From 86170c0bc25b8fcc81404547557f074a452ee1a8 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 1 Sep 2026 18:21:13 +0500 Subject: [PATCH] fix(security): the self-fetch authenticates, and the ledger names 0.1.15 The called-workflow source fetch ran anonymously because the repository is public -- which held until GitHub's unauthenticated fetch path failed every consumer for 77 minutes and recovered on its own (#77). The fetch now carries the ambient token in the temp repository's local config, keeping the retry-and-fallback ladder as defense in depth. The release ledger gains the 0.1.15 heading the advisory sweep flagged (#79), describing what the tag actually shipped. Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF --- .github/workflows/private-security-bundle-free.yml | 9 +++++++++ CHANGELOG.md | 9 +++++++++ 2 files changed, 18 insertions(+) diff --git a/.github/workflows/private-security-bundle-free.yml b/.github/workflows/private-security-bundle-free.yml index 980438d..56f0968 100644 --- a/.github/workflows/private-security-bundle-free.yml +++ b/.github/workflows/private-security-bundle-free.yml @@ -76,11 +76,20 @@ jobs: env: WORKFLOW_REPOSITORY: ${{ job.workflow_repository }} WORKFLOW_SHA: ${{ job.workflow_sha }} + FETCH_TOKEN: ${{ github.token }} run: | set -euo pipefail source_root="$RUNNER_TEMP/private-security-bundle-source" git init --quiet "$source_root" git -C "$source_root" remote add origin "https://github.com/${WORKFLOW_REPOSITORY}.git" + # Authenticate the fetch with the ambient token. The repository is + # public, so anonymous worked -- until 2026-08-31, when GitHub's + # unauthenticated fetch path failed every consumer for 77 minutes + # (#77) while authenticated fetches of the same pin succeeded. The + # header lives in the temp repository's local config, never on the + # command line, and dies with $RUNNER_TEMP. + auth_header="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$FETCH_TOKEN" | base64 -w0)" + git -C "$source_root" config http.extraheader "$auth_header" # Retry, and fall back to protocol v0. # # Measured on a fleet host: `git -c protocol.version=2 ls-remote` diff --git a/CHANGELOG.md b/CHANGELOG.md index 969a66f..fd2b242 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,15 @@ The project follows Semantic Versioning. ## [Unreleased] +## [0.1.15] - 2026-08-31 + +- `docker-build.yml`: reusable BuildKit image build whose layer cache + outlives the runner (registry cache on ghcr by default, `gha` and `none` + backends), registered across the catalog with an infra example. +- `security-bundle` (free): the called-workflow source fetch retries and + falls back to protocol v0, and evidence uploads only when the scan ran. +- Dependabot pin-registry synchronization for the bumped action set. + ## [0.1.14] - 2026-08-30 - Enable Corepack's pnpm and Yarn shims before activating the caller-pinned