ralon 0.1.0

Filesystem policy for AI coding agents: kernel-enforced write protection driven by an agent.lock file
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

name: CI

on:
  push:
    branches: [master]
  pull_request:

env:
  CARGO_TERM_COLOR: always

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy, rustfmt
      - run: cargo fmt --check
      - run: cargo clippy --all-targets -- -D warnings
      - run: cargo test
      # What this runner's kernel is actually capable of. The enforcement tests
      # report that they tested nothing rather than failing here, because a
      # hosted runner's own sandbox may leave no backend available.
      - if: runner.os == 'Linux'
        run: cargo run --quiet -- status

  enforcement:
    # The real bypass attempts, in a container permissive enough to offer the
    # backends. RALON_REQUIRE_BACKEND turns "nothing was tested" into a
    # failure, so this job cannot pass by silently skipping.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - name: Attempt every bypass, against every available backend
        run: |
          docker run --rm \
            --security-opt seccomp=unconfined \
            --security-opt apparmor=unconfined \
            -v "$PWD:/work" -w /work \
            -e CARGO_TARGET_DIR=/tmp/target \
            -e RALON_REQUIRE_BACKEND=1 \
            rust:1-bookworm \
            sh -c 'cargo run --quiet -- status; cargo test --test enforcement -- --nocapture'