+        # and exported functions cannot turn this step into a successful no-op.
+        shell: /usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS /bin/bash --noprofile --norc -p -euo pipefail -- {0}
+        working-directory: zerocopy
         env:
           EVENT_NAME: ${{ github.event_name }}
+        # The runner applies GITHUB_PATH after merging step env, so assign the
+        # fixed path directly to the child command. Do not rely on cargo.sh's
+        # /usr/bin/env bash shebang. Privileged mode also prevents an imported
+        # function from replacing a builtin when this child Bash starts.
         run: |
           set -euo pipefail
-          ./cargo.sh ci github-plan \
+          PATH=/home/runner/.cargo/bin:/usr/local/bin:/usr/bin:/bin \
+          /bin/bash --noprofile --norc -p ./cargo.sh ci github-plan \
             --event "$EVENT_NAME" \
             --github-output "$GITHUB_OUTPUT" \
             --artifact "$RUNNER_TEMP/$CI_PLAN_ARTIFACT"
@@ -213,18 +222,48 @@ jobs:
 
     # The matrix values are data, not shell fragments. `cargo-zerocopy`
     # validates these selectors against the plan for this event, reconstructs
-    # the typed argv and environment, and executes the complete cell. Keep this
-    # invocation coordinated with `tools/zc/src/cli.rs`; adding a command here
-    # would bypass the checked execution model.
+    # the typed argv and environment, and executes the complete cell. This step
+    # deliberately does not use the job's generated Docker shell: auditing its
+    # path would not prove that the generated wrapper still invokes Docker.
+    # Instead, the complete bridge below is explicit. The absolute Docker path
+    # relies on the hosted Ubuntu runner contract and prevents a PATH shim from
+    # returning success without starting a container. The entrypoint override
+    # and Bash startup options prevent image startup behavior or exported
+    # functions from intercepting the typed executor argv. The option
+    # terminator forces the inherited image value to be parsed as an image.
+    # Keep this command and its options coordinated with `tools/zc/src/cli.rs`.
     - name: Execute checked build cell
+      shell: /usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS /bin/bash --noprofile --norc -p -euo pipefail -- {0}
+      working-directory: zerocopy
       env:
         TOOLCHAIN: ${{ matrix.toolchain }}
         CRATE: ${{ matrix.crate }}
         FEATURE_PROFILE: ${{ matrix.feature_profile }}
         TARGET: ${{ matrix.target }}
       run: |
         set -euo pipefail
-        ./cargo.sh ci execute-build-cell \
+        /usr/bin/docker run --rm \
+          --workdir "$PWD" \
+          -v /home/runner/work:/home/runner/work \
+          -v /home/runner/.docker-cargo/registry:/root/.cargo/registry \
+          -v /home/runner/.docker-cargo/git:/root/.cargo/git \
+          -e GITHUB_ENV -e GITHUB_PATH -e GITHUB_STEP_SUMMARY -e GITHUB_OUTPUT -e GITHUB_WORKSPACE \
+          -e CI -e GITHUB_ACTIONS -e GITHUB_ACTOR -e GITHUB_REPOSITORY -e GITHUB_SHA -e GITHUB_REF -e GITHUB_EVENT_NAME \
+          -e TOOLCHAIN -e CRATE -e TARGET -e FEATURE_PROFILE \
+          -e RUSTFLAGS -e RUSTDOCFLAGS -e MIRIFLAGS \
+          -e CARGO_NET_RETRY -e RUSTUP_MAX_RETRIES \
+          -e ZC_NIGHTLY_RUSTFLAGS -e ZC_NIGHTLY_MIRIFLAGS \
+          -e ZC_SKIP_CARGO_SEMVER_CHECKS \
+          -e GIT_CONFIG_COUNT=1 \
+          -e GIT_CONFIG_KEY_0=safe.directory \
+          -e "GIT_CONFIG_VALUE_0=*" \
+          --entrypoint /bin/bash \
+          -- \
+          "$ZC_CI_IMAGE" \
+          --noprofile \
+          --norc \
+          -p \
+          ./cargo.sh ci execute-build-cell \
           --event "$GITHUB_EVENT_NAME" \
           --package "$CRATE" \
           --toolchain "$TOOLCHAIN" \
@@ -319,24 +358,26 @@ jobs:
         matrix.target != 'wasm32-unknown-unknown' &&
         env.ZC_SKIP_CARGO_SEMVER_CHECKS != '1'
 
-  # Miri runs only on full events because it is much more expensive than the
-  # ordinary build matrix. Each borrow model is its own matrix cell so the two
-  # models and all eligible target/profile combinations can run concurrently.
+  # Today's policy selects Miri only for full events because it is much more
+  # expensive than the ordinary build matrix. Each borrow model is its own
+  # matrix cell so the models and all eligible target/profile combinations can
+  # run concurrently. The job itself follows the plan rather than repeating
+  # that current policy.
   miri:
-    if: github.event_name != 'pull_request'
+    # The planner derives this output solely from whether it selected any Miri
+    # cells. Do not duplicate today's PR/full-event policy here: future policy
+    # changes must automatically enable or skip this job with the matrix they
+    # produce.
+    if: needs.plan_ci.outputs.miri_enabled == 'true'
     runs-on: ubuntu-latest
     needs: [build_docker_env, plan_ci]
     permissions:
       contents: read
-    defaults:
-      run:
-        shell: /tmp/docker-shell.sh {0} # zizmor: ignore[misfeature] (CI intentionally routes Miri through the prebuilt Docker image)
-        working-directory: zerocopy
     strategy:
       fail-fast: false
-      # Pull requests skip this job before matrix expansion. Full events consume
-      # exactly the Miri cells selected by the same checked plan used by the
-      # executor below.
+      # A planner-disabled job skips before matrix expansion. When enabled, it
+      # consumes exactly the Miri cells selected by the same checked plan used
+      # by the executor below.
       matrix: ${{ fromJSON(needs.plan_ci.outputs.miri_matrix) }}
 
     name: Miri (${{ matrix.crate }} / ${{ matrix.feature_profile }} / ${{ matrix.miri_model }} / ${{ matrix.target }})
@@ -345,12 +386,18 @@ jobs:
     - *matrix_checkout
     - *download_ci_image
     - *load_ci_image
-    - *create_docker_shell
 
     # As with ordinary cells, the workflow passes only selectors. Model flags,
     # feature arguments, the Cargo configuration transaction, and target
     # workarounds belong to the typed executor rather than this shell adapter.
+    # This explicit Docker bridge does not rely on the generated job shell
+    # actually executing its input. Its absolute Docker path, entrypoint
+    # override, Bash startup options, and option terminator provide the same
+    # fail-closed boundary as the ordinary build bridge. Keep the separate
+    # Miri-model selector coordinated with `tools/zc/src/cli.rs`.
     - name: Execute checked Miri cell
+      shell: /usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS /bin/bash --noprofile --norc -p -euo pipefail -- {0}
+      working-directory: zerocopy
       env:
         TOOLCHAIN: ${{ matrix.toolchain }}
         CRATE: ${{ matrix.crate }}
@@ -359,7 +406,28 @@ jobs:
         MIRI_MODEL: ${{ matrix.miri_model }}
       run: |
         set -euo pipefail
-        ./cargo.sh ci execute-miri-cell \
+        /usr/bin/docker run --rm \
+          --workdir "$PWD" \
+          -v /home/runner/work:/home/runner/work \
+          -v /home/runner/.docker-cargo/registry:/root/.cargo/registry \
+          -v /home/runner/.docker-cargo/git:/root/.cargo/git \
+          -e GITHUB_ENV -e GITHUB_PATH -e GITHUB_STEP_SUMMARY -e GITHUB_OUTPUT -e GITHUB_WORKSPACE \
+          -e CI -e GITHUB_ACTIONS -e GITHUB_ACTOR -e GITHUB_REPOSITORY -e GITHUB_SHA -e GITHUB_REF -e GITHUB_EVENT_NAME \
+          -e TOOLCHAIN -e CRATE -e TARGET -e FEATURE_PROFILE -e MIRI_MODEL \
+          -e RUSTFLAGS -e RUSTDOCFLAGS -e MIRIFLAGS \
+          -e CARGO_NET_RETRY -e RUSTUP_MAX_RETRIES \
+          -e ZC_NIGHTLY_RUSTFLAGS -e ZC_NIGHTLY_MIRIFLAGS \
+          -e ZC_SKIP_CARGO_SEMVER_CHECKS \
+          -e GIT_CONFIG_COUNT=1 \
+          -e GIT_CONFIG_KEY_0=safe.directory \
+          -e "GIT_CONFIG_VALUE_0=*" \
+          --entrypoint /bin/bash \
+          -- \
+          "$ZC_CI_IMAGE" \
+          --noprofile \
+          --norc \
+          -p \
+          ./cargo.sh ci execute-miri-cell \
           --event "$GITHUB_EVENT_NAME" \
           --package "$CRATE" \
           --toolchain "$TOOLCHAIN" \
@@ -768,32 +836,39 @@ jobs:
 
         # GitHub can omit a job output at promotion time if its secret scanner
         # produces a false positive. Keep this comparison in expression space
-        # so the large JSON never enters a process environment; a PR's empty
-        # Miri plan is still the nonempty JSON value {"include":[]}.
+        # so the large JSON never enters a process environment. A disabled Miri
+        # plan is still the nonempty JSON value {"include":[]}; the boolean gate
+        # must also be present and canonical before aggregation trusts it.
         - name: Require published planner outputs
-          if: ${{ needs.plan_ci.result == 'success' && (needs.plan_ci.outputs.build_matrix == '' || needs.plan_ci.outputs.miri_matrix == '') }}
+          if: ${{ needs.plan_ci.result == 'success' && (needs.plan_ci.outputs.build_matrix == '' || needs.plan_ci.outputs.miri_matrix == '' || (needs.plan_ci.outputs.miri_enabled != 'true' && needs.plan_ci.outputs.miri_enabled != 'false')) }}
+          shell: /usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS /bin/bash --noprofile --norc -p -euo pipefail -- {0}
           run: exit 1
 
         - name: Require every dependency to succeed
+          # Pin the absolute interpreter and remove Bash startup controls so a
+          # job default, PATH shim, or exported function cannot turn this
+          # required-check assertion into a successful no-op.
+          shell: /usr/bin/env -u BASH_ENV -u ENV -u SHELLOPTS -u BASHOPTS /bin/bash --noprofile --norc -p -euo pipefail -- {0}
           env:
-            EVENT_NAME: ${{ github.event_name }}
             # Do not serialize the entire `needs` object here: job outputs may
             # legitimately approach GitHub's configured output limit, while a
             # Linux process has a much smaller per-environment-value limit.
             # Results stay small regardless of matrix JSON size. Keep the
-            # separate Miri result so the one intentional PR skip is still
-            # identified rather than accepting an arbitrary skipped job.
+            # separate Miri result so a planner-disabled Miri job is identified
+            # rather than accepting an arbitrary skipped dependency.
             RESULTS_JSON: ${{ toJSON(needs.*.result) }}
+            MIRI_ENABLED: ${{ needs.plan_ci.outputs.miri_enabled }}
             MIRI_RESULT: ${{ needs.miri.result }}
           run: |
             set -euo pipefail
-            jq -e --arg event "$EVENT_NAME" --arg miri "$MIRI_RESULT" '
+            /usr/bin/jq -e --arg enabled "$MIRI_ENABLED" --arg miri "$MIRI_RESULT" '
               type == "array" and length > 0 and
-              if $event == "pull_request"
+              if $enabled == "false"
               then $miri == "skipped" and
                    ([.[] | select(. == "skipped")] | length) == 1 and
                    all(.[]; . == "success" or . == "skipped")
-              else $miri == "success" and
+              else $enabled == "true" and
+                   $miri == "success" and
                    all(.[]; . == "success")
               end
             ' <<< "$RESULTS_JSON"

tools/zc/src/cli.rs

@@ -644,7 +644,10 @@ mod tests {
     };
 
     use super::{run, CliError, Command};
-    use crate::execution::{BuildCellSelector, MiriCellSelector};
+    use crate::{
+        execution::{BuildCellSelector, MiriCellSelector},
+        github::{BUILD_MATRIX_OUTPUT, MIRI_ENABLED_OUTPUT, MIRI_MATRIX_OUTPUT},
+    };
 
     fn strings(args: &[&str]) -> Vec<String> {
         args.iter().map(|arg| (*arg).to_owned()).collect()
@@ -896,7 +899,7 @@ mod tests {
     }
 
     #[test]
-    fn github_plan_publishes_both_outputs_from_one_checked_projection() {
+    fn github_plan_publishes_all_outputs_from_one_checked_projection() {
         static NEXT: AtomicU64 = AtomicU64::new(0);
         let unique = NEXT.fetch_add(1, Ordering::Relaxed);
         let directory =
@@ -920,8 +923,9 @@ mod tests {
         .unwrap();
 
         let job_outputs = fs::read_to_string(github_output).unwrap();
-        assert!(job_outputs.starts_with("build_matrix={\"include\":["));
-        assert!(job_outputs.ends_with("miri_matrix={\"include\":[]}\n"));
+        assert!(job_outputs.starts_with(&format!("{BUILD_MATRIX_OUTPUT}={{\"include\":[")));
+        assert!(job_outputs.contains(&format!("{MIRI_MATRIX_OUTPUT}={{\"include\":[]}}\n")));
+        assert!(job_outputs.ends_with(&format!("{MIRI_ENABLED_OUTPUT}=false\n")));
         let artifact_json: serde_json::Value =
             serde_json::from_slice(&fs::read(artifact).unwrap()).unwrap();
         assert_eq!(artifact_json["event"], "pull_request");