From 2e99ecb5efc1033e3ccff53ed45737fa0f6c81cf Mon Sep 17 00:00:00 2001 From: Bob Date: Tue, 25 Aug 2026 09:25:09 -0400 Subject: [PATCH 1/2] fix: require immutable releases before preparation --- .github/workflows/prepare-release.yml | 7 +++++++ .github/workflows/publish-release.yml | 7 +++++++ 2 files changed, 14 insertions(+) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index 746ad8c..b1264f1 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -13,6 +13,13 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Verify organization-enforced immutable releases + env: + GH_TOKEN: ${{ github.token }} + run: | + test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ + "repos/${GITHUB_REPOSITORY}/immutable-releases" \ + --jq '.enabled and .enforced_by_owner')" = true - name: Install pinned build tools run: | cargo install just --version 1.57.0 --locked diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 6462b17..44898bb 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -44,6 +44,13 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false + - name: Verify organization-enforced immutable releases + env: + GH_TOKEN: ${{ github.token }} + run: | + test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ + "repos/${GITHUB_REPOSITORY}/immutable-releases" \ + --jq '.enabled and .enforced_by_owner')" = true - name: Verify dispatch and candidate build identity env: GH_TOKEN: ${{ github.token }} From 5309bb7a9902ce66af3ad4ede76254ee3f2b4d80 Mon Sep 17 00:00:00 2001 From: Bob Date: Tue, 25 Aug 2026 09:35:21 -0400 Subject: [PATCH 2/2] fix: make immutability a release authorization gate --- .github/workflows/prepare-release.yml | 7 ------- .github/workflows/publish-release.yml | 12 +++++++----- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/.github/workflows/prepare-release.yml b/.github/workflows/prepare-release.yml index b1264f1..746ad8c 100644 --- a/.github/workflows/prepare-release.yml +++ b/.github/workflows/prepare-release.yml @@ -13,13 +13,6 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Verify organization-enforced immutable releases - env: - GH_TOKEN: ${{ github.token }} - run: | - test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ - "repos/${GITHUB_REPOSITORY}/immutable-releases" \ - --jq '.enabled and .enforced_by_owner')" = true - name: Install pinned build tools run: | cargo install just --version 1.57.0 --locked diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index 44898bb..4c3e4a4 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -27,6 +27,10 @@ on: description: Exact approved release-manifest.json SHA-256 required: true type: string + immutable_releases_verified: + description: Release approver verified enabled=true and enforced_by_owner=true via the admin API + required: true + type: boolean permissions: {} @@ -44,13 +48,11 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Verify organization-enforced immutable releases + - name: Require authorized immutable-release preflight env: - GH_TOKEN: ${{ github.token }} + IMMUTABLE_RELEASES_VERIFIED: ${{ inputs.immutable_releases_verified }} run: | - test "$(gh api -H 'X-GitHub-Api-Version: 2026-03-10' \ - "repos/${GITHUB_REPOSITORY}/immutable-releases" \ - --jq '.enabled and .enforced_by_owner')" = true + test "$IMMUTABLE_RELEASES_VERIFIED" = true - name: Verify dispatch and candidate build identity env: GH_TOKEN: ${{ github.token }}