Repository navigation
feat: wire up trusted publishing and harden the reusable workflows - #37
Merged
Merged
Conversation
These workflows run in every purview-dev repository, with that repository's token and publishing credentials, so the blast radius of a defect here is the whole organisation. Trusted Publishing now works. It was a no-op: the toggle made the tool set ApiKey = null and nothing replaced it, because id-token: write appeared nowhere in the repository. The underlying misconception is in the old doc comment - Trusted Publishing does use an API key, the OIDC exchange simply mints a short-lived one. - id-token: write on purview-release.yml, and a NuGet/login step immediately before the push, because the key lives an hour and a token exchanges once. - A nuget-user input, with a step that fails when trusted-publishing is on and it is missing. - PublishNuGetModule always passes the key it finds, and reports a missing one rather than attempting an unauthenticated push. - NUGET_APIKEY is blanked while trusted publishing is on: the tool prefers it over NUGET_API_KEY, so a leftover long-lived secret would have shadowed the short-lived key and kept publishing the old way. Injection hardening. Caller inputs reach shells through env rather than being interpolated into the script text; GITHUB_ENV writes use a random heredoc delimiter, because a value containing a newline could define variables for every later step; workflow-command messages are flattened; set -euo pipefail added where it was missing; publishing credentials scoped to the publishing step rather than exported job-wide. All 14 third-party action references pinned to commit SHAs, with Dependabot added so pinning does not become staleness. Plus SECURITY.md and CODEOWNERS. The repository's own guard tests needed updating rather than weakening: Workflow_GuardsEveryOptionalInputItForwards required the literal interpolated form, so it was enforcing the injectable pattern. It now accepts the env-mapped and step-condition forms, and the parity scan follows keys into the forward helper so moving one there does not drop it from validation. Verified: 530 tests passing, actionlint clean, csharpier clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
These workflows run in every purview-dev repository, with that repository's token and publishing credentials, so the blast radius of a defect here is the whole organisation.
Trusted Publishing now works. It was a no-op: the toggle made the tool set ApiKey = null and nothing replaced it, because id-token: write appeared nowhere in the repository. The underlying misconception is in the old doc comment - Trusted Publishing does use an API key, the OIDC exchange simply mints a short-lived one.
Injection hardening. Caller inputs reach shells through env rather than being interpolated into the script text; GITHUB_ENV writes use a random heredoc delimiter, because a value containing a newline could define variables for every later step; workflow-command messages are flattened; set -euo pipefail added where it was missing; publishing credentials scoped to the publishing step rather than exported job-wide.
All 14 third-party action references pinned to commit SHAs, with Dependabot added so pinning does not become staleness. Plus SECURITY.md and CODEOWNERS.
The repository's own guard tests needed updating rather than weakening: Workflow_GuardsEveryOptionalInputItForwards required the literal interpolated form, so it was enforcing the injectable pattern. It now accepts the env-mapped and step-condition forms, and the parity scan follows keys into the forward helper so moving one there does not drop it from validation.
Verified: 530 tests passing, actionlint clean, csharpier clean.