feat(weave): Allow a whitelisted set of private network IP addresses for remote scoring - #7707
Merged
Merged
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Adds WF_SCORING_WORKER_REMOTE_SCORER_ALLOWED_PRIVATE_CIDRS and its accessor. Operators list networks that are exempt from the scoring worker's non-routable address deny, so a deployment whose scorers sit on an internal network can reach them without waiving https enforcement. The accessor returns raw strings and never raises, matching every other accessor in this module. The scoring worker parses and validates the entries, rejecting malformed networks and any network overlapping the ranges that can never be exempted. Inert on its own: nothing reads the accessor until the worker change lands. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mscavezze-cw
force-pushed
the
mike/remote_scorer_host_policy_100
branch
from
August 7, 2026 22:21
0183298 to
480b3fc
Compare
Drop two paragraphs that belong at the enforcement point rather than on the accessor: which entries the worker rejects, and what happens when a broad network is combined with host validation disabled. Both are documented where that logic lives. Name wf_scoring_worker_remote_scorer_allow_insecure_http directly instead of calling it "the insecure-http waiver". Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
One test asserted five separate behaviors in sequence, so a regression in the first one masked the rest. Split it so each names exactly what it covers: the unset default, an empty value, comma splitting, whitespace stripping, and skipping empty entries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mscavezze-cw
changed the title
The five split tests differed only in the env value and the expected list, so fold them into one parametrize table keyed on exactly those two things. None encodes an absent variable, which is distinct from an empty one. Adds a single-network case, which the sequence of multi-entry cases never covered on its own. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Keep each id next to the data it names instead of in a trailing ids list that readers have to count positions against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…tring Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
mscavezze-cw
marked this pull request as ready for review
August 7, 2026 22:41
mscavezze-cw
enabled auto-merge (squash)
August 7, 2026 22:54
gtarpenning
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Allow a whitelisted set of private network IP addresses for remote scoring. Specify using an env var containing comma-separated CIDR (eg 10.0.0.0/8).
Testing
Unit tests