gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Test release dispatch identity guard against commit drift

Browse Source 
The candidate publisher rejected its admitted SHA input. Execute the backported workflow guard in focused tests so accepting the input cannot silently permit source or workflow drift before checkout.

Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-09-07 12:50:23 +01:00
parent 8f516a014b
commit b03041cdb6
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/release_control/release_promotion_policy_test.py
+25
View File
@@ -1595,6 +1595,31 @@ class ReleasePromotionPolicyTest(unittest.TestCase):
self.assertIn("did not produce a valid promotion metadata envelope", workflow)
self.assertIn("Do not use this artifact to clear", workflow)
def test_release_dispatch_rejects_source_or_workflow_drift_before_checkout(self) -> None:
workflow = yaml.safe_load(read(".github/workflows/create-release.yml"))
steps = workflow["jobs"]["prepare"]["steps"]
self.assertEqual(steps[0]["name"], "Verify admitted source commit")
self.assertIn("actions/checkout@", steps[1]["uses"])
expected = "a" * 40
other = "b" * 40
for admitted, source, workflow_sha, succeeds in (
(expected, expected, expected, True),
(expected, other, expected, False),
(expected, expected, other, False),
(expected, other, other, False),
("", expected, expected, False),
("main", expected, expected, False),
("a" * 39, expected, expected, False),
):
with self.subTest(admitted=admitted, source=source, workflow=workflow_sha):
result = subprocess.run(
["bash", "-c", steps[0]["run"]],
env={"PATH": os.defpath, "EXPECTED_SOURCE_SHA": admitted,
"GITHUB_SHA": source, "GITHUB_WORKFLOW_SHA": workflow_sha},
capture_output=True, text=True, check=False,
)
self.assertEqual(result.returncode == 0, succeeds, result.stdout + result.stderr)
def test_release_workflow_enforces_rc_lineage_soak_and_v5_notice(self) -> None:
content = read(".github/workflows/create-release.yml")
update_demo_workflow = read(".github/workflows/update-demo-server.yml")