Repository navigation
harden(release): sterile publish job, no repo/dist code under OIDC - #186
marcohost33-maker wants to merge 2 commits into
Conversation
… context The publish job holds `id-token: write` but used to check out the repository, set up Python, pip-install the wheel and import it. A wheel may ship a .pth file whose import lines run at every later interpreter start, i.e. inside the OIDC context (PyPI Trusted Publishing security model). Now `build` (no OIDC) proves source/version/tag/commit identity as before and records SHA256SUMS of dist/ as a job OUTPUT (Actions control plane, not inside the artifact). `publish` only downloads the artifact, runs `sha256sum -c --strict` against that output and checks the exact file set, then attests and uploads -- no checkout, no setup-python, no repository code. Base patch: 007acc2 Claude revision 2026-09-30 (REV 3.2). Tests: contract + release-gate 77 passed; old pypi.yml against the new contract: 2 failed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…exact-set check (#186 review) Aegis round on 579af7e (P2-3): removing the `diff <(ls -A ...)` exact-set line, or adding `python3 -c`, `pip3 install`, `uv run --with dist/*.whl` to the publish job all stayed green. The contract now rejects any interpreter or package tool token in the publish block and pins the exact-set line. Mutations (each alone): all four now fail 1 test; unmodified 6 passed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Pruefrunde 1 (Aegis, unabhaengig) @579af7e: Workflow MERGE-REIF. 13 Manipulationsfaelle (Wheel, Extra-/Dot-Datei, Unterordner, Symlink-Extra, leere/kaputte Digests, Output-Injektion via Dateiname) -> alle BLOCK; Identitaetspruefungen in build identisch zu vorher. |
This branch has not been deployed
1 participant
Was
Der
publish-Job haeltid-token: write, checkte aber das Repo aus, installierte das Wheel per pip und importierte es. Eine.pth-Datei im Wheel liefe so im OIDC-Kontext.Neu:
build(ohne OIDC) prueft Identitaet wie bisher und schreibtSHA256SUMSvondist/als Job-Output (Actions-Steuerebene, nicht im Artefakt).publishlaedt nur das Artefakt, prueftsha256sum -c --strict+ exakte Dateimenge, attestiert, laedt hoch -- kein checkout, kein setup-python, kein Repo-Code.Belege @ 579af7e
tests/test_pypi_workflow_contract.py+ release-gate: 77 passed.pypi.ymlgegen den neuen Vertrag -> 2 failed.check_release_pins.pyexit 0.Unabhaengig von #184-PR, beide beruehren aber den Release-Pfad; Merge-Reihenfolge egal (disjunkte Dateien). Release/Tag/PyPI-Konfiguration bleibt Marco-Gate. Merge erst nach unabhaengiger Pruefrunde.
Herkunft: 007acc2 Claude-Revision 2026-09-30 (REV 3.2).
🤖 Generated with Claude Code