Consume the canonical attestation gate instead of carrying a copy of it - #88
Merged
Merged
Conversation
This repository carried its own 679-line shell scanner and 424-line verifier, duplicated from the same origin as every other package in the fleet. That gate decides whether an artefact may reach the registry, so a false pass is the failure that matters - and the canonical implementation has now had fifteen fail-open constructions found and closed in it, three of them introduced by the fix for an earlier one. A copy frozen at any point in that sequence still admits every construction closed after it, and nothing here would have said so. The scanner is deleted, the verifier becomes a thin launcher over the published pm-ops/attestation export. 2028 lines go, 144 arrive. The suite changes shape deliberately. It no longer re-tests the shell model: that suite belongs with the implementation, where a fix reaches every consumer at once. It asserts instead that this repository is still a CONSUMER - no local scanner, the gate importing the package rather than resolving any part of its shell model locally, and the resolved gate still refusing an unattested publish and passing on this repository's own workflows. Identity rather than similarity, because a copy that behaves the same today is exactly what stops behaving the same the next time the canonical implementation is fixed. Deliberately carries no shebang. The auditor treats any file whose first two bytes are a shebang as executable shell, so adding one pulls this file into its own scan - and its prose, which necessarily names the command it guards, then reads as an unattested invocation. The vendored predecessor had no shebang for the same reason.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR removes the duplicated 1,000+-line attestation implementation and its model-level tests, upgrades to the canonical Sequence diagram for release publish attestation verificationsequenceDiagram
participant Release as Release process
participant Launcher as Attestation launcher
participant Gate as pm-ops/attestation
participant Result as Process result
Release->>Launcher: runIfMain()
Launcher->>Gate: verify(root)
Gate-->>Launcher: audit result
Launcher->>Gate: report(result, stdout, exit)
Gate-->>Result: success or exit code 1
Result-->>Release: verification outcome
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Greptile SummaryThis PR replaces the repository’s vendored publish-attestation scanner with the canonical
Confidence Score: 5/5The PR appears safe to merge; the only previous finding was fully addressed and manually resolved, and no new actionable failure remains. The corrected documentation now distinguishes shell from non-shell shebangs, and the focused regression test reproduces both accepted and rejected cases through the canonical verifier. The launcher imports and re-exports the package implementation directly, rejects an unattested fixture, and successfully audits the repository’s workflows.
|
| Filename | Overview |
|---|---|
| scripts/verify-release-publish-attestation.ts | Replaces the vendored verifier with a thin launcher over the canonical attestation package and corrects the documented shebang behavior. |
| test/verify-release-publish-attestation.test.ts | Replaces implementation-model tests with convergence, launcher, workflow, and reproduced shebang-behavior checks. |
| package.json | Updates pm-ops to the release providing the canonical attestation export. |
| package-lock.json | Locks the canonical gate dependency to pm-ops 2026.9.7 with registry integrity metadata. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Release verification script] --> B[pm-ops/attestation]
B --> C[Scan tracked publish paths]
C --> D{Every publish attested?}
D -->|Yes| E[Report success]
D -->|No| F[Report failures and set exit code 1]
Reviews (2): Last reviewed commit: "Correct a wrong claim about which sheban..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…nd reproduce it The launcher docstring said the auditor treats any file whose first two bytes are a shebang as executable shell. Reproduced against the real auditor, that is false: only a shebang naming a shell interpreter makes the body shell input, so #!/usr/bin/env node leaves this file unscanned while #!/bin/bash does not. The same sentence is in all seven repositories carrying this launcher - the error travelled with the copied text. The suite now reproduces all four states rather than asserting any of them. Found by Greptile's unreproduced-claim rule.
Owner
Author
|
Merging. Measured result for this repository, with the harness at The vendored scanner is deleted and the gate is now the canonical Two review findings changed the shape of this PR, and both were cases where a guard did not do what it claimed:
Thank you to the reviewers on this wave; both of the above came from review, not from the change's author. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository carried its own 679-line shell scanner and 424-line verifier, duplicated from the same origin as every other package in the fleet. That gate decides whether an artefact may reach the registry, so a false pass is the failure that matters. The canonical implementation has had fifteen fail-open constructions found and closed in it; this vendored copy was frozen and still admitted them.
The scanner is deleted, the verifier becomes a thin launcher over
pm-ops/attestation, and the test suite asserts consumption rather than re-testing the shell model. 2028 lines go, 144 arrive.Measurement (check.sh)
nonliteral-overwrite,nonliteral-overwrite-cmdsub,bare-brace-scope-escape,subshell-scope-escape,cmdsub-in-command-position,backtick-command-position,unset-after-bind,if-branch-bind,semicolon-same-line-bind,quoted-metachar-value,single-quoted-metachar-valuenonliteral-overwrite,nonliteral-overwrite-cmdsub,quoted-metachar-value,single-quoted-metachar-valuequoted-metachar-valueandsingle-quoted-metachar-valueare open in the publishedpm-ops@2026.9.7, not a convergence issue. A fix for them exists locally in pm-ops but has not been published; a version bump will close them.Line counts
pm item
Quality gates
npm run check— passnpm run docstring— pass (7 files, 83 declarations)npm run coverage— pass (thresholds 81/77/88 met)npm run verify:release-publish-attestation— passnpm test— pass (263 tests)npm run changelog:full— passnpm run changelog:check— passSummary by Sourcery
Use the canonical
pm-opsattestation gate instead of maintaining a duplicated local scanner and verifier.Bug Fixes:
Enhancements:
pm-ops/attestation.Build:
pm-opsdependency to^2026.9.7.Documentation:
Tests:
Chores:
Summary by cubic
Replaces the repo's frozen publish-attestation gate (a 679-line shell scanner plus a 424-line verifier) with the canonical
pm-opsimplementation, closing fail-open publish paths the stale copy still admitted. The verifier becomes a thin launcher, and tests now assert consumption of the canonical gate instead of re-testing the shell model.Refactors
scripts/shell-command-scan.tsand its test; the verifier shrinks from 407 to 38 lines as a thin launcher overpm-ops/attestation.Dependencies
pm-opsfrom2026.8.28to^2026.9.7.quoted-metachar-valueandsingle-quoted-metachar-valuestill failcheck.shon the publishedpm-ops@2026.9.7; the fix exists locally and a future bump closes them.Written for commit b93699d. Summary will update on new commits.