fix(tasks): restrict modal VMs to custom images - #70656
Conversation
![hex-security-app[bot]](https://avatars.githubusercontent.com/in/2665233?s=60&v=4){kind=small}
|
Reviews (1): Last reviewed commit: "fix(tasks): restrict modal VMs to custom..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
5ed3667 to
13d34f6
Compare
🤖 CI report
|
| File | Patch | Uncovered changed lines |
|---|---|---|
products/tasks/backend/temporal/process_task/activities/get_task_processing_context.py |
0.0% | 366–367, 372, 389–390 |
products/tasks/backend/temporal/process_task/activities/tests/test_get_task_processing_context.py |
0.0% | 647, 655, 726 |
products/tasks/backend/temporal/build_image/activities.py |
25.0% | 140, 327, 358 |
🤖 Agents: add a test covering the lines above, or note why under "How did you test this code?". Machine-readable gap list: the patch-coverage artifact on this run (gh run download 29324684513 -n patch-coverage), or the coverage-data block at the end of this comment.
Per-product line coverage (touched products)
| Product | Coverage | Lines |
|---|---|---|
tasks |
█████████████░░░░░░░ 66.8% |
24,759 / 37,057 |
Report-only. Patch coverage = changed backend lines covered vs origin/master. Sorted lowest first.
Known gaps: lines covered only by Temporal tests show as uncovered; core line numbers may drift if master changed the same file.
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 1 · PR risk: 0/10 |
Generated-By: PostHog Code Task-Id: bf2043a7-7d19-4dac-9d50-c0f1780de97a fix(tasks): widen metric labels for mypy Generated-By: PostHog Code Task-Id: bf2043a7-7d19-4dac-9d50-c0f1780de97a fix(tasks): address custom image rollout reviews Generated-By: PostHog Code Task-Id: bf2043a7-7d19-4dac-9d50-c0f1780de97a fix(tasks): require custom images for modal VMs Generated-By: PostHog Code Task-Id: bf2043a7-7d19-4dac-9d50-c0f1780de97a
654165c to
a6520a7
Compare
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security-sensitive VM sandbox gating fix, but all reviewer concerns (hex-security-app, greptile-apps, veria-ai) were concretely addressed in the diff and confirmed resolved, with a final clean security re-review; author is on the owning team with strong familiarity.
- Author wrote 100% of the modified lines and has 134 merged PRs in these paths (familiarity STRONG).
- 👍 on the PR from greptile-apps[bot], hex-security-app[bot].
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✓ | no deny categories matched |
| size | ✓ | 39L, 4F substantive, 96L/7F incl. docs/generated/snapshots — within ceiling |
| tier | ✓ | T1-agent / T1c-medium (96L, 7F, single-area, fix) |
| stamphog 2.0.0b3 | .stamphog/policy.yml @ dac9236 · reviewed head a6520a7 |
2 participants
Problem
The Modal VM rollout flag currently allows every manually created cloud run onto the VM runtime. The rollout is intended to cover manual runs that actually need a custom sandbox image.
Changes
user_createdrun can use the Modal VM runtime through the feature flag.