Fix candidate runner hook filename

[gitcommit90]

Fix

GitHub Runner only accepts job-started hooks with a supported script extension. Rename the constrained Phase 2 hook to .sh, update its service path, and retain enforcement coverage.

Verification

• Phase 2 focused tests: 14/14 passed
• runner online with only the dedicated label
• Stable, LXC 112, and the website untouched

🤖 Generated with Claude Code

Summary by CodeRabbit

• Security

  • Strengthened deployment safeguards by validating repository, workflow, job, event, and commit details before allowing a deployment job to start.
  • Restricted execution to successful pushes to the main branch from the trusted repository.
  • Ensured the runner startup protection is owned and configured correctly.

• Reliability

  • Improved handling of invalid or unreadable event data by rejecting unauthorized runs before execution.

[coderabbitai]

Warning

Review limit reached

@gitcommit90, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 36 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 348af736-dcfe-46f6-ba50-3a39a3d35526

📥 Commits

Reviewing files that changed from the base of the PR and between a1fc772 and 2a59f05.

📒 Files selected for processing (2)

• ops/dress-rehearsal/1helm-candidate-install
• test/phase2-candidate.mjs

📝 Walkthrough

Walkthrough

The runner start hook now uses a root-owned shell script that validates the authorized workflow context. The systemd override and Phase 2 candidate test use and verify the .sh hook path.

Changes

Runner hook validation and wiring

Layer / File(s)	Summary
Runner hook context guard ops/dress-rehearsal/runner-job-started.sh, docs/dress-rehearsal.md	The hook validates the repository, workflow, job, event payload, branch, origin, status, and commit SHA. The documentation identifies the hook as root-owned.
Hook path wiring and boundary coverage ops/dress-rehearsal/runner.service.override.conf, test/phase2-candidate.mjs	The systemd override uses runner-job-started.sh. The candidate test reads and verifies the configured path.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RunnerService
  participant runner-job-started.sh
  participant WorkflowEventPayload
  RunnerService->>runner-job-started.sh: invoke job-start hook
  runner-job-started.sh->>WorkflowEventPayload: read workflow_run JSON
  WorkflowEventPayload-->>runner-job-started.sh: return event context
  runner-job-started.sh-->>RunnerService: allow or reject execution

Loading

Possibly related PRs

• gitcommit90/1Helm#67: Introduced the runner hook and systemd configuration that this change renames and updates.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description states the fix and verification results but omits the required Summary, Type of change, Release notes, acceptance ledger, and post-merge sections.	Add the missing template sections and complete the required checkboxes, release notes, acceptance ledger, and post-merge information.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: fixing the candidate runner hook filename.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/candidate-runner-hook-extension

---

_{Comment @coderabbitai help to get the list of available commands.}