fix(signing): validate release ancestry against protected main

Merged
QN
2d ago
+391-13

User description

Purpose

Correct the release-tag verifier's ancestry check to use the GitHub Compare API fields that the endpoint actually returns. The old check depended on a nonexistent head_commit field and could reject a valid signed release tag.

Changes

  • Accept only ahead or identical comparisons whose base and merge-base SHAs both equal the signed release target.
  • Require the target to match the push event SHA and GitHub context SHA, then recheck the annotated tag ref after verification.
  • Read protected main before and after the ancestry request; fail closed if its SHA moves or protection disappears during verification.
  • Preserve the existing PR/push signature-verification paths. No release workflow or publishing behavior is changed here; PR #1205 will pin the protected-main result after this precursor merges.

Validation

  • tests/unit/tooling/verifyRemoteTag.test.ts: 20/20 passed, including realistic Compare API responses, malformed/divergent ancestry, unprotected or moving main, tag mismatch/retargeting, and API failures.
  • tests/unit/signing.test.ts: 72/72 passed.
  • pnpm run pr:budget --base origin/main: 7 files, 404 meaningful lines, 3 commits; within hard limits.
  • PR_BUDGET_BASE=origin/main pnpm run ci:prepush: passed. Hosted exact-head checks and independent reviews are still required.

Security and release status

This PR does not create or publish a tag, GitHub Release, GHCR image, or Tauri artifact. v1.29.3 remains on HOLD. PR #1205 must use the resulting protected-main commit as its immutable verifier pin after this PR merges and the new main checks are verified.

Related: #1205, #1201, #1206.

Summary by Sourcery

Harden signed release-tag verification against invalid ancestry, mutable refs, and inconsistent GitHub event state.

Bug Fixes:

  • Correct release-tag ancestry validation to use GitHub Compare API results and reject tags whose targets do not match the triggering event commit.

Enhancements:

  • Harden release verification by validating annotated tag identity, checking protected main stability throughout ancestry verification, and rechecking the tag ref before completion.

Documentation:

  • Update changelog and README test-count metrics.

Tests:

  • Add comprehensive coverage for valid and invalid ancestry, tag retargeting, protected-main changes, API failures, and event SHA mismatches.

CodeAnt-AI Description

Bind signed release tags to the pushed commit and protected main

What Changed

  • Release tags are accepted only when their signed commit matches both the push event and GitHub’s commit context.
  • Release commits must be contained in protected main; verification rejects changes to main or the tag while checks are running.
  • Ancestry checks use GitHub’s comparison results to accept valid release commits and reject divergent ones.

Impact

✅ Valid release tags pass ancestry checks
✅ Mismatched or retargeted release tags are rejected
✅ Releases are rejected if protected main changes during verification

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

  • Chores
    • Release tags are now checked against the commit associated with the tag push and verified against protected main before being accepted.
  • Documentation
    • Updated the documented test totals to reflect 8,705+ tests across 656 files.