fix(security): isolate reviewer GitHub CLI subprocess environment

[seonghobae]

Closes #175.

RCA

Protected main reviewer GitHub I/O used subprocess.run(..., shell=False) without an explicit child environment and retained raw non-zero child stderr. The gh subprocess could therefore inherit unrelated model/provider/App/cloud credentials, proxy/HOME/launcher configuration, or other future parent authority, and a failing child could echo the explicitly delegated GH_TOKEN into retained diagnostics.

The selected narrow remedy makes the child environment explicit and fail-closed: pinned GH_HOST=github.com, deterministic NO_COLOR=1, optional non-empty PATH, optional explicit GH_TOKEN, and nothing else. Non-zero diagnostics redact the exact delegated token before they can become retained RuntimeError text. Shell-free execution and the existing injectable runner interface remain unchanged.

Test-first lineage

Protected/live base throughout this line: fa62a30f08122778d2db4a27fbb9b99a82dbac9a.

• 1202b9b364791e9829145198e6ec63fd7c00f3a8 — test-only hostile-parent and delegated-token diagnostic contract, committed before production implementation. Its application/reviewer/Security Scan runs were cancelled by branch concurrency and are not promoted to terminal RED evidence.
• 0070ccf6ab06c24569e893195afa420bd496f029 — production least-authority child environment and exact delegated-token redaction.
• 67c3e0fb3d1a19416712cb64d38e40efdac8afe5 — unchanged exact GREEN head, adding the branch contract that absent optional PATH/GH_TOKEN cannot widen the child environment.

Exact current-head proof

For unchanged head 67c3e0fb3d1a19416712cb64d38e40efdac8afe5 on live protected base fa62a30f08122778d2db4a27fbb9b99a82dbac9a:

• application ci run 31521620956, verify job 93879769402: terminal success; the job reports exact head 67c3e0fb3d1a19416712cb64d38e40efdac8afe5 and its exact-checkout, package-manager, install and release verify steps all succeeded;
• reviewer-ci run 31521621119, reviewer job 93879770053: terminal success on the same exact head; reviewer 100% line+branch coverage, 100% docstring gate, authenticated/scanned sandbox image and real no-network CodeGraph sandbox smoke all succeeded;
• protected-base eligible central Security Scan run 31521620960: terminal success. OSV, supported dependency-review, Trivy filesystem and Scorecard jobs completed successfully under central .github revision 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba; OSV/dependency-review/Trivy remain the applicable hard security evidence while Scorecard is posture evidence;
• current formal reviews: 0;
• current inline review threads: 0;
• GitHub reports the content graph mergeable and the PR is Ready for review.

Skipped conditional fallback/reporting steps inside otherwise successful jobs are not promoted to passing evidence; the applicable hard jobs above independently completed successfully. No cancelled predecessor evidence transfers.

Authority boundary

This repair narrows only reviewer gh child-process authority and retained failure diagnostics. Technical GREEN is not independent approval or live-ruleset proof. No merge is authorized until the unchanged exact head independently satisfies actual Noema/CWL governance and any qualifying non-author formal approval requirement. This PR does not provision reviewer authority, publish a release, deploy production, establish KPI/revenue/legal/IP-transfer evidence, choose an outbound license, or make an acquisition-readiness claim.

Summary by CodeRabbit

• 보안 개선

  • GitHub CLI 실행 시 필요한 환경 변수만 제한적으로 전달합니다.
  • 인증 토큰이 오류 메시지에 노출되지 않도록 자동으로 가립니다.
  • 셸 실행을 비활성화해 안전한 명령 실행을 유지합니다.

• 버그 수정

  • 환경 변수와 토큰이 없을 때도 안전한 기본값으로 동작하도록 개선했습니다.

• 테스트

  • 환경 변수 제한, 토큰 보호, 셸 비활성화 동작에 대한 회귀 테스트를 추가했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ae748c9-c608-4edd-a162-d300bc513f80

📥 Commits

Reviewing files that changed from the base of the PR and between 67c3e0f and 2574b82.

📒 Files selected for processing (1)

• reviewer/tests/test_github_io_environment_boundary.py

🚧 Files skipped from review as they are similar to previous changes (1)

• reviewer/tests/test_github_io_environment_boundary.py

---

📝 Walkthrough

Walkthrough

GitHub CLI 자식 프로세스의 환경을 허용 목록으로 제한했습니다. 선택적 PATH와 GH_TOKEN을 조건부로 전달합니다. 실패 진단에서는 위임 토큰을 [REDACTED]로 치환합니다. shell=False와 표준 출력·오류 캡처 동작은 유지됩니다.

Changes

GitHub CLI 환경 경계

Layer / File(s)	Summary
허용 환경과 토큰 제거 reviewer/noema_reviewer/github_io.py	자식 프로세스 환경에 PATH, GH_TOKEN, GH_HOST, NO_COLOR만 포함합니다. 오류 텍스트의 정확한 위임 토큰을 [REDACTED]로 치환합니다.
제한 환경 실행과 회귀 검증 reviewer/noema_reviewer/github_io.py, reviewer/tests/test_github_io_environment_boundary.py	default_runner가 제한된 환경으로 gh를 실행합니다. 테스트는 허용 변수, 선택적 값의 부재, 토큰 비노출, shell=False를 검증합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related issues

• security(automation): isolate hourly commercial-readiness GitHub CLI subprocess authority #108 — 허용된 변수만 GitHub CLI subprocess 환경에 전달하는 동일한 격리 목표를 다룹니다.

Possibly related PRs

• ContextualWisdomLab/noema#109 — PATH, GH_TOKEN, GH_HOST, NO_COLOR만 허용하는 GitHub CLI 환경 제한과 테스트를 구현합니다.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 GitHub CLI subprocess 환경 격리라는 주요 변경을 정확하고 간결하게 설명합니다.
Linked Issues check	✅ Passed	구현과 회귀 테스트가 허용 환경 변수, 토큰 보존·마스킹, shell-free 실행 요구사항을 충족합니다. [#175]
Out of Scope Changes check	✅ Passed	변경 사항은 GitHub CLI subprocess 격리와 관련 회귀 테스트에 한정되며, 범위를 벗어난 변경은 확인되지 않습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/reviewer-gh-cli-environment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

reviewer/tests/test_github_io_environment_boundary.py (1)

83-85: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

[REDACTED] 대체 결과를 검증하십시오.

현재 검증은 원본 토큰이 없다는 사실만 확인합니다. 토큰을 빈 문자열로 제거하는 회귀도 통과할 수 있습니다. PR 계약을 고정하려면 [REDACTED]가 오류 상세에 포함되는지 검증하십시오.

수정 예시

     detail = str(raised.value)
     assert token not in detail
     assert "authentication failed" in detail
+    assert "retry token=[REDACTED]" in detail

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@reviewer/tests/test_github_io_environment_boundary.py` around lines 83 - 85,
Update the assertion for detail derived from raised.value to verify that the
literal "[REDACTED]" appears in the error details, while retaining the existing
checks that the original token is absent and the authentication failure message
is present.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@reviewer/tests/test_github_io_environment_boundary.py`:
- Around line 83-85: Update the assertion for detail derived from raised.value
to verify that the literal "[REDACTED]" appears in the error details, while
retaining the existing checks that the original token is absent and the
authentication failure message is present.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 928832e6-ace5-47da-afbb-4ae59cf3fe0a

📥 Commits

Reviewing files that changed from the base of the PR and between fa62a30 and 67c3e0f.

📒 Files selected for processing (2)

• reviewer/noema_reviewer/github_io.py
• reviewer/tests/test_github_io_environment_boundary.py

[seonghobae]

Superseded by protected successor #193. Fresh proof immediately before closure: protected main is 0715ba52c32cc94b59f91f74e742657aed822421, produced by merging #193 exact head 883bf1e1ea3cc0456b9c7f96dcbf003462109c0b. This stale PR's current head 2574b8290901f6387d66bb00d4841e12eaf31a79 is 5 commits ahead / 11 behind that protected main, but its only two changed paths are already byte-identical to protected source: reviewer/noema_reviewer/github_io.py blob d3910833bb83639b89c10bb92fbd196d71d9e65f and reviewer/tests/test_github_io_environment_boundary.py blob 4eaaa83f517930ed1227c3037e55fd9d43d36d5f. The protected regression includes the stronger exact diagnostic assertion retry token=[REDACTED]. No predecessor checks/reviews are transferred; this PR is being closed only because its complete current semantic/file delta is protected by #193.