Skip to content

v0.2.1 — adopter-CI trust boundary fix

Choose a tag to compare

View all tags
@mikim mikim released this 18 Jul 12:17
v0.2.1
6de26c2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security hardening of the reusable adopter CI plus honest-signal fixes, from two external reviews of v0.2.0. No adoption-schema changes; existing registers validate identically. See CHANGELOG.md for the full list.

Canonical pin for adopters: v0.2.1 @ 6de26c28573bd1d145dad75529debb8a89d0d5d2 (this tag's commit).

Security

  • The reusable workflow no longer checks out the validator from a repository named in the pull-request-mutable adoption file: the validator always comes from the canonical upstream, the declared repository is validated as data, and the caller's @ reference must equal upstream.commit (now enforced). This closes a code-execution vector where a pull request could point CI at attacker-controlled validator code.
  • permissions: contents: read, persist-credentials: false, full-SHA action pins, and a universal hash-pinned dependency lock in both workflows.
  • All pre-v0.2.1 releases carry the CI issue — re-pin before running the reusable workflow on a repository that accepts external pull requests (see SECURITY.md).

Upgrade actions when re-pinning

  1. Update upstream.version, upstream.commit, and the caller workflow's @ reference to the SHA above in the same change; the PR description needs an Assurance policy change: <why> line (the new policy regression check flags every pin move).
  2. Required-check rename: assurance / conformance → assurance / declared-stage.
  3. Recommended caller on: update: pull_request types [opened, synchronize, reopened, edited, ready_for_review] (docs/ADOPTION.md §3.4).

Also in this release

  • CONFORMANT enforces the mechanically checkable subset of PROFILE §17 (critical OPEN residuals, CONTRADICTED entries, evidence-free VERIFIED criticals, RESTRICTED/EMBARGOED material).
  • Pull-request policy regression gate: stage downgrades, component removal/narrowing, and pin moves require explicit acknowledgment.
  • Impact routing precision: rename-safe change detection; a component is satisfied only when the added lines of the assurance diff reference its invariant IDs (token-boundary matched); findings surface as annotations and a job-summary table.
  • Lite envelope schema rejects unknown top-level keys and empty prose fields (extensions namespace for local keys).
  • 42-case validator regression suite, run on a Python 3.10/3.12/3.13 matrix.
Assets 2
Loading