Repository navigation
🐛 fix(release): verify locks and isolate patches - #12
Merged
Merged
Conversation
The writer previously checked the merged diff, so either artifact could modify files owned by the other. Check each patch against HEAD in a temporary index before applying it. Remove four unused validate-python-release inputs that suggested they affected the tagged build.
Caller lock timestamps can be forged to bypass the seven-day cutoff. Compare selected files with PyPI's Simple JSON listing before installing caller groups, and reject alternate Nab indexes and nab.toml.
Action tests launch Python tools in isolated environments, so ordinary coverage misses them. Start coverage in those processes and test the cooldown, lock, and PyPI guards that security review identified.
Concurrent Action tests repeatedly queried PyPI and failed when its endpoint was unreachable. Serve a fixed test listing to the lock checker while keeping production URL and verification unchanged.
gaborbernat
force-pushed
the
build/rc-067
branch
from
October 23, 2026 22:14
3a4e811 to
ff4f85c
Compare
gaborbernat
changed the title
gaborbernat
marked this pull request as ready for review
October 24, 2026 06:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release jobs verify selected lock artifacts against PyPI's Simple API before installing caller tools. The check rejects direct-source packages and uncooled artifacts across platform and build selections. A pinned CA bundle and bounded retries cover PyPI metadata requests.
Preparation recalculates the tag from the checkout and validates the uploaded patch in a keyless job before the App-key writer runs. The weekly updater checks lock and hook patches against separate path allowlists. Its PR must carry the configured release App identity. Managed dependency pins must be exact, published on PyPI, and at least seven days old. Hook revisions retain the seven-day observation rule.
PR checks validate changed primary and configured secondary locks against the project. Release and updater jobs transfer artifacts by upload ID. The lock reader has its own environment so installing another tool group cannot remove its certificate package. The shared lock selects release-creator 1.0.0 from PyPI.
Removed inputs:
build-python-distribution.source,read-towncrier-config.working-directory,validate-release-patch.working-directory,recheck-hook-update-cooldown.minimum-days, and the unusedvalidate-python-releaseinputschangelog,artifact-base-url,artifact-label, andlocal-tool-source.Callers that use the weekly updater must pass their public repository-level
RELEASE_APP_CLIENT_IDvariable tocheck-hook-update-cooldown. Callers with a secondary lock must supply its matrix tovalidate-newsas well as to the updater.