ci(release): guard the dispatch, fail closed on re-publish, attest the payload - #112
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
lidge-jun
force-pushed
the
codex/release-dispatch-hardening
branch
from
September 9, 2026 14:50
61ca6f7 to
87f1db4
Compare
…e payload Three publication risks in the release train, closed: - workflow_dispatch published whatever the selected ref's HEAD was at run time. A required expected_sha input plus a main-only dispatch guard now refuse to publish an unaudited or moved commit. - Re-dispatching an already-released version silently overwrote the shipped tarball via upload --clobber. A preflight now refuses a pre-existing tag (dispatch path) or a release that already carries assets, and the upload drops --clobber so a duplicate asset name fails loudly. A zero-asset release is treated as an incomplete attempt of the same publish and resumed. - The tarball had SHA256SUMS but nothing binding those sums to the builder identity. npm gets this from Trusted Publishing; the non-npm equivalent is actions/attest-build-provenance (SHA-pinned v4.2.2) over dist-artifacts/, backed by new id-token/attestations grants. Post-publish verification now also rejects an empty release-notes body. actionlint: clean (the two SC2129 style notes pre-date this change, same steps shifted down).
lidge-jun
force-pushed
the
codex/release-dispatch-hardening
branch
from
September 9, 2026 15:11
87f1db4 to
9d3159e
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Hardens
release.ymlagainst the three publication risks a non-npm artifact actually has. codexclaw is not npm-published (private: true); its distribution is GitHub Releases + tags + the plugin payload tarball, so npm-specific gates (Trusted Publishing, dist-tags, registry version checks) deliberately do not apply — this PR ports their equivalents.workflow_dispatchpublishes whatever the selected ref's HEAD is at run time. A new requiredexpected_shainput plus arefs/heads/main-only dispatch check refuse to publish an unaudited or moved commit. (opencodex equivalent:release-dispatch-guard.cjs; here a plain shell guard, no new script surface.)gh release uploadloses--clobber, so a duplicate asset name fails loudly instead of silently overwriting the payload users installed. A zero-asset pre-existing release is treated as an incomplete earlier attempt and resumed.actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8(v4.2.2, SHA-pinned) overdist-artifacts/, with new workflow-levelid-token: write+attestations: writegrants. This binds the payload, SHA256SUMS, and the candidate manifest to the workflow run identity.Also: post-publish verification now rejects an empty release-notes body (it previously only counted assets).
Out of scope (deliberate)
--generate-notesstays; the non-empty-body check is the floor.Verification
actionlint .github/workflows/release.yml— no findings on the new steps (two SC2129 style notes pre-date this change; same steps, shifted line numbers).gate.mjsOK.set -euo pipefail.