Repository navigation
fix(release): bind provenance to the triggering CI head, not the built commit - #2647
Conversation
…t commit Every dev release since 2026-07-25 has failed at sign-attest, silently: verify_exact exits 1 with no message immediately after 'PASSED: SLSA verification passed', killing all four Sign jobs and skipping publish. verify_automated_event asserted $run.head_sha == $source_sha, where $run is the CI workflow_run that TRIGGERED the release and source_sha is the commit the tarballs were built from. Those are never equal on an automated release: auto-version commits the version bump after CI, and the build runs from that bump commit. Observed on v5.260725.4 — CI run 30173890949 head 7b08499, SOURCE_SHA 0466b43, whose parent is exactly 7b08499. The assertion is unsatisfiable by construction. release-publish.yml carried the same defect one stage later, comparing the generic descriptor's sourceSha (also the trigger head) against SOURCE_SHA — it would have failed as soon as signing was fixed. - plumb trigger_sha (github.event.workflow_run.head_sha) through version.yml -> release.yml -> sign-attest.yml + release-publish.yml, optional so the stable dispatch path is unaffected - verify_automated_event binds head_sha to TRIGGER_SHA and requires a well-formed one whenever exact verification is demanded; run id still pins the admitting run exactly, so no binding is lost - release-publish.yml compares the generic descriptor against TRIGGER_SHA for dev/homolog and SOURCE_SHA for stable; the native predicate records source_sha directly and stays compared against it - the test fixture set head_sha = SOURCE_SHA, modelling an impossible world, which is why this shipped; it now models the real one and gains a regression test covering forged, absent, and malformed triggers Not caused by the App-token change: the first failure (16:55) predates that fix reaching main (20:01).
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b3128bb67d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| SOURCE_SHA: ${{ inputs.source_sha }} | ||
| SOURCE_BRANCH: ${{ inputs.source_branch }} | ||
| SOURCE_CI_RUN_ID: ${{ inputs.source_ci_run_id }} | ||
| TRIGGER_SHA: ${{ inputs.trigger_sha }} |
There was a problem hiding this comment.
For every automated dev or homolog release, verify_automated_event now requires a valid TRIGGER_SHA, but this value is exported only to the native-predicate step here; the later “Verify SLSA provenance (self-check)” step exports SOURCE_SHA, SOURCE_BRANCH, and SOURCE_CI_RUN_ID without TRIGGER_SHA. Because step environments are isolated, release-generic-provenance.sh verify-exact exits 2, so signing fails before any automated tarball can be promoted. Pass the input into that verification step as well.
AGENTS.md reference: AGENTS.md:L43-L45
Useful? React with 👍 / 👎.
Every dev release has failed silently since 2026-07-25
v5.260725.1,.2, and.4all died at sign-attest:verify_exactexits 1 with no error message, immediately after printingPASSED: SLSA verification passed. All four Sign jobs fail,publishis skipped, no manifest advances.Root cause: comparing two deliberately-different commits
verify_automated_eventasserted:$runis the CIworkflow_runthat triggered the release.source_shais documented as "Exact CI-approved commit that produced the tarballs". Those are never equal on an automated release —auto-versioncommits the version bump after CI, and the build runs from the bump commit:30173890949head_sha7b084992SOURCE_SHA(built)0466b4330466b4337b084992They differ by exactly one commit, always. The assertion is unsatisfiable by construction, and
jq -efails silently, which is why the log shows a bareexit code 1.release-publish.ymlcarried the same defect one stage later — it compares the generic descriptor'ssourceSha(also the trigger head) againstSOURCE_SHA. It would have failed the moment signing was fixed.Fix
trigger_sha(github.event.workflow_run.head_sha) throughversion.yml→release.yml→sign-attest.yml+release-publish.yml. Optional input, so the stable dispatch path is unaffected (it recordssource_shadirectly and is already self-consistent).verify_automated_eventbindshead_shatoTRIGGER_SHA, and requires a well-formed one whenever exact verification is demanded. No binding is lost — the run id still pins the admitting run exactly, andhead_shais an attribute of that same run.release-publish.ymlcompares the generic descriptor againstTRIGGER_SHAfor dev/homolog andSOURCE_SHAfor stable. The native predicate recordssource_shadirectly and stays compared against it.Why it shipped
The test fixture set
head_sha: SOURCE_SHA— modelling a world that cannot occur. It now models the real one, plus a regression test asserting the old shape is rejected and covering forged, absent, and malformed trigger SHAs.Attribution
Not caused by the GitHub App change (#2643). The first failure was 16:55; that fix only reached
mainat 20:01. This regression arrived with the verification tightening promoted in #2624.Verification:
release-generic-provenance.test.ts6 pass, plusrelease-docs+release-native-predicate— 48 pass / 0 fail.bash -nclean, all four workflows valid YAML. (bun run checkalso reports 2 pre-existingdoctor.tscomplexity errors that are present on cleandevand unrelated to this change.)