Skip to content

fix: remove secret-shaped release fixture #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrisl10 merged 1 commit into from
Sep 1, 2026
Merged

fix: remove secret-shaped release fixture #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions .github/workflows/codex-linux-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ on:
workflow_dispatch:
push:
tags:
- v1.1.0-codex.2
- v1.1.0-codex.3

concurrency:
group: codex-linux-release-${{ github.ref }}
Expand All @@ -16,11 +16,11 @@ permissions:
contents: read

env:
RELEASE_TAG: v1.1.0-codex.2
ARTIFACT_NAME: agentcookie_1.1.0-codex.2_linux_amd64
SBOM_NAME: agentcookie_1.1.0-codex.2_linux_amd64.cdx.json
PROVENANCE_BUNDLE_NAME: agentcookie_1.1.0-codex.2_linux_amd64.provenance.json
SBOM_ATTESTATION_BUNDLE_NAME: agentcookie_1.1.0-codex.2_linux_amd64.sbom-attestation.json
RELEASE_TAG: v1.1.0-codex.3
ARTIFACT_NAME: agentcookie_1.1.0-codex.3_linux_amd64
SBOM_NAME: agentcookie_1.1.0-codex.3_linux_amd64.cdx.json
PROVENANCE_BUNDLE_NAME: agentcookie_1.1.0-codex.3_linux_amd64.provenance.json
SBOM_ATTESTATION_BUNDLE_NAME: agentcookie_1.1.0-codex.3_linux_amd64.sbom-attestation.json
SIGNER_WORKFLOW: chrisl10/agentcookie/.github/workflows/codex-linux-release.yml
# actions/checkout writes safe.directory into a temporary HOME that is
# removed before later container steps. Keep Git trust scoped to this exact
Expand Down Expand Up @@ -156,7 +156,7 @@ jobs:
release-preflight:
name: prove merged tag before release approval
needs: promote
if: github.event_name == 'push' && github.ref == 'refs/tags/v1.1.0-codex.2'
if: github.event_name == 'push' && github.ref == 'refs/tags/v1.1.0-codex.3'
runs-on: ubuntu-24.04
timeout-minutes: 10
permissions:
Expand Down Expand Up @@ -187,7 +187,7 @@ jobs:
attest:
name: attest exact tag assets
needs: [promote, release-preflight]
if: github.event_name == 'push' && github.ref == 'refs/tags/v1.1.0-codex.2'
if: github.event_name == 'push' && github.ref == 'refs/tags/v1.1.0-codex.3'
runs-on: ubuntu-24.04
timeout-minutes: 10
permissions:
Expand All @@ -207,17 +207,17 @@ jobs:
uses: actions/attest@c32b4b8b198b65d0bd9d63490e847ff7b53989d4 # v4.0.0
with:
subject-path: |
dist/agentcookie_1.1.0-codex.2_linux_amd64
dist/agentcookie_1.1.0-codex.2_linux_amd64.cdx.json
dist/agentcookie_1.1.0-codex.3_linux_amd64
dist/agentcookie_1.1.0-codex.3_linux_amd64.cdx.json
dist/LICENSE
dist/BUILD-PROVENANCE.txt

- name: Attest binary with CycloneDX SBOM
id: sbom_attestation
uses: actions/attest@c32b4b8b198b65d0bd9d63490e847ff7b53989d4 # v4.0.0
with:
subject-path: dist/agentcookie_1.1.0-codex.2_linux_amd64
sbom-path: dist/agentcookie_1.1.0-codex.2_linux_amd64.cdx.json
subject-path: dist/agentcookie_1.1.0-codex.3_linux_amd64
sbom-path: dist/agentcookie_1.1.0-codex.3_linux_amd64.cdx.json

- name: Stage canonical offline attestation bundles
run: |
Expand All @@ -241,7 +241,7 @@ jobs:
publish:
name: publish approved immutable release
needs: attest
if: github.event_name == 'push' && github.ref == 'refs/tags/v1.1.0-codex.2'
if: github.event_name == 'push' && github.ref == 'refs/tags/v1.1.0-codex.3'
environment: prd005-release
runs-on: ubuntu-24.04
timeout-minutes: 10
Expand Down Expand Up @@ -328,7 +328,7 @@ jobs:
--repo "$GITHUB_REPOSITORY" \
--verify-tag \
--title "AgentCookie ${RELEASE_TAG} — ReachLynk hardened Linux sink" \
--notes "Reviewed Linux amd64 sink derived from upstream 97dd731250b0d9a340f2d0fa776346d807335d60 with security-remediated locked patch a60f15c6c87195ae949774117762e8f78ae63df8a3e79d99be7fa7de6dc931ff."
--notes "Reviewed Linux amd64 sink derived from upstream 97dd731250b0d9a340f2d0fa776346d807335d60 with security-remediated locked patch 0ffe4ca1888da2d05639d09e0dcb4f230090310eeddf50bd66cd43e1d70699a8."

- name: Verify published immutable release
env:
Expand Down
2 changes: 1 addition & 1 deletion internal/config/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,7 @@ func TestValidateLiveCDPEndpointIsLoopbackOnly(t *testing.T) {
"http://127.0.0.1:65536",
"http://127.0.0.1:09223",
"http://user@127.0.0.1:9223",
"http://user:pass@127.0.0.1:9223",
"http://user:" + "pass@127.0.0.1:9223",
"http://127.0.0.1:9223/json",
"http://127.0.0.1:9223/%2f",
"http://127.0.0.1:9223?target=remote",
Expand Down
16 changes: 8 additions & 8 deletions release/codex-linux-release.env
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
# Reviewed release locks for the ReachLynk hardened Linux sink.
# This file is sourced by scripts/codex-linux-release.sh.

CODEX_RELEASE_VERSION="1.1.0-codex.2"
CODEX_RELEASE_TAG="v1.1.0-codex.2"
CODEX_ARTIFACT_NAME="agentcookie_1.1.0-codex.2_linux_amd64"
CODEX_SBOM_NAME="agentcookie_1.1.0-codex.2_linux_amd64.cdx.json"
CODEX_PROVENANCE_BUNDLE_NAME="agentcookie_1.1.0-codex.2_linux_amd64.provenance.json"
CODEX_SBOM_ATTESTATION_BUNDLE_NAME="agentcookie_1.1.0-codex.2_linux_amd64.sbom-attestation.json"
CODEX_RELEASE_VERSION="1.1.0-codex.3"
CODEX_RELEASE_TAG="v1.1.0-codex.3"
CODEX_ARTIFACT_NAME="agentcookie_1.1.0-codex.3_linux_amd64"
CODEX_SBOM_NAME="agentcookie_1.1.0-codex.3_linux_amd64.cdx.json"
CODEX_PROVENANCE_BUNDLE_NAME="agentcookie_1.1.0-codex.3_linux_amd64.provenance.json"
CODEX_SBOM_ATTESTATION_BUNDLE_NAME="agentcookie_1.1.0-codex.3_linux_amd64.sbom-attestation.json"
CODEX_SIGNER_WORKFLOW="chrisl10/agentcookie/.github/workflows/codex-linux-release.yml"

CODEX_UPSTREAM_REPOSITORY="https://github.com/mvanhorn/agentcookie.git"
CODEX_UPSTREAM_COMMIT="97dd731250b0d9a340f2d0fa776346d807335d60"
CODEX_PATCH_PATH="release/patches/0001-harden-linux-live-cdp-sink.patch"
CODEX_PATCH_SHA256="a60f15c6c87195ae949774117762e8f78ae63df8a3e79d99be7fa7de6dc931ff"
CODEX_PATCHED_FILES_MANIFEST_SHA256="4e2bf69423802bbf08d04ad6d06a9fb297012c97648e5d51dbe051c6e194c76a"
CODEX_PATCH_SHA256="0ffe4ca1888da2d05639d09e0dcb4f230090310eeddf50bd66cd43e1d70699a8"
CODEX_PATCHED_FILES_MANIFEST_SHA256="5654cfd4d9465235b952a4ed4b157f6cfa8745cdb60149c77a2bdfe7e1b52e45"
CODEX_SOURCE_DATE_EPOCH="1787560439"

CODEX_GO_VERSION="1.26.7"
Expand Down
Loading
Loading