ci(release): pin release-critical CI dependencies by graybuton · Pull Request #149 · graybuton/goframe

graybuton · 2026-09-08T23:50:11Z

Summary

Harden GoFrame's release-critical CI supply chain ahead of
v0.4.0-preview.1.

Authored GitHub Actions are pinned to immutable commits, and repository-owned
TinyGo release downloads are cryptographically verified before installation.

A fail-closed repository gate preserves these contracts and rejects regressions
to mutable Action references or weakened artifact verification.

Supply-chain contract

Release-critical CI now requires:

remote authored uses: references to resolve through full immutable commit
SHAs, with readable upstream version annotations;
directly downloaded TinyGo artifacts to pass the accepted SHA-256 check before
installation;
the verified artifact to remain bound to the install sequence;
repository checks to reject mutable refs, missing integrity metadata, and
verification bypasses.

Existing package-manager and pinned-Action internal download mechanisms retain
their current contracts.

Scope

This PR does not change:

GoFrame runtime, GOX, or goxc behavior;
supported Go, TinyGo, or Node policy;
dependencies or WASM size budgets;
security-analysis or CodeQL policy;
CI job topology, matrices, or required-check names;
release artifacts or publication behavior.

Fast-fail CI restructuring remains outside this stage.

Review focus

Please focus on:

immutable provenance of release-critical authored Actions;
fail-closed TinyGo artifact verification and install sequencing;
regression-gate resistance to verification bypasses;
preservation of existing CI behavior and the boundary with later CI-topology
work.

Scan local Docker action entrypoints

When an accepted local Action uses runs.using: docker with a non-executable Dockerfile, this early return excludes the Dockerfile from provenance inspection. A RUN base=https://github.com/tinygo-org/tinygo; curl "$base/releases/download/..." instruction also avoids the contiguous-namespace grep, so the checker reports success while CI builds and executes an unverified TinyGo download. Treat Dockerfiles and other entrypoints referenced by local Action metadata as executable CI sources.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-09-19T19:55:48Z

+		if [[ "$key" != run || -z "$value" ]]; then
+			continue


Restrict run scanning to executable step fields

When a valid workflow contains an ordinary mapping key named run outside a step, such as env:\n run: curl, this context-free check treats the data value as a shell command and rejects it for containing a downloader token. The Action-reference scanner already distinguishes step fields from ordinary env/input data; the downloader scanner needs the same structural check so harmless configuration does not break the repository gate.

Useful? React with 👍 / 👎.

graybuton added 2 commits September 8, 2026 23:23

ci(release): pin release-critical CI dependencies

1b057b0

ci(release): harden supply-chain verification gate

ae107c1

graybuton added this to the v0.4.0-preview.1 milestone Sep 8, 2026

graybuton self-assigned this Sep 8, 2026

graybuton marked this pull request as ready for review September 9, 2026 00:00

chatgpt-codex-connector Bot reviewed Sep 9, 2026

View reviewed changes

Comment thread scripts/check.sh

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread .github/workflows/ci-core.yml

Comment thread scripts/ci-supply-chain-check.sh Outdated

graybuton marked this pull request as draft September 9, 2026 00:11

ci(release): close supply-chain review gaps

2ac1039

chatgpt-codex-connector Bot reviewed Sep 11, 2026

View reviewed changes

Comment thread scripts/ci-supply-chain-check.sh

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

ci(release): bind supply-chain trust roots

cc67a2c

chatgpt-codex-connector Bot reviewed Sep 12, 2026

View reviewed changes

Comment thread scripts/ci-supply-chain-check.sh Outdated

ci(release): bound TinyGo download surface

5222df3

chatgpt-codex-connector Bot reviewed Sep 12, 2026

View reviewed changes

Comment thread scripts/ci-supply-chain-check.sh Outdated

ci(release): remove TinyGo scan exemptions

8fbadcf

chatgpt-codex-connector Bot reviewed Sep 12, 2026

View reviewed changes

Comment thread .github/workflows/ci-core.yml Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

graybuton added 3 commits September 13, 2026 12:19

ci(release): harden checksum execution

49db574

ci(release): restore Bash 3.2 scalar parsing

b158987

ci(release): fix checksum oracle portability

35c1d70

chatgpt-codex-connector Bot reviewed Sep 13, 2026

View reviewed changes

Comment thread scripts/ci-supply-chain-check.sh

Comment thread scripts/ci-supply-chain-check.sh Outdated

graybuton added 2 commits September 13, 2026 22:16

ci(release): bind TinyGo install boundary

cfad7ee

ci(release): separate TinyGo install smoke

8995ea0

chatgpt-codex-connector Bot reviewed Sep 13, 2026

View reviewed changes

Comment thread scripts/ci-supply-chain-check.sh

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

graybuton added 2 commits September 15, 2026 12:14

ci(release): close authored CI policy gaps

7c79571

ci(release): bind TinyGo job execution

6dc44d2

chatgpt-codex-connector Bot reviewed Sep 15, 2026

View reviewed changes

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

Comment thread scripts/ci-supply-chain-check.sh Outdated

ci(release): close final supply-chain blind spots

15b4458

chatgpt-codex-connector Bot reviewed Sep 19, 2026

View reviewed changes

graybuton added 2 commits September 20, 2026 14:48

ci(release): unify authored CI execution policy

d0422f1

ci(release): close execution indirection gaps

ce03c52

+              	if [[ "$forced" != true ]] &&
+              		! repository_file_is_ci_executable_source "$relative" "$file" &&
+              		! repository_file_is_authored_ci_yaml "$relative"; then
+              		return

Conversation

graybuton commented Sep 8, 2026

Summary

Supply-chain contract

Scope

Review focus

Related

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

graybuton commented Sep 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

graybuton commented Sep 12, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

graybuton commented Sep 12, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

graybuton commented Sep 12, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

graybuton commented Sep 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

graybuton commented Sep 13, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

graybuton commented Sep 15, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

graybuton commented Sep 19, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review