Repository navigation
security: build release drafts before immutable publish - #10
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0297ca8b31
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed both P1 review findings in 8e5ec89: (1) draft asset hashes now come from draft-aware gh release view GraphQL instead of published-only REST by-tag; (2) the remote tag object is peeled and compared against the exact verified build SHA both immediately before draft creation and immediately before publication. All six updated PR CI jobs passed. Resolving those threads as fixed, without bypassing branch protection. |
Addresses independent M4 audit. Repository immutable releases setting enabled via GitHub official endpoint on 2026-10-22. For v0.2.3+ only: trigger by new tag, deny historical and already-published releases, pin Rust 1.99.1, build all seven archives, generate checksums, upload only to empty draft without --clobber, verify eight uploaded GitHub SHA256 digests and then publish and assert immutable=true. Remove workflow_dispatch and release:published triggers. Add source policy regression check in CI. Does not change any application code, tags, or existing v0.2.2 release.