Repository navigation
security(release): require npm release tag to match protected main tip - #81
Draft
Pavithran-R-A wants to merge 3 commits into
Draft
Pavithran-R-A wants to merge 3 commits into
Pavithran-R-A wants to merge 3 commits into
Conversation
2 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Production hardening (no publication performed)
The release workflow previously checked the package version, release tag and checked-out
GITHUB_SHA, but did not verify that the tag resolved to the current protectedmainrevision. A published GitHub Release pointing at a different commit could therefore reach the npm OIDC publication step if its source tests passed.This change fails closed unless the release event, tag ref, package repository, peeled local tag, checkout SHA, and read-only remote
maintip all agree. The remote is read directly from the expected HTTPS GitHub repository, not the checkout's configurableorigin; network or malformed Git results fail without printing child stderr. The README/releasing checklist now identifies this additional publication invariant.Added executable negative controls for wrong event/ref, wrong tag, wrong repository, wrong GitHub SHA, stale/unrelated commit, malformed/missing/duplicate remote response. Existing publication and credential policies remain intact.
Safety: This is a draft PR for review. No npm package, GitHub Release, BharatCode model call, customer PR or remote patch was published. It cannot by itself qualify the product for production: current-source real-model test, 10-task benchmark, external draft-PR publication, registry bootstrap/provenance, and Docker-host matrix still need independent proof.
Required to merge: all six Node22/24 Linux/Windows/macOS CI jobs, 8/8 scripted customer journeys, security review, and operator approval. Do not bypass branch protections.