fix(attestation): bind reusable workflow source to OIDC identity - #2164
seonghobae wants to merge 10 commits into
Conversation
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review Please review exact head |
|
The review will check the callee identity claims, trusted checkout inputs, fail-closed JWT validation, and the scope of
|
|
@coderabbitai review Please review exact prerequisite head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== HEAD =='
git rev-parse HEAD
git status --short
printf '%s\n' '== requested commit object =='
git cat-file -t 874f44f9cf7047a18d9815d1677e625f5c7a8c67
printf '%s\n' '== workflow candidates =='
fd -t f 'exact-artifact-sbom-attestation\.yml$' .
printf '%s\n' '== YAML workflow outline =='
fd -t f 'exact-artifact-sbom-attestation\.yml$' . -x ast-grep outline {} --items all
printf '%s\n' '== identity-sensitive references =='
rg -n -i -C 4 '(job_workflow_(ref|sha)|ACTIONS_ID_TOKEN_REQUEST_(URL|TOKEN)|id-token\s*:|github\.workflow_sha|actions/checkout|github-hosted|issuer|audience|jwt|oidc)' -g '*.yml' -g '*.yaml' -g '*.md' .
printf '%s\n' '== tests and documentation candidates =='
fd -t f . . | rg -i '(exact.artifact|attestation|oidc|workflow).*\.(py|sh|yml|yaml|md|json)$' | head -200Length of output: 151741 🏁 Script executed: #!/bin/bash
set -euo pipefail
workflow=$(fd --hidden --type f '^exact-artifact-sbom-attestation\.yml$' . | head -n1)
test_identity="tests/test_reusable_attestation_workflow_identity.py"
test_contract="tests/test_exact_artifact_sbom_attestation_contract.py"
test_regressions="tests/test_exact_artifact_sbom_review_regressions.py"
printf 'workflow=%s\n' "$workflow"
printf '%s\n' '== workflow outline =='
ast-grep outline "$workflow" --items all
printf '%s\n' '== workflow numbered source =='
nl -ba "$workflow" | sed -n '1,520p'
printf '%s\n' '== targeted test outlines =='
ast-grep outline "$test_identity" --items all
ast-grep outline "$test_contract" --items all
ast-grep outline "$test_regressions" --items all
printf '%s\n' '== OIDC identity test source =='
nl -ba "$test_identity" | sed -n '1,520p'
printf '%s\n' '== attestation contract identity-related assertions =='
rg -n -C 5 '(oidc|OIDC|workflow_sha|workflow_ref|checkout|permissions|github-hosted|audience|issuer|JWT|token)' \
"$test_contract" "$test_regressions"
printf '%s\n' '== exact workflow source references in tests =='
rg -n -C 3 'exact-artifact-sbom-attestation\.yml' testsLength of output: 43248 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '== exact-head diff from stated protected base =='
git diff --no-ext-diff --unified=80 d6cf5726cebfd031d0d11989b6fa34aab43452d0..874f44f9cf7047a18d9815d1677e625f5c7a8c67 -- \
.github/workflows/exact-artifact-sbom-attestation.yml \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
ARCHITECTURE.md \
CHANGELOG.d/20260913-reusable-attestation-workflow-identity.md
printf '%s\n' '== every checkout/ref source in attestation workflow =='
rg -n -C 5 '(uses:\s*actions/checkout|^\s*repository:|^\s*ref:|workflow_sha|workflow_ref|github\.workflow_sha|inputs\.source_sha)' \
.github/workflows/exact-artifact-sbom-attestation.yml
printf '%s\n' '== full attestation permission contract section =='
nl -ba tests/test_exact_artifact_sbom_attestation_contract.py | sed -n '115,185p'
printf '%s\n' '== all direct source-execution surfaces before verifier checkout =='
nl -ba .github/workflows/exact-artifact-sbom-attestation.yml | sed -n '64,170p'
nl -ba .github/workflows/exact-artifact-sbom-attestation.yml | sed -n '234,340p'
printf '%s\n' '== all occurrences of resolver or trusted verifier directories =='
rg -n -C 2 '(trusted-intake|trusted-signer|workflow-identity|verify_exact_artifact_sbom_handoff)' \
.github/workflows/exact-artifact-sbom-attestation.yml testsLength of output: 99900 🤖 web_search executed:
Length of output: 18513
I found no blocking issue in the requested trust boundary.
The implementation matches GitHub’s reusable-workflow claim model. I completed static inspection only. I did not execute repository code or tests. Hosted checks remain the required runtime evidence.
|
|
@coderabbitai review Please review exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='73f5b9d3b2664521faf9033743d94d2746ddb12f'
base='78393ea901efc0d57b35dd1e383e473425b7c1da'
printf '%s\n' '== exact objects and topology =='
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge-base=%s\n' "$(git merge-base "$head" "$base")"
printf '%s\n' '== head changes relative to protected main =='
git diff-tree --no-commit-id --name-status -r "$base" "$head"
printf '%s\n' '== merge-only resolution changes relative to each parent =='
git diff-tree --cc --no-commit-id --name-status -r "$head"
printf '%s\n' '== workflow candidate =='
fd --hidden --type f '^exact-artifact-sbom-attestation\.yml$' .
printf '%s\n' '== workflow identity-sensitive source at exact head =='
git show "$head:.github/workflows/exact-artifact-sbom-attestation.yml" | nl -ba | \
sed -n '1,380p'
printf '%s\n' '== workflow checkout and claim reference inventory =='
git show "$head:.github/workflows/exact-artifact-sbom-attestation.yml" | \
rg -n -C 4 '(job_workflow_(ref|sha)|github\.workflow_sha|ACTIONS_ID_TOKEN_REQUEST_(URL|TOKEN)|id-token:|actions/checkout|repository:|ref:|github-hosted|issuer|audience|jwt|JWT|curl|jq)'
printf '%s\n' '== focused test source candidates =='
for f in \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py; do
if git cat-file -e "$head:$f" 2>/dev/null; then
printf '%s\n' "-- $f --"
git show "$head:$f" | rg -n -C 4 '(job_workflow_(ref|sha)|workflow_sha|workflow_ref|id-token|checkout|github-hosted|issuer|audience|OIDC|oidc)' || true
fi
done
printf '%s\n' '== differences from predecessor in owned trust-boundary files =='
git diff --no-ext-diff --unified=30 \
874f44f9cf7047a18d9815d1677e625f5c7a8c67 "$head" -- \
.github/workflows/exact-artifact-sbom-attestation.yml \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
ARCHITECTURE.md \
CHANGELOG.d/20260913-reusable-attestation-workflow-identity.mdLength of output: 37835 🏁 Script executed: #!/bin/bash
set -euo pipefail
head='73f5b9d3b2664521faf9033743d94d2746ddb12f'
first_parent='874f44f9cf7047a18d9815d1677e625f5c7a8c67'
second_parent='78393ea901efc0d57b35dd1e383e473425b7c1da'
printf '%s\n' '== adopted protected-main delta: first parent to merge head =='
git diff-tree --no-commit-id --name-status -r "$first_parent" "$head"
printf '%s\n' '== merge head patch against first parent =='
git diff --no-ext-diff --unified=40 "$first_parent" "$head" -- \
.github/workflows/exact-artifact-sbom-attestation.yml \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py \
CHANGELOG.d \
docs \
ARCHITECTURE.md
printf '%s\n' '== exact first-parent vs merge workflow identity semantic diff =='
git diff --no-ext-diff --word-diff=plain "$first_parent" "$head" -- \
.github/workflows/exact-artifact-sbom-attestation.yml
printf '%s\n' '== parent file differences that touch workflow or OIDC terms =='
git diff --no-ext-diff --name-only "$first_parent" "$second_parent" | \
while IFS= read -r f; do
case "$f" in
*.yml|*.yaml|*.py|*.md)
if git show "$second_parent:$f" 2>/dev/null | rg -q '(exact-artifact|job_workflow|OIDC|oidc|checkout)'; then
printf '%s\n' "$f"
fi
;;
esac
doneLength of output: 13067
I found no blocking issue. The commit has these two parents:
Its merge base with protected Git reports no merge-resolution delta. The exact head does not alter The reconciliation adopts protected-main changes only in the contextual-orchestrator sidecar files, its ADR, and its changelog entry. Those changes do not modify the reusable-workflow verifier identity, trusted checkout repository or ref, OIDC claim checks, or intake permissions. This review is limited to static source and Git topology inspection. I did not execute repository code or tests. Exact-head CI and independent approval remain required before merge authorization.
|
|
@coderabbitai review Exact head changed to |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='834d5163cb306a540a9064931a2694a730b9cd3f'
base='828eaaefb0cc97bba4da63eb9270447476d26710'
previous='73f5b9d3b2664521faf9033743d94d2746ddb12f'
printf '%s\n' '== exact objects and checked-out HEAD =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base=%s\n' "$(git merge-base "$head" "$base")"
printf '%s\n' '== delta from stated protected base =='
git diff-tree --no-commit-id --name-status -r "$base" "$head"
printf '%s\n' '== merge resolution delta =='
git diff-tree --cc --no-commit-id --name-status -r "$head"
printf '%s\n' '== exact base diff for owned identity files =='
git diff --no-ext-diff --unified=60 "$base" "$head" -- \
.github/workflows/exact-artifact-sbom-attestation.yml \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
ARCHITECTURE.md \
CHANGELOG.d/20260913-reusable-attestation-workflow-identity.md
printf '%s\n' '== semantic delta from immediate predecessor in trust-boundary workflow =='
git diff --no-ext-diff --word-diff=plain "$previous" "$head" -- \
.github/workflows/exact-artifact-sbom-attestation.yml
printf '%s\n' '== reusable workflow source at exact head =='
git show "$head:.github/workflows/exact-artifact-sbom-attestation.yml" | nl -ba | sed -n '1,420p'
printf '%s\n' '== identity-sensitive workflow inventory =='
git show "$head:.github/workflows/exact-artifact-sbom-attestation.yml" | \
rg -n -C 5 '(job_workflow_(ref|sha)|github\.workflow_sha|ACTIONS_ID_TOKEN_REQUEST_(URL|TOKEN)|id-token:|actions/checkout|repository:|ref:|github-hosted|issuer|audience|jwt|JWT|curl|jq|persist-credentials)'
printf '%s\n' '== focused static test assertions at exact head =='
for f in \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py; do
if git cat-file -e "$head:$f" 2>/dev/null; then
printf '%s\n' "-- $f --"
git show "$head:$f" | rg -n -C 4 '(job_workflow_(ref|sha)|github\.workflow_sha|id-token|checkout|github-hosted|issuer|audience|OIDC|oidc|permissions)' || true
fi
doneLength of output: 105171
I found one blocking trust-boundary issue. JWT signature validation is missing. In The checks fail on malformed JSON and mismatched decoded fields. They do not fail on a syntactically valid JWT payload with an invalid or absent signature. The trusted checkout ref derives from that unverified Validate the token signature, issuer, audience, and applicable time claims with GitHub’s published OIDC keys before writing The remaining reviewed controls are correct:
This was a static review. I did not execute repository code or tests. You are interacting with an AI system. |
Adopt protected main@91be6442906c7b6b4f600272c953699708394327 without force-push while preserving the reusable-attestation workflow identity owner delta. The intervening main files do not overlap the six owner files.
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
head='b5966eaa6237c9260823969cbae6f64000cb08d7'
base='91be6442906c7b6b4f600272c953699708394327'
pr='2164'
repo='ContextualWisdomLab/.github'
printf '%s\n' '== exact objects and topology =='
printf 'checked_out=%s\n' "$(git rev-parse HEAD)"
git cat-file -t "$head"
git cat-file -t "$base"
git show -s --format='head=%H%nparents=%P%nsubject=%s' "$head"
printf 'merge_base=%s\n' "$(git merge-base "$head" "$base")"
printf 'base_is_ancestor=%s\n' "$(git merge-base --is-ancestor "$base" "$head" && echo yes || echo no)"
printf 'head_is_ancestor_of_base=%s\n' "$(git merge-base --is-ancestor "$head" "$base" && echo yes || echo no)"
printf '%s\n' '== merge-resolution delta =='
git diff-tree --cc --no-commit-id --name-status -r "$head"
printf '%s\n' '== exact head delta from protected main =='
git diff-tree --no-commit-id --name-status -r "$base" "$head"
printf '%s\n' '== first-parent and protected-main relation =='
first_parent=$(git show -s --format='%P' "$head" | awk '{print $1}')
second_parent=$(git show -s --format='%P' "$head" | awk '{print $2}')
printf 'first_parent=%s\nsecond_parent=%s\n' "$first_parent" "$second_parent"
printf 'base_is_second_parent=%s\n' "$([ "$second_parent" = "$base" ] && echo yes || echo no)"
printf '%s\n' '== protected-main changes adopted by merge head =='
git diff-tree --no-commit-id --name-status -r "$first_parent" "$head"
printf '%s\n' '== first-parent changes retained by merge head =='
git diff-tree --no-commit-id --name-status -r "$base" "$head"
printf '%s\n' '== identity owner file candidates in exact-head delta =='
git diff --no-ext-diff --name-only "$base" "$head" | rg -i '(exact-artifact|attestation|reusable.*identity|workflow.*identity|20260913-reusable)' || true
printf '%s\n' '== exact owner-file delta relative to first parent =='
git diff --no-ext-diff --name-status "$first_parent" "$head" -- \
.github/workflows/exact-artifact-sbom-attestation.yml \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py \
docs/doctoring/exact-artifact-sbom-attestation.md \
ARCHITECTURE.md \
CHANGELOG.d/20260913-reusable-attestation-workflow-identity.md
printf '%s\n' '== reusable workflow trust-boundary inventory at exact head =='
git show "$head:.github/workflows/exact-artifact-sbom-attestation.yml" | \
rg -n -C 4 '(job_workflow_(ref|sha)|github\.workflow_sha|ACTIONS_ID_TOKEN_REQUEST_(URL|TOKEN)|id-token:|actions/checkout|repository:|ref:|github-hosted|issuer|audience|jwt|JWT|persist-credentials)'
printf '%s\n' '== identity test assertions at exact head =='
for f in \
tests/test_reusable_attestation_workflow_identity.py \
tests/test_exact_artifact_sbom_attestation_contract.py \
tests/test_exact_artifact_sbom_review_regressions.py; do
if git cat-file -e "$head:$f" 2>/dev/null; then
printf '%s\n' "-- $f --"
git show "$head:$f" | rg -n -C 3 '(job_workflow_(ref|sha)|github\.workflow_sha|id-token|checkout|github-hosted|issuer|audience|OIDC|oidc|permissions)' || true
fi
done
printf '%s\n' '== GitHub PR state and commit list =='
gh pr view "$pr" --repo "$repo" --json number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,mergeable,commits \
--jq '{number,state,isDraft,headRefName,headRefOid,baseRefName,baseRefOid,mergeStateStatus,mergeable,commits:[.commits[]|{oid:.oid,parents:[.parents[].oid],messageHeadline:.messageHeadline}]}' || trueLength of output: 20506
I found one blocking issue in the current exact head. The OIDC resolver still does not validate the JWT signature or time claims. Both The trusted checkout uses Validate the token signature with GitHub’s published OIDC keys before using any claim. Validate the issuer, audience, and applicable time claims as part of that verification. Apply the control in both resolver steps. The protected-main adoption has the expected current topology:
The six owner files have no delta relative to the first parent. They preserve the current static controls:
The commit graph confirms an ordinary forward merge and 0-behind ancestry at the inspected commits. The GitHub PR metadata query did not return commit data, so I could not independently verify remote push history or GitHub’s live mergeability state. You are interacting with an AI system. |
1 participant
Scope
Repairs the cross-repository reusable-workflow identity defect tracked by #1228 and establishes the prerequisite trust boundary for #2162. The canonical exact-artifact attestation workflow resolves its own called-workflow identity from GitHub OIDC
job_workflow_ref+job_workflow_shabefore trusted verifier checkout; callergithub.workflow_shais not used as callee authority.Current authority
b5966eaa6237c9260823969cbae6f64000cb08d7.main:91be6442906c7b6b4f600272c953699708394327.mainis a direct merge parent and the branch is 0-behind by construction.34966986415, SAST34966986628, Security Scan34966986455, Agent Review Runtime Quality34966986465, CodeQL PR34966986712; all are non-terminal at this receipt. No predecessor verdict transfers to this SHA.APPROVEDreview is claimed.Reconciliation lineage
Protected
mainadvanced from828eaaefb0cc97bba4da63eb9270447476d26710to91be6442906c7b6b4f600272c953699708394327. Fresh compare showed 27 main-side commits since the former owner head and no path overlap between the intervening main files and this PR's six owned attestation-identity files. Commitb5966eaa6237c9260823969cbae6f64000cb08d7therefore adopts current protected main by an ordinary two-parent merge, preserving both histories without force push or destructive rebase. #2166 was then separately advanced onto this new parent rather than leaving the descendant on stale authority.Trust boundary
Both verifier and signer jobs request a fresh runner OIDC token using a fixed audience, require GitHub issuer and
github-hostedrunner identity, require the exact central reusable-workflow path, require full 40-hexjob_workflow_sha, require the same SHA suffix injob_workflow_ref, and checkout the trusted verifier only at that resolved SHA. Mutable refs, wrong issuer/audience/path/runner, malformed SHA, or disagreement between the OIDC claims fail before trusted source is materialized.The verifier job keeps only the permissions required to read caller artifacts and identify its own called workflow; the signer independently repeats identity resolution before attestation authority is used.
Integration boundary
#2166 is non-force stacked on this exact head and must not be treated as immutable authority until this prerequisite normally integrates. Keep Draft until current-head gates and then-live review governance are admissible. No self-approval, force push, destructive rebase, protection bypass, synthetic status, mutable-ref dependency, or gate weakening is authorized.