Repository navigation
ci: isolate and attest immutable release publishing - #851
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d8bb54a2e1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Review：三项声称基本落地，质量高于同类 PR；4 点需要处理审查范围 修得好的部分
RUNNER_KIND: ${{ runner.environment }}
...
test "$RUNNER_KIND" = github-hosted配合
需要处理的 4 点P1 ——
另外 P2 ——
P2 ——
P3 —— 同一 tag 重跑会串行排队；配合 测试覆盖PR 描述称 21 个 behavioral tests（策略拒绝矩阵、完整字节/清单、上传失败、重跑、篡改、错误来源、无效证明、prerelease 分类）。覆盖面看起来对得上 #168 第六条验收（"合法通过、篡改/未签名/错误仓库或 workflow/错误版本均被拒绝"）。建议在 PR 里贴一次 边界仅静态审查分支内容与 PR 描述。未执行任何构建、未触发 workflow、未验证 GitHub environment/ruleset 的实际配置状态，未读取 secret 值。glibc 兼容性与托管 runner 容量属于"需实测"项，本审查无法替代。 |
|
已逐项处理这轮 review，新增提交
23 个 helper 测试、actionlint、实际本机 ELF 的 check-abi CLI、diff check 和历史/候选/PR 文本 secret scan 均通过。完整测试输出如下；Cargo/image 完整构建、真实签名/immutable release、目标机验证仍未执行。 python3 -m unittest discover -s scripts/release -p 'test_*.py' -v |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44b54dd303
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| permission-administration: read | ||
| permission-environments: read |
There was a problem hiding this comment.
With the documented read-only App configuration, the policy job cannot pass its ruleset audit even when administrators apply the supplied ruleset correctly. GitHub's ruleset API documentation states that bypass_actors is returned only when the caller has write access to the ruleset, but this token requests Administration read only. Consequently, audit_policy() receives rules without that property, and check_policy() rejects them because it requires rule.get('bypass_actors') == [], blocking every release before the build. Reconcile the policy-reader design with this API restriction in both token-minting steps without treating an omitted bypass list as proof that no bypass exists.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
确认成立，已按 GitHub 官方文档核对：bypass_actors 对仅有 Administration-read 的调用者不可见，原有只读 policy App 不能完成完整策略验收。官方契约。
提交 11749e763a 先修复诊断和误导性 setup 文档：字段缺失时明确报告权限/可见性不足，仍然 fail closed；新增回归测试，24 个 helper tests、actionlint、diff/secret scans 均通过。没有将遗漏字段视为 []，也没有提高 App 权限。
完整修复需要 owner 明确批准足够可见性的隔离读取方案，或独立可验证的替代方案；这会改变外部权限边界，本轮没有擅自授予 Administration-write。该 P1 保持未解决，PR body 和 changelog 都已标为发布阻塞。
用户决策（2026-10-30，Asia/Shanghai）：明确选择保持只读 App、保留发布阻塞。本轮不增加 Administration:write，不将缺失 bypass_actors 当作空列表；此 P1 保持未解决，后续另行设计能完整审计且满足权限隔离的方案。
nekomoto911
left a comment
nekomoto911
left a comment
There was a problem hiding this comment.
只读安全评审后 approve（基于 head 11749e76）。
验证到的：no --clobber、assert-new 拒重复 tag（含 draft）、发布后 immutable=true 复核、现场读 tag ruleset 审计、5 个三方 action 全钉官方 commit SHA、仅 publish job 获 id-token、build job 不碰任何 secret、所有 run 块 set -euo pipefail、无 || true/continue-on-error。第二轮新增 check-abi（readelf 拒 GLIBC>2.35、缺版本信息 fail-closed）与对隐藏 bypass_actors 的显式处理都为 fail-closed，无新旁路。
approve 不等于可直接上线，仍需 owner 侧（PR 自己已声明）：
- 打开 immutable releases + 建 tag ruleset + 配
releaseenvironment + 装 policy App。 - P1 卡点：policy App 只有 Administration-read，GitHub 不向其返回 ruleset
bypass_actors→ CI 无法自证 tag ruleset 无人可绕；需 owner 批准一个有 ruleset-write 可见性的 reader 设计或等效可验证方案。 - 历史 tag 仍存旧版 release.yml（带
--clobber、共享 runner）→ 须禁止对老 ref 发布并停用共享 runner 的发布能力。
Official node/CLI releases currently share a persistent runner with E2E, upload onto existing releases with replacement enabled, and provide no signed build provenance. This change builds in fresh GitHub-hosted VMs with read-only access, requires protected tag context and independent environment review, and separates short-lived policy-read, build and publishing identities.
Publication verifies GitHub attestations for node/CLI, an OCI digest and a signed source/version/run manifest, creates a new draft, uploads without overwrite, compares every fully downloaded asset, then publishes and confirms release immutability. Existing drafts/releases fail closed; image consumers use the signed OCI digest. A fail-closed policy checker and tag ruleset template specify immutable releases, non-bypass tag protection and independent release approval. Its currently requested read-only policy token cannot expose the bypass list; the authority blocker below must be resolved before activation.
The build also rejects node/CLI ELF requirements newer than GLIBC 2.35, preserving the Ubuntu 22.04 build ceiling; supported target OS smoke acceptance is still required. Missing environment/ruleset controls fail the policy gate before publication. Same-tag duplicate runs intentionally queue and then reject an existing release.
Validation: 24 behavioral tests passed (policy rejection matrix, complete bytes/inventory, upload failures, reruns, tampering, wrong origin, invalid proofs and prerelease classification and ABI acceptance/rejection); actionlint, diff checks and the required staged/history secret scans passed. Parent review found no blocker in policy, permissions and proof/source flow.
A newly validated P1 blocker remains: GitHub hides ruleset
bypass_actorsunless the policy reader has ruleset-write access. The current Administration-read App candidate therefore cannot complete its audit. Missing visibility now produces an explicit permission error and still fails closed. A sufficient isolated-reader design or independently verifiable alternative needs an owner decision; this change does not elevate App permissions.Operational acceptance remains outstanding: administrators must configure the read-only GitHub App, immutable releases, tag protection and protected environment, prevent old-tag workflow execution on the historical shared runner while preserving incident evidence, confirm hosted build capacity/target OS compatibility, and run a controlled build/sign/publish/consumer-verification exercise. No native Rust build, real signing/release, settings mutation, runner cleanup or production deployment was performed. Existing unsigned versions require consumer-owned exact expiring migration pins; no generic bypass is introduced.
Related: Galxe/mono-grav#165, Galxe/mono-grav#167, Galxe/mono-grav#168, Galxe/mono-grav#169. These issues remain open pending operational acceptance.
Owner decision (2026-10-30, Asia/Shanghai): retain the read-only policy App and keep release publication blocked. Do not grant Administration:write or treat an omitted bypass list as empty. A separate complete-audit design remains follow-up work.