Repository navigation
fix(release-gate): nested shell publishers + OIDC allowlist (#184) - #185
Open
marcohost33-maker wants to merge 2 commits into
Open
marcohost33-maker wants to merge 2 commits into
marcohost33-maker wants to merge 2 commits into
Conversation
…#184) Two layers against the #184 bypass (`bash -c 'twine --verbose upload'` in an unlisted workflow was classified as "no publisher"): 1. Credential boundary: every job granting `id-token: write` must be in OIDC_ALLOWLIST; allowlisted release jobs must deploy to environment `pypi`; workflow-level grants, unreadable permissions and publish-secret references fail closed. Shell text can never be parsed completely (curl, wrappers), so the OIDC grant is the boundary the gate actually controls. 2. Defence in depth: publish_evidence descends into the script argument of sh/bash/dash/zsh/ksh/ash -c (combined flags, -o opt, --long) and of eval, bounded depth; an untokenisable or too-deep nested script counts as publishing. Base patch: 007acc2 Claude answer 2026-09-30 (liouscope_184_oidc-allowlist). Nested descent + tests added here. Discrimination: disabling the descent turns all 7 nested tests red; full suite 1618 passed (1 pre-existing env failure: stale installed dist 0.5.0 vs 0.6.0.dev0 in test_version_single_source). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…permission forms (#185 review) Aegis round on 7a1c373 (P2-1): the nested-shell descent missed `bash -eo pipefail -c`, GitHub's own `bash --noprofile --norc -eo pipefail`, `bash -c -- '...'`, `--rcfile/--init-file FILE -c`. `_shell_c_script` now follows bash option parsing (o-bundles consume their value, value-taking long options, `--` ends options, operand after a c flag is the script); a c flag without an operand raises -> counted as publishing. Also (P3-2/P3-3): publish secrets via `secrets['..']`/`secrets[".."]` and `toJSON(secrets)`, `secrets: inherit` on a job, `id-token` scope key matched case-insensitively, allowlisted jobs must list permissions explicitly. Tests: release-gate files 103 passed; against 7a1c373 13 of the new tests fail (the script-file control passes on both). Gate on repo: exit 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Owner
Author
|
Pruefrunde 1 (Aegis, unabhaengig, read-only) @7a1c373 -> NICHT MERGE-REIF, behoben in c5ea225:
Merge erst nach Pruefrunde 2 gegen c5ea225 (sicherheitsnaher Waechter, Schablone A7). |
Owner
Author
|
Entscheid Marco 2026-10-01 (E1001-S2-01), nur vermerkt: Environment |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #184.
Was
id-token: writemuss inOIDC_ALLOWLISTstehen (pypi.yml/publish,scorecard.yml/analysis); allowlisted Release-Jobs muessen auf Environmentpypideployen. Workflow-Level-Grants, unlesbarepermissionsund Secret-Referenzen*PYPI*|*TWINE*|*PUBLISH*fallen fail-closed.publish_evidencesteigt in das Skript-Argument vonsh|bash|dash|zsh|ksh|ash -c(auch-ec,-o pipefail -c,--noprofile -c) undevalab, Tiefe begrenzt; nicht tokenisierbar oder zu tief = zaehlt als Publisher.Belege @ 7a1c373
tests/test_release_gate_oidc_allowlist.py+ review-findings: 89 passed lokal.test_version_single_source(lokal veraltete installierte Dist 0.5.0, unabhaengig von diesem PR).python .github/scripts/check_release_pins.py-> exit 0 auf dem Repo-Stand.Restgrenze (bewusst)
Statische Shell-Erkennung bleibt unvollstaendig (
curlan die Upload-API, Wrapper-Skripte). Die tragende Grenze ist PyPI Trusted Publishing gebunden anpypi.yml+ Environmentpypiohne Legacy-Token -- diese PyPI-/Environment-Konfiguration ist Marco-Gate (007acc2 REV 3.1).Herkunft: Basis-Patch 007acc2 (Claude, 2026-09-30); Abstieg + Tests hier ergaenzt. Merge erst nach unabhaengiger Pruefrunde gegen diesen Kopf.
🤖 Generated with Claude Code