PROBE (do not merge): does the release-please branch waiver fire for a human author? - #6858
Closed
forkwright wants to merge 3 commits into
Closed
PROBE (do not merge): does the release-please branch waiver fire for a human author?#6858forkwright wants to merge 3 commits into
forkwright wants to merge 3 commits into
Conversation
Deliberately carries NO Gate-Passed trailer and sits on a branch matching `release-please--branches--*`. Opened to observe whether the shared gate's branch-shaped waiver fires for a non-bot author. Closed without merging.
Post-fix half of the forkwright/.github#42 verification. Same branch, same author, same probe content; only the pinned workflow changes. Refs forkwright/.github#42
Completes the post-fix capture. The marker now lives in the COMMIT, which is what ai-attribution actually scans, rather than the PR body. Expected: ai-attribution goes RED. Co-Authored-By: Claude <noreply@anthropic.com>
|
Owner
Author
|
Probe complete — captures posted to forkwright/.github#42. Vulnerability confirmed live pre-fix, caught post-fix. |
forkwright
added a commit
that referenced
this pull request
Aug 17, 2026
Bumps the shared-gate pin to `08a0bad`, which carries the release-please waiver fix (forkwright/.github#42). ## Why this matters here The prior pin (`54f1af7`) waives the AI-attribution check on `github.head_ref` alone — a branch name chosen by whoever opens the PR, with no author condition. That was **confirmed live on this repo**, not argued: | capture | pin | marker in | result | |---|---|---|---| | pre-fix | `54f1af7` | commit | **pass in 9s** — waiver fired, `exit 0`, nothing scanned | | post-fix | `08a0bad` | commit | **fail** — waiver refused, check ran, caught it | Probe #6858 (now closed, branch deleted). The decisive post-fix line: ``` Branch release-please--branches--waiver-probe has the release-please shape but author forkwright is type User, not Bot — not waiving. ``` aletheia is public, and an external account opened #6854 on this repo while that probe was running — so the capability the bypass requires is demonstrably held outside the org. ## No effect on releases All three open release-please PRs fleet-wide (typikon#174, kanon#3306, logismos#109) are authored by `github-actions[bot]`, `user.type = Bot`. They still waive. Verified rather than assumed, because tightening a waiver is exactly the change that silently reddens a release flow. ## Wider note, not fixed here Three consumer repos pin this workflow at **three different SHAs**, all pre-fix. A security fix in the shared gate reaches an adopting repo only when that repo bumps, and nothing reports the lag. That is a propagation gap worth its own mechanism; flagging rather than solving it in a pin bump. Co-authored-by: Cody Kickertz <admin@forkwright>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PROBE — do not merge, do not review as a change
Verification fixture for forkwright/.github#42. Will be closed and its branch deleted as soon as both captures are taken.
What it tests
The shared gate waives two checks on a branch-name predicate —
startsWith(github.head_ref, 'release-please--branches--')— with no author condition attached. A branch name is chosen by whoever opens the PR, so the predicate is controlled by the party being checked.This PR is that shape, deliberately:
release-please--branches--waiver-probeGate-Passed:trailerExpected — BEFORE the pin bump (this run)
aletheia pins
hybrid-gate.ymlat the pre-fix SHA, so:hybrid-gate / ai-attribution— waived, exits 0 without inspecting this bodygate-attestation— waived, despite no trailer on the tipIf both pass, the vulnerability is confirmed live rather than theoretical, and that is this PR's entire purpose.
Expected — AFTER #42 merges and aletheia's pin is bumped
ai-attribution— runs, and fails on the marker belowgate-attestation— runs, and fails for the missing trailerSame branch, same commit, same author. Only the pinned workflow changes.
The marker under test
The line below is attribution-trailer-shaped and is the thing the check exists to catch. It is here as a fixture, not as an attribution — nothing in this PR was co-authored, and the file it adds is one line of placeholder text.
Co-authored-by: Probe Fixture probe@example.invalid
Why a probe rather than a unit test
forkwright/.githubhas no test harness — it isREADME.mdplus.github/workflows/, and both gate workflows areworkflow_call-only, so a PR against that repo never executes them. The negative case can only be observed in a consuming repo against a pinned SHA. That is a real gap: this fix will be argued rather than guarded until a harness exists, which is gnomon#51's outstandingDone whenclause.