chore(release): require audited dispatch SHA - #1559
Conversation
Changed expected-sha input to be required for release.
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
added
the
chore
|
Warning Review limit reached
Next review available in: 4 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe release workflow now requires ChangesRelease SHA Verification
Estimated code review effort: 3 (Moderate) | ~20 minutes Mergeability Score: ⚪ Minimal · up to The release workflow now requires an explicit audited commit and fails closed when it is missing; no actionable merge-blocking risk remains after normal checks and review. Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/release.yml:
- Around line 57-58: Move trusted dispatch-ref validation ahead of checkout and
any commands that execute release-ref code, using scripts from the trusted
default branch to validate the requested ref. Preserve the existing main and
preview allowlist, then check out the approved ref and retain expected-sha
validation to bind it to the audited commit.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 8d348efa-174c-4027-baae-c179f236f889
📒 Files selected for processing (1)
.github/workflows/release.yml
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/scripts/release-dispatch-guard.cjs:
- Around line 8-38: Invoke validateReleaseDispatch from trusted code in the
release workflow before any GitHub or npm release operations, using the
repository default branch revision rather than the dispatch-selected ref. Pass
the workflow event, ref, expected SHA, and checked-out actual SHA to the guard,
fail immediately on a validation message, and retain support for
refs/heads/preview.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a8a80e4f-576d-40ce-9aa6-ae7e89ba8176
📒 Files selected for processing (1)
.github/scripts/release-dispatch-guard.cjs
Ingwannu
left a comment
Ingwannu
left a comment
There was a problem hiding this comment.
Security review completed on exact head d373694b1cd8c1660ca4793d444035f457222243. The release gate is loaded from the trusted default branch before release-ref code runs, dispatch is limited to main/preview, expected-sha is required as a full SHA and compared to GITHUB_SHA, workflow-level permissions are empty, and write/OIDC permissions exist only on the gated publish job. The actual PR diff is four files and exact-head CI is green. Approved from the release-integrity boundary.
3 participants
Summary
expected-shafor every manual Release workflow dispatchmainandpreviewWhy
The Release workflow is designed to publish an explicitly reviewed and audited commit, but the previous workflow still had two trust gaps.
First,
expected-shawas optional. A manually dispatched release without it could continue by publishing whatever commit the selected branch currently pointed at.Second, branch/ref validation happened only after the selected dispatch ref had already been checked out and repository code had begun executing. Since
workflow_dispatchcan be started against a selected branch, that meant release-ref code could run before the workflow had established that the dispatch came from an approved release branch.This change makes the release path fail closed.
A new
validate-dispatchjob:contents: readworkflow_dispatchrefs/heads/mainandrefs/heads/previewexpected-shaGITHUB_SHAto exactly match that audited SHAOnly after that validation succeeds can the
publishjob start.The write-capable permissions required for GitHub release creation and npm Trusted Publishing are now scoped specifically to
publish, rather than being granted to every job in the workflow.Impact
Normal releases through
bun scripts/release.tsremain compatible because the helper already:mainorpreviewexpected-sha=${releaseSha}Intentional behavior changes:
expected-shaare rejectedmainorprevieware rejectedNo npm publishing semantics, release channel mapping, or
main/previewrelease support are removed.Validation
Added focused tests covering:
maindispatchpreviewdispatchworkflow_dispatcheventsdevexpected-shaCodeRabbit's two security findings covering dispatch trust ordering and trusted guard invocation are now resolved.
Review
Ready for review.
@lidge-jun @Ingwannu