Repository navigation
ci: verify Composer trust before CLI builds - #63
Merged
Merged
Conversation
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
Continues durable-workflow/.github#237. The CLI test, PHAR and reproducibility
jobs select the reviewed public CA bundle, pin Composer 2.10.3, and verify its
actual version and effective file/directory immediately before Composer runs.
The release PHAR builder does the same. Central preflight uses the current
reviewed bootstrap. Product source, lock, version and release-channel rules
are unchanged.
Native launcher qualification restores the exact PHAR builder's locked vendor
artifact by artifact ID with digest mismatch refusal and one-day retention.
It no longer performs a separate unguarded Composer installation on each
native runner. The existing macOS Homebrew PHP workaround remains; Composer
is no longer needed there. This does not qualify a new native binary or move
an immutable release.
Verification
Current central policy with the stricter CLI Composer requirement enabled
refuses the preceding workflow and accepts the complete candidate. That flag
is changed only in the temporary validation input; central main policy is
unchanged. Intermediate local candidates were correctly refused for a stale
verification and the previously missed native launcher installation; neither
is presented as qualified.
The six existing/extended release metadata controls pass; the preceding release
workflow fails the new dependency-artifact control while its five old controls
pass. Parsing uses the normal PyYAML 6.0.2 wheel after independently checking
its published SHA-256; local execution is offline.
git diff --checkpasses.Exact candidate
4dc51f62d76c1bf4694cf7ae882b8636dc1ab7be/ whole4e377a3eefa6e13a0ec91d495ecd222515904569passes all 15 applicable checks,including PHP 8.2–8.5, PHAR, bit-identical rebuilds, central policy and Sonar.
The Sonar issue API has zero OPEN/CONFIRMED findings.
The CodeQL summary is NEUTRAL with a missing-actions-configuration warning;
it is not called green. The actual default-setup records independently show
all three analyses on this exact head at
refs/pull/63/head: actions2010766807, JavaScript/TypeScript 2010766747 and Python 2010766677. Each has
an empty error and zero results. All three Analyze jobs pass. No configuration
is disabled or reset to hide the summary warning; its aggregation cause is
not established.
Actual protected native release execution remains a separate #237 acceptance
step. No CI-only change establishes a rebuilt public artifact or completes the
organization-wide security follow-through.