Repository navigation
Release: publish from a verified self-dispatch (Trusted Publishing rejects workflow_run) - #24
Merged
Merged
Conversation
…jects workflow_run) The alpha.3 publish job (run 34931485896) failed at the OIDC exchange: 'Trusted Publishing does not support the workflow_run event trigger due to security concerns. Please use a different trigger such as push, release, or workflow_dispatch.' release.yml keeps its workflow_run stage (verify + release-pr). When the verified commit is a merged release-plz PR, a new dispatch-publish job dispatches release.yml itself on main with the SHA and CI run ID. The dispatched run verifies both inputs again with main's own verifier script (checkout github.sha, never the input commit's scripts) before its publish job - still behind the crates-io environment approval - checks out the release commit. The Trusted Publisher config (release.yml + crates-io) is unchanged. release.py publish now requires workflow_dispatch. actionlint, zizmor and shellcheck pass.
|
Warning Review limit reachedNext included review available in 51 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
proggeramlug
added a commit
that referenced
this pull request
Sep 15, 2026
loop_drop_terminates_live_children_and_releases_their_handles sampled GetProcessHandleCount once per cycle and compared it to an exact baseline. It failed on windows-2025 in PR #24's run 34941544032 with 83 against 82, on a PR that only changed release scripts (issue #26). The outstanding handle is a WaitCompletionPacket, and it is not leaked. The backend learns a child exited through RegisterWaitForSingleObject, which the thread pool backs with such a packet. UnregisterWaitEx(INVALID_HANDLE_VALUE) is the strongest join Windows documents and it joins the callback; the pool closes its own packet afterwards, on its own threads. An instrumented 192-cycle sweep on windows-2025 (run 34954538795) saw the table oscillate 130 -> 131 -> 130, gaining and releasing exactly one WaitCompletionPacket, on 117 to 138 of the 192 rounds with eight busy threads, and move zero times on the same idle runner. So the comparison stays exact and gains a bounded deadline instead of a single sample: settled() requires the count to be exactly the baseline again within five seconds. A leaked handle never comes back and still fails, and now names itself -- handle_table walks this process's handle table with GetHandleInformation and NtQueryObject(ObjectTypeInformation), and the failure reports what the table gained and released. The two other whole-process handle comparisons in this file get the same treatment for the same reason.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The alpha.3 publish failed at the OIDC token exchange (run 34931485896):
Change
release.ymlkeeps itsworkflow_runstage (verify,release-pr).dispatch-publishjob: when the verified commit is a mergedrelease-plz-*PR, it runsgh workflow run release.yml --ref main -f sha=… -f ci_run_id=…withactions: write.verifychecks both inputs through the API again, running main's owncheck-ci.py(checkoutgithub.sha) rather than the input commit's scripts.publishruns only onworkflow_dispatchwithrelease == 'true', still behind thecrates-ioenvironment approval, and checks outinputs.sha.release.py publishnow requiresGITHUB_EVENT_NAME == workflow_dispatch.release.yml+crates-io) is unchanged, so no crates.io settings change.Verified
scripts/ci/lint-workflows.pypasses: actionlint, zizmor (no findings) and shellcheck.After merge
The alpha.3 commit 0ef71c9 still carries the old
release.py, so the next merged release-plz PR publishes the still-unpublished 0.1.0-alpha.3 through the new path.