fix(release): harden the release pipeline before signing secrets land (#1)

* fix(release): harden the signers, release workflow and updater

* fix(update): keep HERMES_DATA_DIR_SUFFIX for the refresh after a rollback

* fix(release): satisfy CI's shellcheck and describe the code-owner rulesets

Author: adamdotdevin

.github/release/client.sh.sha256

@@ -0,0 +1 @@
+f19e3852cca5b675a0871487a035fc5ed42a871df429da10fd688568d1ad526e

.github/release/lib.sh

@@ -74,17 +74,69 @@ target_file() {
   printf '%s' "$file"
 }
 
-# repack <work dir> <out tarball>: packs <work dir>/package as npm pack lays it out (files only, root-owned, fixed
-# mtime, the binary 0755 and the rest 0644), so publish-npm.sh's listing check holds for a re-signed tarball.
+# release_client <out>: downloads the release service's client (https://anoma.ly/release/client.sh) to <out> and checks
+# it against the SHA-256 pinned in client.sh.sha256 before anything runs it, so a change to the served client can't run
+# in a job holding an OIDC token until a reviewed change here pins it. RELEASING.md says how to move the pin.
+release_client() {
+  local out=$1 pinned actual
+  pinned=$(tr -d ' \n' < "$(dirname "${BASH_SOURCE[0]}")/client.sh.sha256")
+  curl -fsSL --retry 5 --retry-all-errors "${RELEASE_ORIGIN:-https://anoma.ly/release}/client.sh" -o "$out"
+  actual=$(sha256 "$out" | cut -c1-64)
+  [ "$actual" = "$pinned" ] || die "The release service's client.sh has SHA-256 $actual, not the pinned $pinned (.github/release/client.sh.sha256)."
+}
+
+# members <target> [signed]: the files a target's tarball holds, as npm pack lays them out and in the order repack writes
+# them: LICENSE, the binary (opencode-console.exe on Windows), with "signed" the Linux binary's .sig, and package.json.
+members() {
+  local executable=opencode-console
+  case "$1" in windows-*) executable=opencode-console.exe ;; esac
+  if [ "${2:-}" = signed ]; then
+    printf '%s' "package/LICENSE package/bin/$executable package/bin/$executable.sig package/package.json"
+  else
+    printf '%s' "package/LICENSE package/bin/$executable package/package.json"
+  fi
+}
+
+# unpack <tarball> <dir> <member>...: extracts a tarball that holds exactly <member>..., each once and each a regular
+# file, into <dir>. Anything else (a directory, a link, a duplicate, an extra entry, a name with a newline, which lists as
+# two lines or escaped and so never matches) fails the run before a byte of it is written.
+unpack() {
+  local file=$1 dir=$2 names expected member
+  shift 2
+  names=$(tar -tzf "$file") || die "$file is not a gzipped tarball."
+  expected=$(printf '%s\n' "$@" | LC_ALL=C sort)
+  [ "$(printf '%s\n' "$names" | LC_ALL=C sort)" = "$expected" ] ||
+    die "$file must hold exactly $*, and holds: $(printf '%s' "$names" | tr '\n' ' ')"
+  # Every entry a regular file: GNU tar and bsdtar list one with a leading "-" and no "link to" or "->" after it.
+  while IFS= read -r line; do
+    case "$line" in -*) ;; *) die "$file has an entry that isn't a regular file: $line" ;; esac
+    case "$line" in *" link to "* | *" -> "*) die "$file has a link: $line" ;; esac
+  done < <(tar -tvzf "$file")
+  mkdir -p "$dir"
+  tar -xzf "$file" -C "$dir" -- "$@"
+  for member in "$@"; do
+    if [ ! -f "$dir/$member" ] || [ -L "$dir/$member" ]; then die "$file's $member didn't unpack as a regular file."; fi
+  done
+}
+
+# repack <work dir> <out tarball> <member>...: packs exactly <member>... from <work dir> as npm pack lays them out
+# (files only, root-owned, fixed mtime, the binary 0755 and the rest 0644), so publish-npm.sh's listing check holds for
+# a re-signed tarball. The names are the caller's fixed list, never read back from the unpacked tree.
 repack() {
-  local work=$1 out=$2
-  find "$work/package" -type f -exec chmod 644 {} +
-  find "$work/package/bin" -type f ! -name '*.sig' -exec chmod 755 {} +
-  find "$work/package" -type f -exec touch -t 198001010000 {} +
-  (cd "$work" && find package -type f | LC_ALL=C sort > "$work/files")
+  local work=$1 out=$2 member
+  shift 2
+  for member in "$@"; do
+    if [ ! -f "$work/$member" ] || [ -L "$work/$member" ]; then die "$work/$member is not a regular file."; fi
+    case "$member" in
+      package/bin/*.sig | package/LICENSE | package/package.json) chmod 644 "$work/$member" ;;
+      package/bin/*) chmod 755 "$work/$member" ;;
+      *) die "repack doesn't pack $member." ;;
+    esac
+    touch -t 198001010000 "$work/$member"
+  done
   if tar --version 2> /dev/null | grep -q GNU; then
-    tar --owner 0 --group 0 --numeric-owner -czf "$out" -C "$work" -T "$work/files"
+    tar --owner 0 --group 0 --numeric-owner -czf "$out" -C "$work" -- "$@"
   else
-    COPYFILE_DISABLE=1 tar --no-mac-metadata --uid 0 --gid 0 -czf "$out" -C "$work" -T "$work/files"
+    COPYFILE_DISABLE=1 tar --no-mac-metadata --uid 0 --gid 0 -czf "$out" -C "$work" -- "$@"
   fi
 }

.github/release/publish-release-service.sh

@@ -44,7 +44,7 @@ fi
 
 work=$(mktemp -d)
 trap 'rm -rf "$work"' EXIT
-curl -fsSL --retry 5 --retry-all-errors "$release/client.sh" -o "$work/client.sh"
+RELEASE_ORIGIN=$release release_client "$work/client.sh"
 # npm's copy is recorded once it's on npm (publish-npm.sh); dev builds aren't published there.
 distributions='[{"kind":"direct"}]'
 if [ "$CONSOLE_CHANNEL" != dev ]; then

.github/release/reserve-tag.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# reserve-tag.sh: claims refs/tags/v$CONSOLE_VERSION at $SHA before a stable release publishes anything, so the tag
+# `finish` releases can't point at another commit. Creates it through the API; when it already exists, resolves it,
+# peeling annotated tags, and fails unless it's $SHA. A rerun of the same run, or a new run at the same commit, finds
+# its own tag and goes on.
+#
+# Environment: CONSOLE_VERSION, SHA, GH_REPO, GH_TOKEN (contents: write).
+. "$(dirname "$0")/lib.sh"
+
+: "${CONSOLE_VERSION:?Set CONSOLE_VERSION}" "${SHA:?Set SHA}" "${GH_REPO:?Set GH_REPO}"
+[[ "$SHA" =~ ^[0-9a-f]{40}$ ]] || die "SHA must be a full commit SHA, not $SHA"
+tag="v$CONSOLE_VERSION"
+
+if gh api -X POST "repos/$GH_REPO/git/refs" -f "ref=refs/tags/$tag" -f "sha=$SHA" > /dev/null 2>&1; then
+  summary "Reserved $tag at $SHA."
+  exit 0
+fi
+
+# It exists, or the API refused for another reason, which reading it back tells apart.
+ref=$(gh api "repos/$GH_REPO/git/ref/tags/$tag") || die "Couldn't create $tag, and it doesn't exist."
+type=$(jq -r .object.type <<< "$ref") object=$(jq -r .object.sha <<< "$ref")
+for _ in 1 2 3 4 5 6 7 8; do
+  [ "$type" = tag ] || break
+  peeled=$(gh api "repos/$GH_REPO/git/tags/$object")
+  type=$(jq -r .object.type <<< "$peeled") object=$(jq -r .object.sha <<< "$peeled")
+done
+[ "$type" = commit ] || die "$tag points at a $type, not a commit."
+[ "$object" = "$SHA" ] || die "$tag already points at $object, not this run's $SHA. Bump the version, or delete the tag if it was made by mistake."
+summary "$tag is already at $SHA; this run goes on."

.github/release/sign-linux.sh

@@ -29,8 +29,8 @@ for target in $TARGETS; do
   case "$target" in linux-*) ;; *) continue ;; esac
   file="$in/$(tarball_name "$target")"
   test -s "$file" || die "Missing $file"
-  mkdir -p "$work/$target"
-  tar -xzf "$file" -C "$work/$target" package/package.json package/LICENSE package/bin/opencode-console
+  read -ra unsigned <<< "$(members "$target")"
+  unpack "$file" "$work/$target" "${unsigned[@]}"
   bin="$work/$target/package/bin/opencode-console"
   sha=$(sha256 "$bin" | cut -c1-64)
   printf 'anomaly.opencode-console.linux-artifact.v1\n%s\n' "$sha" > "$work/message"
@@ -40,6 +40,7 @@ for target in $TARGETS; do
   openssl pkeyutl -verify -rawin -pubin -inkey "$public" \
     -in "$work/message" -sigfile "$bin.sig" > /dev/null ||
     die "CONSOLE_CLI_RELEASE_SIGNING_KEY does not match linux-signing.pub, the key the updater trusts."
-  repack "$work/$target" "$out/$(tarball_name "$target")"
+  read -ra signed <<< "$(members "$target" signed)"
+  repack "$work/$target" "$out/$(tarball_name "$target")" "${signed[@]}"
   echo "Signed $target ($sha)."
 done

.github/release/sign-macos.sh

@@ -26,15 +26,15 @@ export COPYFILE_DISABLE=1
 for target in darwin-arm64 darwin-x64 darwin-x64-baseline; do
   file="$in/$(tarball_name "$target")"
   test -s "$file" || die "Missing $file"
-  mkdir -p "$work/$target"
-  tar -xzf "$file" -C "$work/$target" package/package.json package/LICENSE package/bin/opencode-console
+  read -ra files <<< "$(members "$target")"
+  unpack "$file" "$work/$target" "${files[@]}"
   bin="$work/$target/package/bin/opencode-console"
   file -b "$bin" | grep -q '^Mach-O' || die "$target is not a Mach-O binary"
   if dry_run; then
     codesign --force --options runtime --entitlements "$release/entitlements/cli.plist" \
       --identifier anomaly.opencode-console --sign - "$bin"
     codesign --verify --strict --verbose=2 -R='identifier "anomaly.opencode-console"' "$bin"
-    repack "$work/$target" "$out/$(tarball_name "$target")"
+    repack "$work/$target" "$out/$(tarball_name "$target")" "${files[@]}"
     echo "Dry run: signed $(tarball_name "$target") ad hoc."
     continue
   fi
@@ -57,6 +57,6 @@ for target in darwin-arm64 darwin-x64 darwin-x64-baseline; do
     [ "$attempt" -lt 6 ] || die "$target doesn't satisfy macos-requirement.txt after notarization."
     sleep 20
   done
-  repack "$work/$target" "$out/$(tarball_name "$target")"
+  repack "$work/$target" "$out/$(tarball_name "$target")" "${files[@]}"
   echo "Signed and notarized $(tarball_name "$target")."
 done

.github/release/windows-binaries.sh

@@ -6,18 +6,19 @@
 
 action=$1
 for target in windows-x64 windows-x64-baseline; do
+  read -ra files <<< "$(members "$target")"
   case "$action" in
     unpack)
       in=$(posix "$2") work=$(posix "$3")
-      mkdir -p "$work/$target" "$work/sign"
-      tar -xzf "$in/$(tarball_name "$target")" -C "$work/$target" package/package.json package/LICENSE package/bin/opencode-console.exe
+      mkdir -p "$work/sign"
+      unpack "$in/$(tarball_name "$target")" "$work/$target" "${files[@]}"
       cp "$work/$target/package/bin/opencode-console.exe" "$work/sign/opencode-console-$target.exe"
       ;;
     repack)
       work=$(posix "$2") out=$(posix "$3")
       mkdir -p "$out"
       cp "$work/sign/opencode-console-$target.exe" "$work/$target/package/bin/opencode-console.exe"
-      repack "$work/$target" "$out/$(tarball_name "$target")"
+      repack "$work/$target" "$out/$(tarball_name "$target")" "${files[@]}"
       echo "Signed $(tarball_name "$target")."
       ;;
     *) die "Usage: windows-binaries.sh unpack <binaries> <work> | repack <work> <out>" ;;

.github/workflows/promotion-pr.yml

@@ -26,7 +26,10 @@ jobs:
         run: |
           set -euo pipefail
 
-          pr="$(gh pr list --base production --head dev --state open --json url --jq '.[0].url // empty')"
+          # --head matches a branch name in any fork, so a fork's own dev could stand in for this one: only a PR
+          # from this repository's dev counts.
+          pr="$(gh pr list --base production --head dev --state open --json url,isCrossRepository,headRepository \
+            --jq "[.[] | select(.isCrossRepository == false and .headRepository.nameWithOwner == \"$GH_REPO\")][0].url // empty")"
           if [[ -n "$pr" ]]; then
             echo "Promotion PR already open: $pr"
             exit 0

.github/workflows/publish-console-cli.yml

@@ -25,7 +25,9 @@ run-name: "${{ github.event_name == 'workflow_dispatch' && format('Console CLI {
 # - The release service runs in environment release (dev and production), which holds no secrets: the service admits
 #   it by OIDC. npm runs in environment npm (production only, no secrets), which every package's trusted publishing
 #   names, so no dev run can mint a token npm accepts.
-# .github/ is the security boundary for releases: changes to it need review by someone who may release.
+# .github/ is the security boundary for releases. Changes to it need a code owner's review, which repository admins
+# may skip when merging a pull request. Required Checks and the merge methods apply to everyone, and only admins and
+# maintainers may merge into production.
 
 on:
   push:
@@ -119,10 +121,14 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .node-version
+          package-manager-cache: false
+      # No step here restores a cache: dev is the default branch, so a production run could restore one a dev run
+      # wrote, and the build would run what it holds.
       - &setup-bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
           bun-version: "1.4.3"
+          no-cache: true
       - run: bun install --frozen-lockfile
       # Stamped into the checkout only, never committed.
       - &stamp
@@ -274,8 +280,9 @@ jobs:
           name: signed-macos
           path: ${{ runner.temp }}/signed
 
-  # Authenticode through Azure Artifact Signing for the two Windows binaries, signed in by OIDC (the federated
-  # credential names repo:anomalyco/opencode-console-cli:environment:signing). A check run repacks them unsigned.
+  # Authenticode through Azure Artifact Signing for the two Windows binaries, signed in by OIDC. This repository uses
+  # immutable OIDC subjects, so the federated credential names
+  # repo:anomalyco@66570915/opencode-console-cli@1452060248:environment:signing. A check run repacks them unsigned.
   sign-windows:
     name: Sign the Windows binaries
     needs: [plan, build-binaries]
@@ -352,6 +359,8 @@ jobs:
           timestamp-digest: SHA256
           description: OpenCode Console CLI
           description-url: https://opencode.ai/console
+          # Its PowerShell module and build tools would otherwise come from a cache any branch's run can write.
+          cache-dependencies: false
           exclude-environment-credential: true
           exclude-workload-identity-credential: true
           exclude-managed-identity-credential: true
@@ -424,16 +433,42 @@ jobs:
 
   # ---- Publish: only .github/release/ is checked out; artifacts are data --------------------------------------------
 
+  # Stable only, before anything leaves GitHub: claims refs/tags/v<version> at this run's commit (reserve-tag.sh), so a
+  # tag someone made at another commit stops the release before it publishes rather than after. A rerun at the same
+  # commit finds its own tag.
+  reserve-tag:
+    name: Reserve the release tag
+    needs: [plan, build, build-binaries, sign-macos, sign-windows, sign-linux]
+    if: >-
+      ${{ !cancelled() && needs.plan.outputs.mode == 'stable' && needs.build.result == 'success'
+      && needs.build-binaries.result == 'success' && needs.sign-macos.result == 'success'
+      && needs.sign-windows.result == 'success' && needs.sign-linux.result == 'success' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    environment: release
+    permissions:
+      contents: write # creates the tag's ref
+    steps:
+      - *checkout-release
+      - name: Reserve
+        run: bash .github/release/reserve-tag.sh
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          CONSOLE_VERSION: ${{ needs.plan.outputs.version }}
+          SHA: ${{ github.sha }}
+
   # The job's OIDC token is the only credential; the service checks it against its registry entry for opencode-console
   # (this repository and workflow, environment release, dev for channel dev and production for stable and beta).
   publish-release-service:
     name: Publish to the release service
-    needs: [plan, build, build-binaries, sign-macos, sign-windows, sign-linux]
-    # Dev skips signing; every other run needs all three signed.
+    needs: [plan, build, build-binaries, sign-macos, sign-windows, sign-linux, reserve-tag]
+    # Dev skips signing; every other run needs all three signed, and stable its tag reserved.
     if: >-
       ${{ !cancelled() && needs.build.result == 'success' && needs.build-binaries.result == 'success'
       && (needs.plan.outputs.mode == 'dev' || (needs.sign-macos.result == 'success'
-      && needs.sign-windows.result == 'success' && needs.sign-linux.result == 'success')) }}
+      && needs.sign-windows.result == 'success' && needs.sign-linux.result == 'success'))
+      && (needs.plan.outputs.mode != 'stable' || needs.reserve-tag.result == 'success') }}
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     environment: ${{ needs.plan.outputs.dry_run != 'true' && 'release' || '' }}
@@ -485,6 +520,7 @@ jobs:
         with:
           node-version: "24"
           check-latest: true
+          package-manager-cache: false
       - *download-all
       - name: Publish
         run: |
@@ -518,7 +554,8 @@ jobs:
           CONSOLE_VERSION: ${{ needs.plan.outputs.version }}
           CONSOLE_CHANNEL: ${{ needs.plan.outputs.channel }}
         run: |
-          curl -fsSL --retry 5 --retry-all-errors https://anoma.ly/release/client.sh -o "$RUNNER_TEMP/client.sh"
+          . .github/release/lib.sh
+          release_client "$RUNNER_TEMP/client.sh"
           bash "$RUNNER_TEMP/client.sh" distribution --app opencode-console --artifact cli --channel "$CONSOLE_CHANNEL" \
             --entry "$(jq -nc --arg version "$CONSOLE_VERSION" '{kind: "npm", version: $version}')"
       - name: Tag and GitHub release
@@ -528,12 +565,19 @@ jobs:
           GH_REPO: ${{ github.repository }}
           CONSOLE_VERSION: ${{ needs.plan.outputs.version }}
           SHA: ${{ github.sha }}
+        # The tag reserve-tag made at this commit; --verify-tag refuses to make one. A rerun after the release was made
+        # uploads its files again in place.
         run: |
           . .github/release/lib.sh
-          files=()
+          files=("$RUNNER_TEMP/in/build/opencode-console-$CONSOLE_VERSION.tgz")
           for target in $TARGETS; do
             files+=("$(target_file "$target" "$RUNNER_TEMP/in/binaries" "$RUNNER_TEMP/in/signed-macos" "$RUNNER_TEMP/in/signed-windows" "$RUNNER_TEMP/in/signed-linux")")
           done
-          gh release create "v$CONSOLE_VERSION" --target "$SHA" --title "OpenCode Console CLI $CONSOLE_VERSION" \
-            --notes "@opencode/console $CONSOLE_VERSION: https://anoma.ly/release/opencode-console/cli/stable.json" \
-            "$RUNNER_TEMP/in/build/opencode-console-$CONSOLE_VERSION.tgz" "${files[@]}"
+          SHA=$SHA bash .github/release/reserve-tag.sh
+          if gh release view "v$CONSOLE_VERSION" > /dev/null 2>&1; then
+            gh release upload "v$CONSOLE_VERSION" --clobber "${files[@]}"
+          else
+            gh release create "v$CONSOLE_VERSION" --verify-tag --title "OpenCode Console CLI $CONSOLE_VERSION" \
+              --notes "@opencode/console $CONSOLE_VERSION: https://anoma.ly/release/opencode-console/cli/stable.json" \
+              "${files[@]}"
+          fi

AGENTS.md

@@ -18,7 +18,8 @@ every push to it publishes a dev build. Beta and stable releases are dispatched
   `src/hermes*.ts`: each agent's setup, hook or in-process plugin.
 - `src/credentials.ts`, `src/store.ts`: the sign-in and the CLI's data directory.
 - `src/install.ts`, `src/update/`: where setup installs the CLI, self-update, signature checks and rollback.
-- `install`, `install.ps1`: the standalone installers served at `https://opencode.ai/console/install[.ps1]`.
+- `install`, `install.ps1`: the standalone installers, from `production` on `raw.githubusercontent.com` until Console
+  serves them at `https://opencode.ai/console/install[.ps1]` (RELEASING.md, "The installers").
 - `.github/release/`: the release scripts. Jobs holding secrets run only these.
 - `test/support/`: the stand-in Console and release service every test runs against.
 
@@ -59,4 +60,6 @@ every push to it publishes a dev build. Beta and stable releases are dispatched
 
 Pull requests squash-merge into `dev`, and every push to `dev` publishes a dev build. `dev` reaches `production`
 through the promotion pull request, merged with a merge commit. Stable and beta are dispatched on `production`; see
-`RELEASING.md`. Changes under `.github/` need a code owner's review.
+`RELEASING.md`. Changes under `.github/` need a code owner's review, which repository admins may skip when merging a
+pull request; required `Checks` and the merge methods apply to everyone, and only admins and maintainers may merge
+into `production`.