Repository navigation
feat: support configurable device IDs - #236
Open
swarit-stepsecurity wants to merge 4 commits into
Open
swarit-stepsecurity wants to merge 4 commits into
swarit-stepsecurity wants to merge 4 commits into
Conversation
Member
Author
|
@ashishkurmi can you please add copilot review to this PR? |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Persisted cadence can be attributed to the wrong device, and WSL policy reconciliation uses the host identity instead of the guest identity.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Adds configurable device IDs to separate backend identity from machine serials across telemetry, hooks, and managed policies.
Changes:
- Adds configuration, display, and documentation for
device_id. - Applies effective identities to telemetry, WSL scans, and cached scan state.
- Adds regression tests and bumps the version to 1.18.0.
| File | Description |
|---|---|
| README.md | Documents custom IDs and history implications. |
| internal/telemetry/wsl_scan.go | Passes effective host identity to guests. |
| internal/telemetry/telemetry.go | Uses effective identity and scopes inventory cache. |
| internal/state/state.go | Binds cached inventory to device identity. |
| internal/state/device_id_test.go | Tests identity-based inventory resets. |
| internal/rungate/state.go | Records configured identity with cadence. |
| internal/rungate/evaluate.go | Resolves identity and invalidates cached cadence. |
| internal/rungate/evaluate_test.go | Tests override changes and guest precedence. |
| internal/heartbeat/heartbeat.go | Stores configured identity in cadence state. |
| internal/device/device.go | Adds effective device-ID resolution. |
| internal/device/device_test.go | Tests overrides and serial preservation. |
| internal/config/config.go | Loads, prompts for, and displays device IDs. |
| internal/config/config_test.go | Tests loading and preserving device IDs. |
| internal/config/config_nonint_test.go | Tests device IDs supplied through files. |
| internal/buildinfo/version.go | Bumps version to 1.18.0. |
| internal/aiagents/identity/identity.go | Uses configured identity for hooks. |
| internal/aiagents/identity/identity_test.go | Tests overrides with unknown serials. |
| cmd/stepsecurity-dev-machine-guard/main.go | Uses effective identity for reconciliation. |
| CHANGELOG.md | Records the new feature. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| dev := device.Gather(ctx, exec) | ||
| if dev.SerialNumber == "" || dev.SerialNumber == "unknown" { | ||
| log.Warn("hook-state reconcile: device serial unresolved; skipping") | ||
| deviceID := device.ID(dev) |
Comment on lines
+79
to
+82
| if st.ConfiguredDeviceID != configuredID { | ||
| st = heartbeat.RunGate{} | ||
| stOK = false | ||
| } |
This comment was marked as off-topic.
This comment was marked as off-topic.
…ork" This reverts commit f523017.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds optional
device_idin the agent's existing config.json, interactiveconfigure,configure show, andconfigure --from-file. The configured ID is used consistently across telemetry, cadence, run status, rules, AI hooks and managed policies. Missing/blank values retain the machine-derived identity; hardware serial remains inserial_number. WSL guests retain host/distro-derived IDs.Changing the configured ID resets cadence and incremental inventory state. Completion stamps are bound to the effective identity, including forced and failed-check-in paths.
This is agent-side configuration only. No central device-ID editor, backend-managed rename history, or three-change limit is included. The later backend ownership preflight has been removed, so this PR does not require the abandoned central-management backend changes.
Limitations: configure IDs uniquely within a tenant. The agent cannot reliably detect another machine using the same configured ID; duplicate IDs can share the same backend registration. Changing an ID creates a separate registration and does not migrate history or policies.
Dependencies: #243 builds on this feature to stabilize machine identity across root/user runs; #246 builds on that resolver for VDI support. #247 is withdrawn following the decision to retain agent-side configuration.
Validation: original feature/review regression coverage remains. The ownership-check commit was reverted and the resulting diff reviewed; routine CI checks are left to CI. Earlier collision-preflight tests and guarantees no longer apply.