From 063a21b2484f86f7557ba39f67f846b3038009d4 Mon Sep 17 00:00:00 2001 From: alphacrack <18480504+alphacrack@users.noreply.github.com> Date: Fri, 24 Jul 2026 00:38:01 +0200 Subject: [PATCH] =?UTF-8?q?chore:=20release-infra=20hardening=20=E2=80=94?= =?UTF-8?q?=20sigstore=20attach=20on=20dispatch,=20wildcard=20langchain=20?= =?UTF-8?q?ignore,=20codeql=20name=20normalization?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Four small fixes that came out of the v0.5.0 release, packaged together because each is a one-file change with the same "invisible to users, matters for maintainers" shape. 1) publish-pypi.yml: sigstore attach step now fires on workflow_dispatch too Previously the "Attach signed artifacts + SBOM to the GitHub Release" step was gated on `event_name == 'release'` only. v0.5.0 was dispatched manually via `gh workflow run publish-pypi.yml --ref v0.5.0` (because the first tag-triggered run had failed at SBOM generation), so the attach step was skipped and the sigstore .sigstore bundles never reached the Release page. The wheel/sdist/SBOM had to be attached by hand after the fact. Fix: broaden the gate to also match `workflow_dispatch` against a v* tag ref, and derive TAG_NAME from either github.event.release.tag_name (release event) or github.ref_name (dispatch against tag ref). 2) dependabot.yml: wildcard `langchain*` ignore for major bumps The previous ignore list enumerated langchain, langchain-core, langchain-openai, langchain-anthropic, langchain-community — five entries, easy to miss a family member. v0.5.0 had to close #23 (langchain-ollama 0.2 → 1.1) because langchain-ollama was NOT in that list, and #10 (a langchain group PR) because grouped updates bypass per-package ignores. Fix: `- dependency-name: "langchain*"` covers the whole family including future additions (langchain-google-*, langchain-xai, etc.). 3) codeql.yml: drop the redundant single-element matrix With `strategy.matrix.language: ["python"]` GitHub rendered the check as "Analyze (python) (python)" — the job's `name: Analyze (python)` plus the matrix value appended. Branch protection had to encode the redundant name to work. Removing the matrix (only one language today) gives the cleaner "Analyze (python)". If a second language is added later, re-introduce the matrix and change `name:` to just "Analyze" so the render becomes `Analyze (foo)` without doubling. 4) scripts/apply_branch_protection.sh: update required check to match Follows from (3). Now requires "Analyze (python)" (without the redundant appendix). A comment above the JSON payload documents the transition so anyone re-running this script understands why the required-check name changed. Verified locally: - publish-pypi.yml YAML parses; if: expression is well-formed. - codeql.yml YAML parses; ${{ matrix.language }} references removed. - dependabot.yml YAML parses; wildcard pattern matches langchain-ollama and any future langchain-* additions. - apply_branch_protection.sh JSON payload still parses (checked with python's json.loads on the extracted heredoc content). Signed-off-by: alphacrack <18480504+alphacrack@users.noreply.github.com> --- .github/dependabot.yml | 18 ++++++++---------- .github/workflows/codeql.yml | 15 ++++++++------- .github/workflows/publish-pypi.yml | 14 ++++++++++++-- scripts/apply_branch_protection.sh | 6 ++++++ 4 files changed, 34 insertions(+), 19 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 25c56fd..7924d36 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -22,16 +22,14 @@ updates: - patch - minor ignore: - # LangChain 0.4.x requires a coordinated port — handled manually. - - dependency-name: langchain - update-types: [version-update:semver-major] - - dependency-name: langchain-core - update-types: [version-update:semver-major] - - dependency-name: langchain-openai - update-types: [version-update:semver-major] - - dependency-name: langchain-anthropic - update-types: [version-update:semver-major] - - dependency-name: langchain-community + # LangChain-family major bumps require a coordinated port; the LLMClient + # abstraction in src/iac_scanner/llm/providers.py is where that lands. + # Wildcard "langchain*" covers current and future family members + # (langchain-google-*, langchain-xai, langchain-mistralai, etc.) so we + # don't have to enumerate one-by-one. History: v0.5.0 had to close + # #10 (langchain group major) and #23 (langchain-ollama 0.2→1.1) because + # the previous per-package ignore list didn't cover langchain-ollama. + - dependency-name: "langchain*" update-types: [version-update:semver-major] - package-ecosystem: github-actions diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 8b63287..38c92d7 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -24,11 +24,12 @@ jobs: permissions: security-events: write packages: read - - strategy: - fail-fast: false - matrix: - language: ["python"] + # Deliberately no `strategy.matrix` — the workflow only analyzes one + # language today. Previously a single-element matrix caused GitHub to + # render the check as "Analyze (python) (python)" (matrix name appended + # to the job name), which then had to be encoded verbatim in branch + # protection. If a second language is added, re-introduce a matrix and + # change `name:` above to just "Analyze" so the render is `Analyze (foo)`. steps: - uses: actions/checkout@v7 @@ -36,7 +37,7 @@ jobs: - name: Initialize CodeQL uses: github/codeql-action/init@v4 with: - languages: ${{ matrix.language }} + languages: python queries: +security-and-quality - name: Autobuild @@ -45,4 +46,4 @@ jobs: - name: Perform CodeQL analysis uses: github/codeql-action/analyze@v4 with: - category: "/language:${{ matrix.language }}" + category: "/language:python" diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml index bbf388c..61aebbe 100644 --- a/.github/workflows/publish-pypi.yml +++ b/.github/workflows/publish-pypi.yml @@ -105,11 +105,21 @@ jobs: ./dist/*.whl ./sbom.cdx.json - name: Attach signed artifacts + SBOM to the GitHub Release - if: github.event_name == 'release' + # Runs on `release: published` (normal tag-triggered flow) AND on + # `workflow_dispatch` when dispatched against a v* tag ref (manual + # re-publish). The previous gate was `event_name == 'release'` only — + # v0.5.0's manual re-dispatch skipped this step, leaving the Release + # with no sigstore bundles until they were attached by hand. + if: >- + github.event_name == 'release' || + (github.event_name == 'workflow_dispatch' && startsWith(github.ref, 'refs/tags/')) env: GH_TOKEN: ${{ github.token }} + # `github.event.release.tag_name` exists on release events; + # `github.ref_name` (e.g. "v0.5.1") is the tag on workflow_dispatch. + TAG_NAME: ${{ github.event.release.tag_name || github.ref_name }} run: | - gh release upload "${{ github.event.release.tag_name }}" \ + gh release upload "$TAG_NAME" \ ./dist/*.tar.gz ./dist/*.whl \ ./dist/*.sigstore \ ./sbom.cdx.json \ diff --git a/scripts/apply_branch_protection.sh b/scripts/apply_branch_protection.sh index ec9a1fb..00d16db 100755 --- a/scripts/apply_branch_protection.sh +++ b/scripts/apply_branch_protection.sh @@ -23,6 +23,12 @@ echo "Applying branch protection to ${REPO}@${BRANCH}" # Required status check contexts. These must match the `name:` of jobs in your # workflows. If you rename a job, update both here and the workflow. +# +# History: "Analyze (python)" was previously "Analyze (python) (python)" +# because codeql.yml used a single-element matrix that appended `(python)` +# to the job name. codeql.yml was normalized in v0.5.1 — repos that ran +# this script before that change need to re-run it to pick up the corrected +# context, otherwise merges will block waiting on the stale check name. read -r -d '' PAYLOAD <