Repository navigation
Expose installed lock identity and bind Go gates to action outputs - #165
Conversation
Expose the verified absolute lock path alongside versions and SHA256, keep single-version parsing in prepare, and require Go gates to consume expected version/path/hash through the environment. Retain deprecated prepare-backed adapters for current main workflow calls. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
Superseded — see the current review report for commit
|
Require output-derived version and lock identity in every Go gate. Remove the repository wrapper, positional adapter, gon adapter and their fixtures; retain the strict environment contract and existing install checks. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| The Go gate is action-local and environment-only; there is no repository-level | ||
| wrapper or positional lockfile fallback. Callers must wire the installed action's | ||
| version and lock-identity outputs. The main-tip workflow's old wrapper calls are | ||
| not executable until the coordinated caller amendment lands; moving-tag | ||
| promotion remains blocked until that migration is complete. |
There was a problem hiding this comment.
🟠 Bug: This commit deletes scripts/verify-locked-go.sh, but .github/workflows/release.yaml in this same tree still calls bash _workflows/scripts/verify-locked-go.sh 12 times (lines 293, 297, 439, 442, 766, 770, 1052, 1055, 1323, 1326, 1582, 1585). _workflows is checked out at job.workflow_sha (release.yaml:175), so those calls hit a missing file. Also, gon-source.sh build (release.yaml:445) now runs without EXPECTED_*/LOCK_PATH and fails closed. If this merges before the caller migration, every release gate on main breaks. Either migrate release.yaml in this PR or keep the deprecated wrapper until that lands. Confidence: high.
Superseded — see the current review report for commit
|
Use neutral fixture and tool provenance, remove process history and stale helper references, and replace opaque diagnostic labels with descriptive names. Refresh the pinned fixture metadata checksum; artifact locks and certificate identities remain unchanged. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Superseded — see the current review report for commit
|
| The action-local Go gate is environment-only. Callers supply the installed | ||
| action's version and lock-identity outputs; positional lockfile lookup is not supported. |
There was a problem hiding this comment.
🟠 Bug (Prior — still present, high confidence): This PR still deletes scripts/verify-locked-go.sh, but .github/workflows/release.yaml in this tree still runs bash _workflows/scripts/verify-locked-go.sh 12 times (lines 293, 297, 439, 442, 766, 770, 1052, 1055, 1323, 1326, 1582, 1585). _workflows is checked out at job.workflow_sha, so every release on main that runs from this commit hits file-not-found. gon-source.sh build (line 445) also fails closed because it gets no EXPECTED_GO_VERSION/EXPECTED_LOCK_SHA256/LOCK_PATH. This commit also removed the doc caveat that said those calls are not executable, so these docs no longer mention the breakage. Migrate release.yaml in this PR, or keep the wrapper until the caller amendment lands.
General PR Review: Expose installed lock identity and bind Go gates to action outputsBlocking Issues: 1 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe PR adds a The new commits since
I scanned the full PR diff for security and correctness; the incremental artifact was complete, with no dropped paths. No repo-local criteria loaded, so only the base criteria applied. The PR body now calls the Security IssuesNone found. Correctness Issues
SuggestionsNone. Prompt for AI agentsReviewed commit: |
DECLINE as a blocker (accepted staged window; fail-closed never silent-pass; v4 pinned pre-actions, zero @main consumers)
…e actions (#159) ## Why GitHub-hosted runner images may still trust the compromised eMudhra intermediates until patched images roll out (actions/runner-images#15018). Release jobs must (a) measure, deny, and redirect TLS trust and (b) install only hash-locked tools — before any credential. Both mechanisms ship as composite actions in this repo (ca-trust-guard, locked-tools); this PR adopts them in release.yaml and removes the per-job inline installs. ## What - Every guarded job (9) opens with the `_workflows` checkout at `job.workflow_sha` (`persist-credentials: false`; validate-inputs gains `contents: read` (checkout uses the default read-scoped token; not persisted)), then runs **ca-trust-guard** and, in the 6 tool-using jobs, **locked-tools** via **local paths** (`./_workflows/.github/actions/...`). Workflow, action code, fixtures, and canonical tool lock are always the same commit — no self-referential action SHAs (enforced by a CI assertion). - Ordering: `_workflows` checkout → guard → locked-tools (`id: tools`; preflight's stays conditional on the Go checks) → caller checkout + event-SHA verification → secrets. notify-release-failure remains exempt, with no bootstrap there. - **Module gates** (6 sites) run the action-local `verify-locked-go.sh module` with expected version, lock hash, and lock path taken from the locked-tools step's **outputs** (one reader of the lock per job); standalone version gates and the inline gon step are removed (the action asserts the runtime version; gon builds inside the action). - Per-job install/verify/gon-checkout steps and the four transitional wrappers (`install-tool.{sh,ps1}`, `gon-source.sh`, `verify-locked-go.sh`) are deleted; `verify-release-checkout.sh`, `setup-release-buildx.sh`, `derive-iam-role-name.sh` stay. - `ci.yaml` covers release.yaml; `test-tool-integrity.py` enforces local-path ordering, output-bound gate env, tool lists, the notify exemption, and the no-self-SHA rule. ## Evidence - Action canaries (#160/#161) plus the full-release canary through this amended branch on baton-github-test (run linked below when complete) — local-path resolution, ordering, and output wiring exercised end-to-end on all three OSes. - reviewer-claude gate: APPROVE (amendment review: ordering per job, env wiring incl. skip-safe JSON, rebase resolution, negative controls). **Staged rollout:** safe to promote `v4` only after this lands — see #165 for the window details. --------- Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
Why
Caller Go gates must use the version and lock identity returned by the locked-tools action, not rediscover expectations from a separate workflow checkout. The action remains the single owner of lock metadata parsing.
What
lock_path: the absolute path of the exact lock used (action-local canonical file by default, resolved reviewed override when supplied). Preserve per-tool outputs,versions, andlock_sha256.sort -u) sanity in prepare.verify-locked-go.shconsumeEXPECTED_GO_VERSION,EXPECTED_LOCK_SHA256, andLOCK_PATH. It hashes bytes to check identity but never parses lock versions. Missing/partial expectations, drift, nonlocal toolchain mode, and version mismatch fail closed.GOTOOLCHAIN=local go list -mwith workspace discovery disabled.Intentional staged rollout (verifiable): main-tip release.yaml's 12 old wrapper calls are unresolved until the coordinated caller amendment lands in #159 (branch steve.gontzes/sh10-probe-report). No live release path is affected: the v4 tag still points at e643283 (pre-dates these actions), every sampled connector consumes @v4, and code search finds zero @main/@sha callers; the failure mode in the window is fail-closed (file-not-found / missing env), never a silent pass. Do not promote v4 between this merge and #159 landing.
Verification
make test-scripts: pass, including 27 integrity fixtures (one native-Windows-only skip locally), 23 image/update tests, workflow contracts, and both guard Bash suites.go vet ./...andgo test -count=1 ./...: pass with local/offline settings.go list -m.lock_path, preserved version/hash outputs, metadata-reader ownership, missing env, hash drift, runtime mismatch, go-list failure/disagreement, and rejection of positional lockfile fallback.git diff --check: pass..github/workflows/release.yamlis byte-unchanged.