fix(ci): harden SLSA pin guardrail + drop stale ci-local date - #754
Merged
Conversation
ci-local.sh restated a "2026-06-02 deadline" string that drifted from the script's own DEADLINE constant (2026-09-16); PR #751 fixed the date in deploy.yml and the script but missed this echo. Make the echo defer to the script so the date lives in one place. Add an opt-in upstream check (MMS_CHECK_SLSA_UPSTREAM=true) that queries the releases API and flags when upstream cuts a release newer than the pinned one — the human-action trigger #661 waits on. Off by default so the lint stays offline and deterministic, matching the MMS_VERIFY_STATE_BUCKET opt-in pattern. Point LOCAL_ISSUE at #661 (supersedes #389). Refs #661 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens the #661 watch guardrail and clears a stale date the #751 sweep missed.
Changes
ci-local.sh: theokline restated a2026-06-02 deadlinestring that drifted fromassert-slsa-pin-fresh.sh's ownDEADLINE=2026-09-16. fix(ci): correct Node-24 default-flip date to 2026-06-16 #751 fixed the date indeploy.ymland the script but missed this echo. The echo now defers to the script so the deadline date is single-sourced.assert-slsa-pin-fresh.sh: adds an opt-in upstream check (MMS_CHECK_SLSA_UPSTREAM=true) that queries the releases API and surfaces anACTION:line when upstream cuts a release newer than the pinnedv2.1.0— the human-action trigger Watch: bump slsa-github-generator to a Node-24 release (upstream-gated) #661 waits on. Off by default so the default lint stays offline and deterministic, matching theMMS_VERIFY_STATE_BUCKETopt-in pattern. Also repointsLOCAL_ISSUEto#661(supersedes ci: upgrade slsa-github-generator to Node.js 24 before June 2 2026 default flip #389).Verification
shellcheck+shfmt -dclean onassert-slsa-pin-fresh.sh.#661.OK: upstream latest (v2.1.0) matches the pinned version — nothing newer to evaluate.No behavior change to the pin itself — the bump remains upstream-gated on slsa-framework/slsa-github-generator#4490.
Refs #661
🤖 Generated with Claude Code