Repository navigation
fix(signing): validate release ancestry against protected main - #1207
Conversation
Bind version-tag verification to the push event SHA and check protected-main ancestry using the compare response's base_commit and merge_base_commit fields. Recheck the annotated tag ref before returning the verified target SHA.\n\nAdd regressions for real-shaped ahead and identical responses, malformed or divergent comparisons, and preserve the existing pull-request signature path.
|
The latest updates on your projects. Learn more about Vercel for GitHub. 1 Skipped Deployment
|
|
| Status | Commit | Started (UTC) | Finished (UTC) |
|---|---|---|---|
✅ #05ecf Reviewed your PR |
3d38186 |
Nov 08, 2026 · 22:04 | 22:07 |
✅ #e3cba Reviewed your PR |
ea8d1f3 |
Nov 08, 2026 · 21:51 | 21:54 |
Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
No actionable comments were generated in the recent review. Walkthrough
Merge Risk:
 |
Reviewer's GuideAPIExpose the expected tag target input and the verified target SHA in the remote verification type declarations.
ImplementationBind release-tag verification to the push event and GitHub context SHAs, verify annotated-tag identity and protected-main ancestry using Compare API fields, and recheck main and the tag ref before accepting the target.
Require a version-tag push event whose ref matches the requested tag, derive its expected target from the event payload and GitHub SHA, and pass that target to remote verification.
DocumentationUpdate the changelog and README test-count metrics to reflect the added coverage, and document the release-tag verification change.
TestsAdd regressions for event-SHA binding, tag identity and retargeting, protected-main ancestry and stability, API failures, and signature verification outcomes.
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
codeant-ai
Bot
added
the
size:L
Commit ✅ Overall Status: PASSED
|
Commit ⚪ Overall Status: Not applicable
New-code coverage threshold not configured; coverage is reported but not enforced. |
![codescene-access[bot]](https://avatars.githubusercontent.com/in/3755875?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
|
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
|
[check-pr-size] PR size is over the target tier (normal profile): 7 files, 404 meaningful lines, 4 commits — limit ≤8 files / ≤400 lines / ≤6 commits. Consider splitting into smaller, independently reviewable PRs. |
|
@CodeAnt-AI review |
There was a problem hiding this comment.
Gates Passed
See analysis details in CodeScene
Absence of Expected Change Pattern
- WorldScript-Studio/tests/unit/signing.test.ts is usually changed with: WorldScript-Studio/scripts/signing/signing-core.mjs
Quality Gate Profile: The Bare Minimum
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
User description
Purpose
Correct the release-tag verifier's ancestry check to use the GitHub Compare API fields that the endpoint actually returns. The old check depended on a nonexistent
head_commitfield and could reject a valid signed release tag.Changes
aheadoridenticalcomparisons whose base and merge-base SHAs both equal the signed release target.mainbefore and after the ancestry request; fail closed if its SHA moves or protection disappears during verification.Validation
tests/unit/tooling/verifyRemoteTag.test.ts: 20/20 passed, including realistic Compare API responses, malformed/divergent ancestry, unprotected or movingmain, tag mismatch/retargeting, and API failures.tests/unit/signing.test.ts: 72/72 passed.pnpm run pr:budget --base origin/main: 7 files, 404 meaningful lines, 3 commits; within hard limits.PR_BUDGET_BASE=origin/main pnpm run ci:prepush: passed. Hosted exact-head checks and independent reviews are still required.Security and release status
This PR does not create or publish a tag, GitHub Release, GHCR image, or Tauri artifact. v1.29.3 remains on HOLD. PR #1205 must use the resulting protected-main commit as its immutable verifier pin after this PR merges and the new main checks are verified.
Related: #1205, #1201, #1206.
Summary by Sourcery
Harden signed release-tag verification against invalid ancestry, mutable refs, and inconsistent GitHub event state.
Bug Fixes:
Enhancements:
Documentation:
Tests:
CodeAnt-AI Description
Bind signed release tags to the pushed commit and protected main
What Changed
main; verification rejects changes tomainor the tag while checks are running.Impact
✅ Valid release tags pass ancestry checks✅ Mismatched or retargeted release tags are rejected✅ Releases are rejected if protected main changes during verification💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit
mainbefore being accepted.