mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 12:42:38 +00:00
Oliver Kieselbach
f5efadfd07
A tag is a mutable pointer owned by the action's publisher. These jobs are not ordinary CI: they hold the code-signing Key Vault token (D-223), the federated storage credentials (D-222), and combine-rules.yml holds a contents:write token that pushes to main. Whoever could repoint v7 would run code with all of that. azure/login and Azure/functions-action were already pinned; the actions/* and github/codeql-action references were not, on the usual argument that GitHub owns them and shares the runner's trust boundary. That argument does not survive the fact that they run in the same jobs as the signing identity. All seven are now pinned by SHA with the version in a trailing comment -- the comment is what keeps the line reviewable, and Dependabot rewrites both together. action-pins.yml is the guard: pins nobody enforces rot, and no review reliably catches one @v4 added to a 200-line workflow. It lives in its own workflow because ci.yml deliberately ignores changes to the other workflow files, so a job placed there would stay silent for exactly the commits it must inspect. Like CI it reports rather than blocks -- main is unprotected; making it binding would mean adding it as a required status check, which is a branch-protection decision. Verified both directions: 49 references pass against the repo, and a fixture with @v7, @main and a bare SHA fails with three annotations while the local reusable workflow refs are skipped. Two floating tool versions closed while here. wix went from the range 5.* to 5.0.2 -- it writes the bytes of the MSI customers install, where AzureSignTool only signs them. ajv was the worse one: unpinned, and npm runs lifecycle scripts at install, so a hijacked release would have executed with the push token before a single rule was validated; now exact versions with --ignore-scripts. Line endings: sed -i rewrote the workflow files as LF. Git normalises on commit, so the content diff is unaffected and indexnow-notify.yml carries no change at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
64 lines
2.6 KiB
YAML
64 lines
2.6 KiB
YAML
name: Bootstrap script gates
|
|
|
|
# Quality gate for the customer-facing PowerShell scripts, factored out so it exists
|
|
# once and both callers run the identical checks:
|
|
# * pester.yml -- pull requests (reports, does not block the merge button)
|
|
# * publish-scripts.yml -- pushes to main, where it BLOCKS the upload to the
|
|
# download alias. Devices execute these scripts as SYSTEM
|
|
# during enrollment, so a red suite must never ship.
|
|
|
|
on:
|
|
workflow_call:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
gates:
|
|
name: Bootstrap guard tests (PS 5.1)
|
|
runs-on: windows-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
|
|
- name: Install Pester 5+
|
|
shell: powershell
|
|
run: |
|
|
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser | Out-Null
|
|
Install-Module Pester -Scope CurrentUser -Force -SkipPublisherCheck -MinimumVersion 5.5.0
|
|
|
|
# Windows PowerShell 5.1 on purpose: that is the runtime IME uses to execute
|
|
# platform scripts, so guard/relax logic is verified without resetting a device.
|
|
- name: Run Pester
|
|
shell: powershell
|
|
run: |
|
|
Import-Module Pester -MinimumVersion 5.5.0
|
|
$c = New-PesterConfiguration
|
|
$c.Run.Path = 'scripts/Bootstrap'
|
|
$c.Run.Exit = $true
|
|
$c.Output.Verbosity = 'Detailed'
|
|
Invoke-Pester -Configuration $c
|
|
|
|
- name: Guard scripts stay pure ASCII
|
|
shell: powershell
|
|
run: |
|
|
$failed = $false
|
|
Get-ChildItem 'scripts/Bootstrap' -Filter '*.ps1' | ForEach-Object {
|
|
$bytes = [System.IO.File]::ReadAllBytes($_.FullName)
|
|
for ($i = 0; $i -lt $bytes.Length; $i++) {
|
|
if ($bytes[$i] -gt 127) {
|
|
Write-Host "::error file=scripts/Bootstrap/$($_.Name)::Non-ASCII byte 0x$('{0:X2}' -f $bytes[$i]) at offset $i. PS 5.1 (IME) reads BOM-less files as ANSI and corrupts multi-byte chars."
|
|
$failed = $true
|
|
break
|
|
}
|
|
}
|
|
}
|
|
if ($failed) { exit 1 }
|
|
Write-Host 'All bootstrap scripts are pure ASCII.'
|
|
|
|
# The publish chain renders the -Dev variant by literal substitution and refuses to
|
|
# ship when an anchor moved. Running it dry here surfaces that (and any drift against
|
|
# the alias) on the PR instead of on the push that would have published.
|
|
- name: Publish dry run (dev-render anchors + version-bump guard + drift)
|
|
shell: pwsh
|
|
run: ./.github/scripts/Publish-BootstrapScripts.ps1 -DryRun
|