Skip to content

v0.8.1

Marketplace
Marketplace

Choose a tag to compare

View all tags
@mavericksea-ai mavericksea-ai released this 03 Sep 16:20
· 1 commit to main since this release
v0.8.1
2d0f254

Spec 023, Action input hardening. The change that earns a patch version is action.yml: it hardens a surface published on the Marketplace, so the tag adopters are told to use moves to a commit that carries the fix. What driftproof run measures is unchanged: bin/, every measurement module in lib/, the receipt schema and the model registry are byte-identical to v0.8.0; a receipt from 0.8.1 differs from one from 0.8.0 in the version stamp, and therefore its hash, and in nothing else.

What shipped

  • The Action's inputs are data, not shell. Every ${{ inputs.* }} moved out of inline run: scripts into the step's env: block; step bodies live in action/run.sh and action/enforce.sh and reference those variables double-quoted only. No run: line in action.yml or the self-test workflow contains an expression. (Audit finding A1, High.)
  • The refusal is proved on a real GitHub runner, in public (spec 024). The self-test workflow passes a value carrying a double quote, a semicolon, $(...), a backtick and a newline through each of the five inputs of the real action.yml and fails the job unless every one is refused before anything ran. A control step pastes the same payload the way v0.8.0 did and requires the markers to appear first, so the mechanism is shown live before it is relied on. Run: https://github.com/driftproofhq/driftproof/actions/runs/33775114997
  • Inputs are validated before use: models over [A-Za-z0-9._-], max-usd a positive decimal, max-calls a positive integer, fail-on-regression exactly true or false, skill-dir an existing directory with no control character. Anything else fails the step with ::error title=Driftproof before a directory is created or a model call is projected.
  • $GITHUB_OUTPUT entries are heredocs with a random delimiter, and a value carrying a line break is refused before anything is written. (A6, High when chained with A1.)
  • Full-SHA pins on actions/checkout, actions/setup-node and actions/upload-artifact, and npm ci no longer falls back to npm install. (A9, Low.)
  • RUNNER_VERSION 0.8.1, stamped into every receipt from here on.

Known open
The other audit groups: judge prompt injection (A4), budget validation (A3), S3 to S9, and the spec-021 carry list. The honest scope of this release is the Action input surface and the local-agent boundary; judge integrity and budget enforcement are the next loop.

Full notes in RELEASES.md.

Action usage: uses: driftproofhq/driftproof@v0.8.1

Assets 2
Loading