From b03041cdb6f99e2c18e4ecd58d7d93856dcc803c Mon Sep 17 00:00:00 2001 From: "pulse-triage[bot]" <249995291+pulse-triage[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 12:50:23 +0100 Subject: [PATCH] Test release dispatch identity guard against commit drift The candidate publisher rejected its admitted SHA input. Execute the backported workflow guard in focused tests so accepting the input cannot silently permit source or workflow drift before checkout. Change-source: pulse-maintainer --- .../release_promotion_policy_test.py | 25 +++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/scripts/release_control/release_promotion_policy_test.py b/scripts/release_control/release_promotion_policy_test.py index 0b712a641..216cc4598 100644 --- a/scripts/release_control/release_promotion_policy_test.py +++ b/scripts/release_control/release_promotion_policy_test.py @@ -1595,6 +1595,31 @@ class ReleasePromotionPolicyTest(unittest.TestCase): self.assertIn("did not produce a valid promotion metadata envelope", workflow) self.assertIn("Do not use this artifact to clear", workflow) + def test_release_dispatch_rejects_source_or_workflow_drift_before_checkout(self) -> None: + workflow = yaml.safe_load(read(".github/workflows/create-release.yml")) + steps = workflow["jobs"]["prepare"]["steps"] + self.assertEqual(steps[0]["name"], "Verify admitted source commit") + self.assertIn("actions/checkout@", steps[1]["uses"]) + expected = "a" * 40 + other = "b" * 40 + for admitted, source, workflow_sha, succeeds in ( + (expected, expected, expected, True), + (expected, other, expected, False), + (expected, expected, other, False), + (expected, other, other, False), + ("", expected, expected, False), + ("main", expected, expected, False), + ("a" * 39, expected, expected, False), + ): + with self.subTest(admitted=admitted, source=source, workflow=workflow_sha): + result = subprocess.run( + ["bash", "-c", steps[0]["run"]], + env={"PATH": os.defpath, "EXPECTED_SOURCE_SHA": admitted, + "GITHUB_SHA": source, "GITHUB_WORKFLOW_SHA": workflow_sha}, + capture_output=True, text=True, check=False, + ) + self.assertEqual(result.returncode == 0, succeeds, result.stdout + result.stderr) + def test_release_workflow_enforces_rc_lineage_soak_and_v5_notice(self) -> None: content = read(".github/workflows/create-release.yml") update_demo_workflow = read(".github/workflows/update-demo-server.yml")