Keep reusable workflow operands verifiable by the canonical auditor

Merged
UN
5d ago
+204-50

Dependabot PR #135 fails this repository's own workflows pass the gate: the updated canonical pm-ops auditor reports 38 unresolved executable positions in the reusable workflows. The coverage-error lines elsewhere in that job are expected gate self-test output.

Express dynamic workflow data as operands to literal commands so its executable boundary is provable:

  • Validate whole remote tag names before binding associative-array elements through declare.
  • Validate numeric versions as NUL-delimited whole values through grep, rejecting multiline inputs while retaining numeric suffixes and annotated-tag behavior.
  • Populate literal Git pathspec data through printf/mapfile, and classify paths with conditional tests and explicit continuations.

The shared auditor remains the resolved package export, with every finding enforced. The publication scope and safety properties are exercised with real workflow shell, literal tracker names, runtime exclusions, malformed tags, multiline versions, and tag text that must remain data.

The overlay also exposed an untested artifact-time branch in its refreshed canonical prepare launcher. Added pack/publish omission-path tests that preserve Git config and attributes and pass against both canonical launcher generations. Focused launcher coverage is 100/100/100/100 with 10/10 tests.

Validation: Under the exact complete #135 overlay, npm run release:check and bun run release:check with isolated CI identity each pass 766/766 tests, zero failures/skips, with all 13 authored modules at exactly 100% statements, branches, functions and lines. Restored the original dependency pins and launcher, installed with npm ci, and passed 64/64 focused baseline compatibility tests. Linked pm commands pass 56/56; final strict pm health, changelog and privacy checks pass.

Applied the exact full #135 diff over this fix, including both dependency updates and the merge-driver launcher refresh, then installed it with npm ci. The applied diff is byte-identical to the PR diff (SHA-256 c72710900b72ae73365b959aaf184821d1d49417f64434509a0f120d31af3aea). Under that overlay, restoring only the original workflow shell reproduces all 38 findings and fails the repository regression; restoring the fix passes 1/1 with zero skips. Focused release-tag tests pass 42/42 and literal-scope tests pass 4/4. Dependency changes are temporary proof inputs and are excluded from this PR.

The design and verification notes describe the operand-boundary property. Import fidelity PR #142 remains separate.

PM: pm-github-7c95.

Summary by Sourcery

Harden reusable workflows so every dynamic value remains verifiable as literal operand data by the canonical auditor.

Bug Fixes:

  • Make reusable workflow release-tag and version handling reject unsafe or multiline values while preserving annotated-tag resolution and numeric-version validation.
  • Prevent dynamic tracker and path data from being interpreted as executable workflow syntax, while retaining publication allowlists and runtime exclusions.

Enhancements:

  • Add documentation describing the operand-boundary attestation property and its verification against the canonical auditor.

Documentation:

  • Document the reusable workflow operand-boundary guarantees, retained safety properties, and verification coverage.

Tests:

  • Add workflow operand tests covering literal tracker names, pathspec exclusions, rejected paths, malformed and multiline versions, malicious tag text, and annotated tags.
  • Add artifact-time pack and publish tests verifying omission notices and unchanged Git configuration and attributes.

Chores:

  • Record the associated PM issue and history metadata.

Summary by cubic

Reworks the reusable workflow shell so the canonical auditor can prove every dynamic value is operand text, clearing the 38 unresolved executable positions the updated pm-ops auditor reports under Dependabot PR #135. No auditor finding is pinned, filtered, or exempted.

  • Validates whole remote tag names before binding associative-array elements through declare, and rejects multiline versions as NUL-delimited whole grep values.
  • Builds pathspec arrays with printf/mapfile and classifies paths with conditional tests instead of dynamic case arms.
  • Adds literal-operand tests and pack/publish omission regressions that leave Git config and attributes unchanged; a new doc describes the operand-boundary property.

The dependency changes from the overlay are temporary proof inputs and are excluded from this PR.

CI receipt at 25835e48e31246a3f4b1e48db7bf362e5d453a67: required test (22) and test (26) pass, including native Bun acceptance; CodeQL and Semgrep pass. Skipped/neutral reviewer checks are not treated as approval.