Repository navigation
fix(security): verify inferred tags still exist in GHCR - #3533
Conversation
@coderabbitai review |
|
|
|
Warning Review limit reachedNext included review available in 44 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: ASSERTIVE Plan: Team Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@codex review |
User evaluation @
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 590d0014f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
User evaluation @
|
@coderabbitai review |
|
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fad1a5e85e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
User evaluation @
|
@coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- PR diff summary ---'
git diff --stat HEAD^ HEAD
echo
echo '--- Changed files ---'
git diff --name-status HEAD^ HEAD
echo
echo '--- Changed shell and workflow outlines ---'
fd -t f . scripts .github docs 2>/dev/null \
| rg '(report-publish-workflow-signing-revisions\.sh|test-publish-workflow-signing-revisions\.sh|validate-main\.yaml)$' \
| xargs -r -n1 ast-grep outline --items all
echo
echo '--- Full patch ---'
git diff --find-renames --find-copies HEAD^ HEAD -- \
scripts .github docsLength of output: 9946 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)"
printf '%s\n' "--- Merge base: ${base} ---"
git diff --stat "${base}..HEAD"
git diff --name-status "${base}..HEAD"
echo '--- Guard outline ---'
ast-grep outline scripts/guard-shared-publish-workflow-pin.sh --items all || true
echo '--- Test outline ---'
ast-grep outline scripts/tests/test-shared-publish-workflow-pin-guard.sh --items all || true
echo '--- Guard parser and validation section ---'
nl -ba scripts/guard-shared-publish-workflow-pin.sh | sed -n '250,415p'
echo '--- Test helpers and concrete-SHA cases ---'
nl -ba scripts/tests/test-shared-publish-workflow-pin-guard.sh | sed -n '1,210p'
echo '--- Complete PR diff ---'
git diff --find-renames --find-copies "${base}..HEAD" -- scripts .github docsLength of output: 1871 🏁 Script executed: #!/bin/bash
set -euo pipefail
base="77bc673782dc1f184b7bcabcb0b69967f0d1e0d6"
echo '--- Report, lines 1-280 ---'
sed -n '1,280p' scripts/report-publish-workflow-signing-revisions.sh
echo '--- Behavioral test, lines 1-360 ---'
sed -n '1,360p' scripts/tests/test-publish-workflow-signing-revisions.sh
echo '--- Workflow permissions context ---'
grep -n -A18 -B8 'validate-main\|permissions:\|packages:' .github/workflows/validate-main.yaml || true
echo '--- Complete PR patch ---'
git diff --find-renames --find-copies "${base}..HEAD" -- \
.github/workflows/validate-main.yaml \
scripts/report-publish-workflow-signing-revisions.sh \
scripts/tests/test-publish-workflow-signing-revisions.shLength of output: 63320 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo '--- Report: version selection and resolver ---'
sed -n '260,860p' scripts/report-publish-workflow-signing-revisions.sh
echo '--- Report: main and output contract ---'
sed -n '860,1040p' scripts/report-publish-workflow-signing-revisions.sh
echo '--- Consumer manifest locations and OCIRepository selectors ---'
grep -r -n -A30 -B5 \
'oci://ghcr.io/devantler-tech/.*\|publish-\(app\|manifests\).*\.yaml@' \
--include='*.yaml' . 2>/dev/null | head -1200
echo '--- Test helper definitions and cases 9-22 ---'
grep -n -A220 -B12 \
'^make_exact_root\|^bm_root=\|^# 1[0-9]\.\|^# 2[0-2]\.' \
scripts/tests/test-publish-workflow-signing-revisions.shLength of output: 143319
I found no correctness issues in the inspected changes. The report now fails closed when GHCR metadata is unavailable or a candidate tag no longer exists. It preserves exact manifest-tag matching. It also refuses higher or ambiguous registry versions that lack proven publication evidence. The workflow grants I did not execute repository scripts in this sandbox. You are interacting with an AI system. |
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d51860d835
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Current-head evaluation: the hermetic suite passes all 28 behavioral cases, including the new |
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
@coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
base="$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)"
printf '%s\n' "--- HEAD ---" "$(git rev-parse HEAD)"
printf '%s\n' "--- Merge base ---" "$base"
printf '%s\n' "--- Changed files ---"
git diff --name-status "$base..HEAD"
printf '%s\n' "--- Changed-file outlines ---"
for file in \
scripts/report-publish-workflow-signing-revisions.sh \
scripts/tests/test-publish-workflow-signing-revisions.sh \
.github/workflows/validate-main.yaml \
docs/publish-workflow-signing-revisions.md
do
if [ -f "$file" ]; then
printf '%s\n' "### $file"
ast-grep outline "$file" --items all || true
fi
done
printf '%s\n' "--- Pull request patch ---"
git diff --find-renames --find-copies "$base..HEAD" -- \
scripts/report-publish-workflow-signing-revisions.sh \
scripts/tests/test-publish-workflow-signing-revisions.sh \
.github/workflows/validate-main.yaml \
docsLength of output: 24562 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Resolver version patterns and selection ---'
nl -ba scripts/report-publish-workflow-signing-revisions.sh | sed -n '360,790p'
printf '%s\n' '--- Resolver output and caller behavior ---'
nl -ba scripts/report-publish-workflow-signing-revisions.sh | sed -n '930,1035p'
printf '%s\n' '--- Workflow job context ---'
rg -n -A55 -B10 'validate-shared-publish-pin:' .github/workflows/validate-main.yaml
printf '%s\n' '--- Prerelease-related behavioral cases and fixtures ---'
rg -n -i -C4 'prerelease|pre-release|alpha|beta|rc[0-9.-]*|strict_re|loose_re|sort -V' \
scripts/tests/test-publish-workflow-signing-revisions.sh \
scripts/report-publish-workflow-signing-revisions.shLength of output: 1119 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Resolver version patterns and selection (lines 360-790) ---'
sed -n '360,790p' scripts/report-publish-workflow-signing-revisions.sh
printf '%s\n' '--- Resolver output and caller behavior (lines 930-1035) ---'
sed -n '930,1035p' scripts/report-publish-workflow-signing-revisions.sh
printf '%s\n' '--- Workflow job context ---'
rg -n -A55 -B10 'validate-shared-publish-pin:' .github/workflows/validate-main.yaml || true
printf '%s\n' '--- Prerelease-related behavioral cases and fixtures ---'
rg -n -i -C4 'prerelease|pre-release|alpha|beta|rc[0-9.-]*|strict_re|loose_re|sort -V' \
scripts/tests/test-publish-workflow-signing-revisions.sh \
scripts/report-publish-workflow-signing-revisions.sh || trueLength of output: 94787 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- Remaining registry and post-selection logic (lines 754-850) ---'
sed -n '754,850p' scripts/report-publish-workflow-signing-revisions.sh
printf '%s\n' '--- Consumer discovery and source-to-package mapping ---'
sed -n '35,245p' scripts/report-publish-workflow-signing-revisions.sh
printf '%s\n' '--- Checked-in GHCR OCIRepository selectors ---'
rg -n -A24 -B4 \
'url:[[:space:]]*oci://ghcr\.io/devantler-tech/|ref:[[:space:]]*$|tag:[[:space:]]*|semver:[[:space:]]*' \
-g '*.yaml' -g '*.yml' .
printf '%s\n' '--- Current report workflow invocation and test workflow invocation ---'
rg -n -A16 -B6 \
'report-publish-workflow-signing-revisions\.sh|test-publish-workflow-signing-revisions\.sh' \
-g '*.yaml' -g '*.yml' .Length of output: 71659
I found no correctness issues in the inspected changes. The resolver now requires current GHCR package evidence before it attributes a signing revision. It fails closed when package metadata is unavailable, when a selected tag was deleted, and when registry precedence is higher or ambiguous. The resolver preserves exact manifest-tag spelling. It also normalizes partial registry versions before it checks equal precedence. The I did not execute repository scripts in this sandbox. You are interacting with an AI system. |
Summary
validate-mainreport the narrowpackages: readpermission and pin that authority with a contract testVerification
packages: nonebash scripts/tests/test-publish-workflow-signing-revisions.sh— 28 cases passshellcheck scripts/report-publish-workflow-signing-revisions.sh scripts/tests/test-publish-workflow-signing-revisions.shactionlint .github/workflows/validate-main.yamlgit diff --checkThe token-cleared local operator credential lacks
read:packages; the actual report refused all four consumers by name and exited non-zero. The main-branch workflow now grants its job-scopedGITHUB_TOKENthe required package-read authority.Fixes #3331