Skip to content

Commit be62cfc

Browse files
codeforestercodeforester
authored
security: define release-path code owners (#498)
## Summary - add CODEOWNERS coverage for release workflows, VERSION, packaging metadata, locks, and release validators - document the independent-review and emergency-recovery controls for production releases - prepare the repository for the matching protected-main and `v*` tag rulesets ## Validation - `UV_CACHE_DIR=/private/tmp/base-cli-uv-cache uv run --extra dev pytest -q tests/test_security_documentation.py tests/test_validate_docs.py` - Ruff and `git diff --check` pass After this merges, apply the repository ruleset changes from #484: one approval, code-owner review, last-push approval, and immutable `v*` tags. Relates to #484.
1 parent 10c29d5 commit be62cfc

2 files changed

Lines changed: 47 additions & 6 deletions

File tree

‎.github/CODEOWNERS‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
# Release-path changes require review from the maintainers responsible for
2+
# package integrity. The protected-branch ruleset requires an approval from a
3+
# reviewer other than the last pusher.
4+
/.github/workflows/package.yml @codeforester @rameshulugar
5+
/.github/workflows/issue-branch-policy.yml @codeforester @rameshulugar
6+
/.github/CODEOWNERS @codeforester @rameshulugar
7+
/VERSION @codeforester @rameshulugar
8+
/requirements/release.in @codeforester @rameshulugar
9+
/requirements/release.txt @codeforester @rameshulugar
10+
/scripts/validate_package_artifact.py @codeforester @rameshulugar
11+
/scripts/validate_release_docs.py @codeforester @rameshulugar
12+
/scripts/validate_release_metadata.py @codeforester @rameshulugar
13+
/scripts/validate_release_provenance.py @codeforester @rameshulugar
14+
/scripts/validate_release_ref.py @codeforester @rameshulugar
15+
/scripts/verify_pypi_metadata.py @codeforester @rameshulugar
16+
/scripts/verify_release_assets.py @codeforester @rameshulugar
17+
/scripts/generate_release_metadata.py @codeforester @rameshulugar
18+
/scripts/release_metadata_helpers.py @codeforester @rameshulugar
19+
/docs/releasing.md @codeforester @rameshulugar

‎docs/releasing.md‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,31 @@ Production releases use a matching annotated tag such as `v0.1.0`, created from
2020
updates, and tags that do not exactly match `v${VERSION}` are rejected before
2121
publication. The workflow fetches the complete trusted `main` history so an
2222
ancestor check fails closed instead of relying on shallow checkout state.
23-
The active default-branch ruleset also requires one approving pull-request
24-
review, approval from someone other than the last pusher, strict up-to-date
25-
status checks, and the policy, quality, runtime, and consumer checks listed in
26-
the repository ruleset. Deletion and non-fast-forward updates are disabled.
23+
The default-branch and `v*` tag rulesets are release prerequisites. Before a
24+
production tag is created, an independent maintainer must verify in the live
25+
repository settings that the default branch requires one approving pull-request
26+
review from someone other than the last pusher, strict up-to-date status checks,
27+
and the policy, quality, runtime, and consumer checks listed in the ruleset.
28+
The same verification must confirm that tag deletion and non-fast-forward
29+
updates are disabled and that no unreviewed bypass actor is configured. This
30+
document describes the required controls; it does not treat a ruleset as active
31+
until that live readback has been recorded in the release evidence.
32+
33+
Release-path changes are additionally covered by `.github/CODEOWNERS`, including
34+
the package workflows, `VERSION`, the hash-locked release toolchain, the
35+
artifact/provenance validators, and this release procedure. CODEOWNERS is a
36+
review-routing control, not enforcement by itself: the protected-branch
37+
ruleset must require the matching owner review and protect the CODEOWNERS file.
38+
The independent reviewer must rerun the quality and release gates before a
39+
production tag is created. The tag ruleset must protect `v*` tags from deletion
40+
and force updates; bypass actors must be intentionally empty.
41+
42+
If a maintainer credential is suspected to be compromised, pause publication,
43+
revoke the affected token or OIDC trust, preserve the workflow run and review
44+
evidence, and rotate the release version rather than moving an existing tag.
45+
Restore access only after an independent maintainer has reviewed the ruleset,
46+
environment approvals, trusted-publisher claims, and the exact artifact
47+
digests.
2748

2849
## Validation workflow
2950

@@ -64,8 +85,9 @@ the exact reviewed wheel, sdist, `SHA256SUMS`, `SBOM.spdx.json`, and
6485
`RELEASE-BOM-ROW.json` downloaded from the build job. GitHub-generated
6586
comparison notes are supplemented by the
6687
dated section in `CHANGELOG.md`; the tagged release is rejected when `VERSION`
67-
or that section does not match the tag. Published tags and release assets are
68-
immutable. Before creating a release, the workflow verifies that the tag still
88+
or that section does not match the tag. Once the live `v*` tag ruleset has been
89+
verified, published tags and release assets are treated as immutable. Before
90+
creating a release, the workflow verifies that the tag still
6991
resolves to the reviewed commit, that the wheel and sdist have provenance and
7092
SBOM attestations for that tag and commit, and that the release metadata binds
7193
the same version, commit, and assets. If an existing GitHub Release is found,

0 commit comments

Comments
 (0)