Consume the canonical attestation gate instead of carrying a copy of it - #103
Merged
Conversation
This repository carried its own 711-line shell scanner and 452-line verifier, duplicated from the same origin as every other package in the fleet. That gate decides whether an artefact may reach the registry, so a false pass is the failure that matters - and the canonical implementation has now had fifteen fail-open constructions found and closed in it, three of them introduced by the fix for an earlier one. A copy frozen at any point in that sequence still admits every construction closed after it, and nothing here would have said so. The scanner is deleted, the verifier becomes a thin launcher over the published pm-ops/attestation export. 2086 lines go, 141 arrive. The suite changes shape deliberately. It no longer re-tests the shell model: that suite belongs with the implementation, where a fix reaches every consumer at once. It asserts instead that this repository is still a CONSUMER - no local scanner, the gate importing the package rather than resolving any part of its shell model locally, and the resolved gate still refusing an unattested publish and passing on this repository's own workflows. Identity rather than similarity, because a copy that behaves the same today is exactly what stops behaving the same the next time the canonical implementation is fixed. Deliberately carries no shebang. The auditor treats any file whose first two bytes are a shebang as executable shell, so adding one pulls this file into its own scan - and its prose, which necessarily names the command it guards, then reads as an unattested invocation. The vendored predecessor had no shebang for the same reason.
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Reviewer's GuideThis PR removes the frozen, duplicated attestation gate and makes the release verifier a thin launcher over the canonical File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Greptile SummaryThis PR replaces the repository’s stale, vendored publish-attestation scanner with the canonical
Confidence Score: 5/5The PR appears safe to merge; the follow-up changes correct and directly test the launcher’s shebang documentation without introducing a new functional issue. No accepted new findings or outstanding blocking failures remain. The verifier delegates to the locked canonical implementation, preserves failure reporting and exit behavior through the launcher, and tests both canonical identity and rejection of unattested publishes.
|
| Filename | Overview |
|---|---|
| scripts/verify-release-publish-attestation.ts | Replaces the local verifier implementation with a thin launcher and direct re-exports from pm-ops/attestation. |
| test/verify-release-publish-attestation.test.ts | Replaces duplicated scanner-model tests with package-identity, behavior, launcher, repository-gate, and shebang-classification checks. |
| scripts/shell-command-scan.ts | Deletes the obsolete vendored shell scanner now supplied by the canonical package. |
| package.json | Advances the canonical pm-ops dependency to the release containing the consolidated attestation gate. |
| package-lock.json | Locks pm-ops 2026.9.7 with its registry URL and integrity digest. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
Release[Release verification command] --> Launcher[scripts/verify-release-publish-attestation.ts]
Launcher --> Canonical[pm-ops/attestation]
Canonical --> Scan[Inspect tracked publish sources]
Scan --> Decision{Every publish attested?}
Decision -->|Yes| Pass[Exit successfully]
Decision -->|No| Fail[Report failures and exit 1]
Reviews (2): Last reviewed commit: "Correct a wrong claim about which sheban..." | Re-trigger Greptile
…nd reproduce it The launcher docstring said the auditor treats any file whose first two bytes are a shebang as executable shell. Reproduced against the real auditor, that is false: only a shebang naming a shell interpreter makes the body shell input, so #!/usr/bin/env node leaves this file unscanned while #!/bin/bash does not. The same sentence is in all seven repositories carrying this launcher - the error travelled with the copied text. The suite now reproduces all four states rather than asserting any of them. Found by Greptile's unreproduced-claim rule.
Owner
Author
|
Merging. Measured result for this repository, with the harness at The vendored scanner is deleted and the gate is now the canonical Two review findings changed the shape of this PR and are worth naming, because both were cases where the guard did not do what it claimed:
Thank you to the reviewers on this wave; both of the above came from review, not from the change's author. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repository carried its own 711-line shell scanner and 452-line verifier, duplicated from the same origin as every other package in the fleet. That gate decides whether an artefact may reach the registry, so a false pass is the failure that matters. The canonical implementation has had fifteen fail-open constructions found and closed in it; this vendored copy was frozen and still admitted them.
The scanner is deleted, the verifier becomes a thin launcher over
pm-ops/attestation, and the test suite asserts consumption rather than re-testing the shell model. 2086 lines go, 141 arrive.Measurement (check.sh)
nonliteral-overwrite,nonliteral-overwrite-cmdsub,bare-brace-scope-escape,subshell-scope-escape,cmdsub-in-command-position,backtick-command-position,unset-after-bind,if-branch-bind,semicolon-same-line-bind,quoted-metachar-value,single-quoted-metachar-valuenonliteral-overwrite,nonliteral-overwrite-cmdsub,quoted-metachar-value,single-quoted-metachar-valuequoted-metachar-valueandsingle-quoted-metachar-valueare open in the publishedpm-ops@2026.9.7, not a convergence issue. A fix for them exists locally in pm-ops but has not been published; a version bump will close them.Line counts
pm item
Quality gates
npm run check— passnpm run docstring— pass (7 files, 47 declarations)npm run coverage— pass (thresholds 70/80/80 met)npm run verify:release-publish-attestation— passnpm test— pass (114 tests)npm run changelog:full— passnpm run changelog:check— passSummary by Sourcery
Consume the canonical
pm-opsattestation gate so release publishing uses the centrally maintained security checks.Bug Fixes:
Enhancements:
pm-ops/attestationimplementation.Build:
pm-opsdependency to version2026.9.7.Tests:
Chores:
Summary by cubic
Replaces the vendored 711-line shell scanner and 452-line verifier with the canonical attestation gate from
pm-ops, closing fail-open constructions the frozen copy still admitted.Refactors
pm-ops/attestation.pm-opsto2026.9.7;quoted-metachar-valueandsingle-quoted-metachar-valueremain open there and close in a later version bump.Written for commit 2ae8254. Summary will update on new commits.