Enforce immutable Actions and untrusted contribution boundaries

Author: durable-workflow-ops

.github/workflows/docs.yml

@@ -40,6 +40,7 @@ jobs:
 
   deploy:
     needs: build
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions:
       contents: read

.github/workflows/publish.yml

@@ -109,7 +109,8 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')) ||
-      (github.event_name == 'workflow_dispatch' && inputs.publish)
+      (github.event_name == 'workflow_dispatch' &&
+       github.ref == 'refs/heads/main' && inputs.publish)
     environment: pypi
     permissions:
       contents: write
@@ -174,7 +175,10 @@ jobs:
   publish-test:
     needs: build
     runs-on: ubuntu-latest
-    if: github.event_name == 'workflow_dispatch' && !inputs.dry_run && !inputs.publish
+    if: >-
+      github.event_name == 'workflow_dispatch' &&
+      github.ref == 'refs/heads/main' &&
+      !inputs.dry_run && !inputs.publish
     environment: test-pypi
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8

.github/workflows/release-plan-recovery.yml

@@ -24,6 +24,7 @@ concurrency:
 jobs:
   recover:
     name: Recover exact Python SDK release
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -78,7 +79,7 @@ jobs:
           set -euo pipefail
           decision=
           for attempt in 1 2 3 4 5 6; do
-            gh run list --workflow publish.yml --limit 100 \
+            gh run list --workflow publish.yml --event workflow_dispatch --branch main --limit 100 \
               --json databaseId,displayTitle,headBranch,headSha,status,conclusion \
               > publication-runs.json
             decision="$(python scripts/ci/component-release-recovery.py select-publication-run \
@@ -93,7 +94,7 @@ jobs:
             fi
           done
           if [ "$publication_action" = dispatch ]; then
-            gh workflow run publish.yml --ref "$RELEASE_TAG" \
+            gh workflow run publish.yml --ref main \
               -f release_tag="$RELEASE_TAG" -f release_plan="$PLAN_TAG" -f publish=true
           else
             printf 'Durable publication run %s is %s/%s; no duplicate dispatch is needed.\n' \

scripts/ci/cli-release-plan-recovery.fixture.yml

@@ -23,6 +23,9 @@ concurrency:
 jobs:
   discover:
     name: Discover exact CLI release
+    if: >-
+      github.event_name != 'workflow_dispatch' ||
+      github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -74,7 +77,9 @@ jobs:
   publish:
     name: Publish exact CLI release
     needs: discover
-    if: needs.discover.outputs.action == 'publish'
+    if: >-
+      github.ref == 'refs/heads/main' &&
+      needs.discover.outputs.action == 'publish'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     environment: release-plan-publication

scripts/ci/component-release-recovery.py

@@ -59,14 +59,14 @@
 # SHA-256 of durable-workflow/cli's protected release recovery workflow.
 # Exact source identity is required because source-pattern matching cannot
 # prove that tag creation remains inside the protected repository authority.
-CLI_RELEASE_RECOVERY_SHA256 = "29fde398856e0db8c43c14dc3c3544fcb21ad9c79db71661db1637e8f89c588a"
+CLI_RELEASE_RECOVERY_SHA256 = "de1e7f37bcbadf3644b53d127abcae11ec823fd6602a682a58617c6b257dae11"
 
 # SHA-256 of durable-workflow/sdk-rust's prepared-plan recovery workflow. The
 # verifier normalizes only
 # CRLF line endings to LF before hashing. Exact source identity is the bounded
 # security contract because arbitrary shell execution cannot be proven safe by
 # source-pattern matching.
-SDK_RUST_RELEASE_RECOVERY_SHA256 = "0055b197f7ef3f826275bd5514a33891a9cbf10f5d74b9fefa1647f5eefe868a"
+SDK_RUST_RELEASE_RECOVERY_SHA256 = "d6bca15d3f09aa3e7ecf6fc796b81a008e3e4cba2fdea10391f8ede0cab3548c"
 
 
 @dataclass(frozen=True)
@@ -772,8 +772,10 @@ def verify_recovery_workflow_source(name: str, source: str) -> None:
     if component.release_workflow is None:
         return
 
+    dispatch_ref = component.default_branch if name == "sdk-python" else '"$RELEASE_TAG"'
     dispatch = re.search(
-        rf'gh\s+workflow\s+run\s+{re.escape(component.release_workflow)}\s+--ref\s+"\$RELEASE_TAG"',
+        rf"gh\s+workflow\s+run\s+{re.escape(component.release_workflow)}\s+--ref\s+"
+        rf"{re.escape(dispatch_ref)}(?=\s|$)",
         source,
     )
     tag_ref_at = source.find('-f ref="refs/tags/$RELEASE_TAG"')
@@ -791,7 +793,7 @@ def verify_recovery_workflow_source(name: str, source: str) -> None:
     ):
         raise RecoveryError(
             f"{component.repository} publication must create or verify the declared source tag "
-            "before dispatching in its exact tag context",
+            "before dispatching from its protected publication source",
             "default-branch-preflight",
         )
     release_input = f'-f {component.release_tag_input}="$RELEASE_TAG"'
@@ -812,16 +814,24 @@ def select_publication_run(
     if not isinstance(runs, list):
         raise RecoveryError("publication run metadata must be a JSON array", "publication")
 
+    # A protected-main dispatch reports main's head SHA; the exact release
+    # commit is instead enforced by the immutable tag checkout in publish.yml.
+    expected_title_prefix = f"Release {release_tag} for "
     exact_runs: list[dict[str, Any]] = []
     for run in runs:
-        if not isinstance(run, dict) or run.get("headBranch") != release_tag:
+        if (
+            not isinstance(run, dict)
+            or run.get("headBranch") != COMPONENTS["sdk-python"].default_branch
+            or not isinstance(run.get("displayTitle"), str)
+            or not run["displayTitle"].startswith(expected_title_prefix)
+        ):
             continue
-        if run.get("headSha") != release_commit:
-            raise RecoveryError(
-                f"publication run {run.get('databaseId')} for {release_tag} is bound to a different source commit",
-                "publication",
-            )
-        if not isinstance(run.get("databaseId"), int) or not isinstance(run.get("status"), str):
+        if (
+            not isinstance(run.get("databaseId"), int)
+            or not isinstance(run.get("headSha"), str)
+            or not COMMIT_PATTERN.fullmatch(run["headSha"])
+            or not isinstance(run.get("status"), str)
+        ):
             raise RecoveryError("publication run metadata is incomplete", "publication")
         exact_runs.append(run)
 

scripts/ci/sdk-rust-release-plan-recovery.fixture.yml

@@ -70,7 +70,10 @@ jobs:
   publish:
     name: Publish exact Rust SDK release
     needs: discover
-    if: needs.discover.outputs.action == 'publish'
+    if: >-
+      github.repository == 'durable-workflow/sdk-rust' &&
+      github.ref == 'refs/heads/main' &&
+      needs.discover.outputs.action == 'publish'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: release-plan-publication
@@ -109,19 +112,21 @@ jobs:
           set -euo pipefail
 
           select_publication_run() {
-            gh run list --workflow release.yml --limit 100 \
-              --json databaseId,displayTitle,headBranch,headSha,status,conclusion \
+            gh run list --workflow release.yml --event workflow_dispatch --branch main --limit 100 \
+              --json databaseId,event,displayTitle,headBranch,headSha,status,conclusion \
               > publication-runs.json
             python scripts/ci/component-release-recovery.py select-publication-run \
               --release-tag "$RELEASE_TAG" --release-commit "$RELEASE_COMMIT" \
+              --release-plan "$PLAN_TAG" \
               --runs publication-runs.json
           }
 
           decision="$(select_publication_run)"
           IFS=$'\t' read -r publication_action run_id status conclusion <<< "$decision"
           if [ "$publication_action" = dispatch ]; then
-            gh workflow run release.yml --ref "$RELEASE_TAG" \
-              -f release_tag="$RELEASE_TAG" -f release_plan="$PLAN_TAG"
+            gh workflow run release.yml --ref main \
+              -f release_tag="$RELEASE_TAG" -f release_commit="$RELEASE_COMMIT" \
+              -f release_plan="$PLAN_TAG"
             for attempt in {1..12}; do
               decision="$(select_publication_run)"
               IFS=$'\t' read -r publication_action run_id status conclusion <<< "$decision"

scripts/ci/test-component-release-recovery.py

@@ -12,7 +12,10 @@
 from pathlib import Path
 from unittest import mock
 
-from cli_release_verifier_contract import CliRecoveryWorkflowSourceTest, CliReleaseAuthorityTest
+from cli_release_verifier_contract import (  # noqa: F401 - imported for unittest discovery
+    CliRecoveryWorkflowSourceTest,
+    CliReleaseAuthorityTest,
+)
 
 RECOVERY_SCRIPT = Path(__file__).with_name("component-release-recovery.py")
 RUST_WORKFLOW_FIXTURE = Path(__file__).with_name("sdk-rust-release-plan-recovery.fixture.yml")
@@ -433,8 +436,8 @@ def test_rejects_skipped_nonblocking_or_decoy_scoped_steps(self) -> None:
                 1,
             ),
             "run identity includes an unapproved field": source.replace(
-                "databaseId,displayTitle,headBranch,headSha,status,conclusion",
-                "databaseId,displayTitle,headBranch,headSha,status,conclusion,event",
+                "databaseId,event,displayTitle,headBranch,headSha,status,conclusion",
+                "databaseId,event,displayTitle,headBranch,headSha,status,conclusion,actor",
                 1,
             ),
         }
@@ -553,6 +556,27 @@ def test_other_components_keep_the_contents_api_contract(self) -> None:
         with self.assertRaises(self.recovery.RecoveryError):
             self.recovery.verify_recovery_workflow_source("server", protected_only)
 
+    def test_python_recovery_dispatches_publication_from_protected_main(self) -> None:
+        recovery_source = RECOVERY_WORKFLOW.read_text()
+        publish_source = PUBLISH_WORKFLOW.read_text()
+
+        self.recovery.verify_recovery_workflow_source("sdk-python", recovery_source)
+        self.assertIn("gh workflow run publish.yml --ref main", recovery_source)
+        self.assertNotIn('gh workflow run publish.yml --ref "$RELEASE_TAG"', recovery_source)
+        self.assertIn('-f release_tag="$RELEASE_TAG"', recovery_source)
+        self.assertIn("github.ref == 'refs/heads/main' && inputs.publish", publish_source)
+        self.assertIn("format('refs/tags/{0}', inputs.release_tag)", publish_source)
+        self.assertIn('if [ "$REQUESTED_TAG" != "$package_version" ]', publish_source)
+        self.assertIn('tag_commit="$(git rev-list -n 1 "$REQUESTED_TAG")"', publish_source)
+
+        invalid_recovery_sources = (
+            recovery_source.replace("--ref main", '--ref "$RELEASE_TAG"', 1),
+            recovery_source.replace('-f release_tag="$RELEASE_TAG"', '-f release_tag="$GITHUB_REF_NAME"', 1),
+        )
+        for invalid_source in invalid_recovery_sources:
+            with self.assertRaises(self.recovery.RecoveryError):
+                self.recovery.verify_recovery_workflow_source("sdk-python", invalid_source)
+
 
 class PublicationRunSelectionTest(unittest.TestCase):
     RELEASE_TAG = "1.2.3"
@@ -568,14 +592,14 @@ def run_metadata(
         *,
         status: str,
         conclusion: str | None,
-        commit: str | None = None,
+        head_sha: str | None = None,
         plan: str = "release-plan/continuity-plan-a",
     ) -> dict[str, object]:
         return {
             "databaseId": run_id,
             "displayTitle": f"Release {self.RELEASE_TAG} for {plan}",
-            "headBranch": self.RELEASE_TAG,
-            "headSha": commit or self.RELEASE_COMMIT,
+            "headBranch": "main",
+            "headSha": head_sha or "2" * 40,
             "status": status,
             "conclusion": conclusion,
         }
@@ -592,6 +616,11 @@ def test_failed_plan_a_dispatches_current_plan_b_once(self) -> None:
         )
         workflow = RECOVERY_WORKFLOW.read_text()
         self.assertEqual(workflow.count("gh workflow run publish.yml"), 1)
+        self.assertIn("gh workflow run publish.yml --ref main", workflow)
+        self.assertIn(
+            "gh run list --workflow publish.yml --event workflow_dispatch --branch main",
+            workflow,
+        )
         self.assertIn('-f release_tag="$RELEASE_TAG" -f release_plan="$PLAN_TAG" -f publish=true', workflow)
         self.assertNotIn("gh run rerun", workflow)
 
@@ -603,13 +632,13 @@ def test_active_exact_run_waits_and_successful_exact_run_completes(self) -> None
         successful = self.run_metadata(3, status="completed", conclusion="success")
         self.assertEqual(self.select([failed, successful])["action"], "complete")
 
-    def test_moved_source_tag_is_rejected(self) -> None:
-        moved = self.run_metadata(1, status="completed", conclusion="failure", commit="a" * 40)
-
-        with self.assertRaises(self.recovery.RecoveryError) as caught:
-            self.select([moved])
+    def test_non_main_or_different_release_runs_are_ignored(self) -> None:
+        tag_context = self.run_metadata(1, status="completed", conclusion="success")
+        tag_context["headBranch"] = self.RELEASE_TAG
+        different_release = self.run_metadata(2, status="completed", conclusion="success")
+        different_release["displayTitle"] = "Release 9.9.9 for release-plan/continuity-plan-a"
 
-        self.assertEqual(caught.exception.phase, "publication")
+        self.assertEqual(self.select([tag_context, different_release])["action"], "dispatch")
 
     def test_fresh_dispatch_keeps_partial_publication_idempotent(self) -> None:
         workflow = PUBLISH_WORKFLOW.read_text()