Harden synchronization and release verification by oovz · Pull Request #9 · getspas/spas

oovz · 2026-09-09T07:01:34Z

Summary of Changes

Hardens SPAS synchronization, CLI contracts, Git reference handling, and release verification.

Validate public remote visibility and persist explicit approval.
Add command timeouts and improve unlinked-workspace diagnostics.
Enforce path, Unicode, branch, and Git reference safety checks.
Stabilize JSON output, error codes, diff behavior, permissions, and recovery copies.
Strengthen merge protection and non-interactive Git execution.
Require CI and CodeQL before releases, and attest checksum artifacts.
Update the README and wiki to match the implementation and release process.
Prepare the branch for the v0.1.2 release tag after merge.

Contract & Risk Assessment

Affected commands include link, add, sync, diff, remove, doctor, and version.
JSON payloads, schema metadata, and error codes have intentional contract updates.
Git path/ref parsing, merge-option validation, timeout handling, and public-repository checks affect synchronization behavior.
Windows path-length and file-replacement handling are stricter.
Release builds now require successful CI and CodeQL checks and publish build provenance attestations.
No compatibility fallback paths were added. Documentation reflects the updated behavior.

Verification & Testing

git rev-list --count first-review --not origin/main — 42 branch-specific commits.
Commit-tree verification — all 42 rewritten commits preserve their original trees.
Conventional Commit subject check — 47/47 commit subjects pass.
Merge-base verification — remains 80f6638.
Release configuration review — GoReleaser injects the version from the release tag; the release workflow accepts semantic version tags.
go run . version --json — blocked in the review environment because the Go build cache path was inaccessible. No source changes were made by this check.

Contributor Checklist

[x ] Tests cover the changed behavior (or the PR explains why no test applies).
[x ] gofmt -w, go mod tidy -diff, tests, and go vet pass cleanly.
[x ] User-facing documentation in README.md or wiki/ matches the implementation.
[x ] The change contains no credentials, private assets, recovery files, or compiled binaries.

Remove redundant branches from sync and GitHub reference checks, and keep the final exclusion set in scope across push retries.

…ralize commit.gpgsign and tag.gpgsign via command-line arguments and safety configuration so global signing settings do not prompt or break non-interactive synchronization.

Propagate the root timeout through Git subprocesses, preserve deadline errors, and document the --timeout flag.

Keep Git, data-directory, lock, and worktree diagnostics available in unlinked workspaces.

… Handle transient ERROR_SHARING_VIOLATION and ERROR_ACCESS_DENIED errors in MoveFileEx with bounded retries and backoff.

…oroutine leak

Validate total path length alongside component limits before accepting managed paths.

…t Version to "dev" and only adopt debug.ReadBuildInfo when Version is "dev". This prevents runtime build metadata from overwriting ldflags-injected versions.

…p Runner.Timeout from gitexec and rely solely on the caller's context to manage deadlines across child git processes. Release the command timeout cancel function deterministically in Execute and add tests for deadline propagation and exit code mapping.

Use typed Windows errors and return the caller's context error consistently after cancellation.

…wner and repo components to lowercase when resolving GitHub repository paths so references are case-insensitive.

Record approved public remotes in link state, report whether probing occurred, and run probes outside the workspace.

… probe Add workspace and link-state warnings when link checks are skipped in non-git or unlinked directories. Deduplicate the git version check to a single process spawn, and use PID-scoped lock probe files to prevent race conditions during concurrent runs.

…ce and clone roots on Windows during add and sync instead of rejecting long paths globally.

…ess Pass candidate paths over stdin with -z, --verbose, and --non-matching to verify all exclusions in one Git process.

Create workspace files with Git-style modes filtered by umask while keeping recovery copies owner-only.

Normalize error codes, emit empty arrays instead of null, and support JSON output for version.

…acts

Align the README and wiki with the JSON contract, audit follow-ups, and checksum-plus-attestation releases.

Rename regression tests so their names describe the behavior they protect.

Parse fetched refs by exact namespace so branch names are not trimmed or confused with tags.

Run native tests with -count=1 and -json. Upload results, stderr, and command timestamps while preserving test exit codes.

Keep raw selections through Diff and Remove validation, and enumerate staged rename sides without probing workspace write access.

Document read-only selection, Unicode identity checks, and separate captured and streaming budgets.

oovz added 30 commits August 25, 2026 15:05

refactor: simplify sync and repository validation

f82406e

Remove redundant branches from sync and GitHub reference checks, and keep the final exclusion set in scope across push retries.

fix(privategit): disable commit and tag signing in private clone Neut…

f264cc6

…ralize commit.gpgsign and tag.gpgsign via command-line arguments and safety configuration so global signing settings do not prompt or break non-interactive synchronization.

feat(cli): add command timeout support

0618557

Propagate the root timeout through Git subprocesses, preserve deadline errors, and document the --timeout flag.

fix(doctor): run checks before requiring link state

f1c7416

Keep Git, data-directory, lock, and worktree diagnostics available in unlinked workspaces.

fix(atomicfile): retry Windows file replacement on sharing violations…

d190730

… Handle transient ERROR_SHARING_VIOLATION and ERROR_ACCESS_DENIED errors in MoveFileEx with bounded retries and backoff.

fix(version): fallback to debug buildinfo when ldflags are omitted

5959651

fix(cli): parse --json=false and flag precedence in pre-execution check

d39454e

fix(interaction): unblock reader on context cancellation to prevent g…

e90e68a

…oroutine leak

fix(path): reject oversized paths during resolution

ca0a0be

Validate total path length alongside component limits before accepting managed paths.

feat(schema): add schemaVersion to JSON payloads and document schema

9b4ed19

fix(version): preserve ldflags version over buildinfo fallback Defaul…

7b17f4e

…t Version to "dev" and only adopt debug.ReadBuildInfo when Version is "dev". This prevents runtime build metadata from overwriting ldflags-injected versions.

refactor: simplify Windows retries and cancellation handling

7eac241

Use typed Windows errors and return the caller's context error consistently after cancellation.

fix(githubref): canonicalize owner and repository to lowercase Fold o…

33d5c58

…wner and repo components to lowercase when resolving GitHub repository paths so references are case-insensitive.

fix(link): persist public approval and isolate visibility probes

1426429

Record approved public remotes in link state, report whether probing occurred, and run probes outside the workspace.

fix(path): restrict MAX_PATH preflight to Windows roots Check workspa…

92cccdc

…ce and clone roots on Windows during add and sync instead of rejecting long paths globally.

perf(publicgit): batch exclusion checks into single check-ignore proc…

10d3263

…ess Pass candidate paths over stdin with -z, --verbose, and --non-matching to verify all exclusions in one Git process.

fix(filesync): match checkout modes and protect recovery copies

8e470bc

Create workspace files with Git-style modes filtered by umask while keeping recovery copies owner-only.

fix(cli): stabilize JSON output and error codes

e922003

Normalize error codes, emit empty arrays instead of null, and support JSON output for version.

ci(release): generate build provenance attestations for release artif…

7bdc265

…acts

fix(json): serialize clean sync changes as an array

918fd8d

test(git): isolate fixtures from host signing

2e0ca14

docs: document JSON, release, and security policies

7b7bf3a

Align the README and wiki with the JSON contract, audit follow-ups, and checksum-plus-attestation releases.

docs(link): explain the visibility probe and skip flags

46b51fb

refactor(sync): unify public approval persistence

9fb02ad

test(json): pin payload variants and doctor exit rules

7de0721

test(permissions): make config state checks non-vacuous

52c7750

ci(release): replace provenance wrapper with actions/attest

70c03ec

build(go): require Go 1.26.8

9ba6862

oovz added 12 commits September 4, 2026 17:12

fix(state): enforce the 10,000-path limit before enrollment

34edb4f

fix(gitexec): disconnect stdin for non-interactive commands

1da9cd7

ci(release): require full CI and CodeQL before building

3856b04

test(app): name regressions by behavior

043fdbb

Rename regression tests so their names describe the behavior they protect.

fix(add): reject ambiguous Unicode file selections

0fb10c3

fix(diff): show additions and report I/O failures

61d4000

fix(git): preserve exact repository paths and branch names

7a6d9b6

fix(merge): reject conflicting and inherited merge options

5152f8d

fix(cli): resolve Git paths from the invocation directory

4bf56fb

docs: clarify merge protection and ignore precedence

a0069a5

fix(privategit): preserve literal branch names

3dcd337

Parse fetched refs by exact namespace so branch names are not trimmed or confused with tags.

fix(cli): classify conflicting flags as invalid usage

58f93b8

oovz changed the title ~~fix multiple issues~~ Harden synchronization and release verification Sep 9, 2026

oovz added 4 commits September 10, 2026 18:09

test(app): fix symlink assertions and linked-state fixtures

62653c7

fix(paths): resolve selections through workspace aliases

c5204e6

fix(paths): preserve directory-entry spelling during enrollment

afafd14

perf(tests): remove Git proxy race exit delays

0824a8a

oovz force-pushed the first-review branch from 70906bc to 0824a8a Compare September 11, 2026 03:32

ci: disable native test-result caching and retain timing logs

846a83a

Run native tests with -count=1 and -json. Upload results, stderr, and command timestamps while preserving test exit codes.

oovz force-pushed the first-review branch from f478c84 to 846a83a Compare September 11, 2026 05:05

oovz added 5 commits September 12, 2026 03:24

fix(doctor): report repository inspection failures

0fed221

fix(diff): preserve observed path identity

23dc210

Keep raw selections through Diff and Remove validation, and enumerate staged rename sides without probing workspace write access.

fix(paths): describe Windows preflight byte limit

c629af9

docs(diff): document path aliases and output limits

2a263a8

Document read-only selection, Unicode identity checks, and separate captured and streaming budgets.

test(diff): stage case-only renames with git mv

14be7bb

oovz merged commit d643395 into main Sep 12, 2026
18 checks passed

oovz deleted the first-review branch September 12, 2026 11:33

Navigation Menu

Uh oh!

Harden synchronization and release verification - #9

Harden synchronization and release verification#9
oovz merged 52 commits into
mainfrom
first-review

oovz commented Sep 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

oovz commented Sep 9, 2026

Summary of Changes

Contract & Risk Assessment

Verification & Testing

Contributor Checklist

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant