From 76b20895cda579e83b4435106c8bae2fdf0cf54a Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Wed, 28 Oct 2026 00:20:48 +0530 Subject: [PATCH 1/2] security: define release-path code owners --- .github/CODEOWNERS | 12 ++++++++++++ docs/releasing.md | 14 ++++++++++++++ 2 files changed, 26 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..bf5b51e --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,12 @@ +# Release-path changes require review from the maintainers responsible for +# package integrity. The protected-branch ruleset requires an approval from a +# reviewer other than the last pusher. +/.github/workflows/package.yml @codeforester @rameshulugar +/.github/workflows/issue-branch-policy.yml @codeforester @rameshulugar +/VERSION @codeforester @rameshulugar +/pyproject.toml @codeforester @rameshulugar +/requirements/ @codeforester @rameshulugar +/scripts/validate_* @codeforester @rameshulugar +/scripts/verify_* @codeforester @rameshulugar +/scripts/generate_release_metadata.py @codeforester @rameshulugar +/scripts/release_metadata_helpers.py @codeforester @rameshulugar diff --git a/docs/releasing.md b/docs/releasing.md index 52b40b6..c2a481a 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -25,6 +25,20 @@ review, approval from someone other than the last pusher, strict up-to-date status checks, and the policy, quality, runtime, and consumer checks listed in the repository ruleset. Deletion and non-fast-forward updates are disabled. +Release-path changes are additionally covered by `.github/CODEOWNERS`, including +the package workflow, `VERSION`, packaging metadata, release locks, and release +validators. Maintainers must review the complete diff, and the independent +reviewer must rerun the quality and release gates before a production tag is +created. The repository ruleset protects `v*` tags from deletion and force +updates; bypass actors are intentionally empty. + +If a maintainer credential is suspected to be compromised, pause publication, +revoke the affected token or OIDC trust, preserve the workflow run and review +evidence, and rotate the release version rather than moving an existing tag. +Restore access only after an independent maintainer has reviewed the ruleset, +environment approvals, trusted-publisher claims, and the exact artifact +digests. + ## Validation workflow Pull requests and pushes to `main` start from a clean artifact destination, From 53cab3d6755ff531b63b49a25d7da11f73963f38 Mon Sep 17 00:00:00 2001 From: Ramesh Padmanabhaiah <22363102+codeforester@users.noreply.github.com> Date: Wed, 28 Oct 2026 07:39:56 +0530 Subject: [PATCH 2/2] docs: align release controls with live enforcement --- .github/CODEOWNERS | 15 +++++++++++---- docs/releasing.md | 30 +++++++++++++++++++----------- 2 files changed, 30 insertions(+), 15 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index bf5b51e..0b1d0fa 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -3,10 +3,17 @@ # reviewer other than the last pusher. /.github/workflows/package.yml @codeforester @rameshulugar /.github/workflows/issue-branch-policy.yml @codeforester @rameshulugar +/.github/CODEOWNERS @codeforester @rameshulugar /VERSION @codeforester @rameshulugar -/pyproject.toml @codeforester @rameshulugar -/requirements/ @codeforester @rameshulugar -/scripts/validate_* @codeforester @rameshulugar -/scripts/verify_* @codeforester @rameshulugar +/requirements/release.in @codeforester @rameshulugar +/requirements/release.txt @codeforester @rameshulugar +/scripts/validate_package_artifact.py @codeforester @rameshulugar +/scripts/validate_release_docs.py @codeforester @rameshulugar +/scripts/validate_release_metadata.py @codeforester @rameshulugar +/scripts/validate_release_provenance.py @codeforester @rameshulugar +/scripts/validate_release_ref.py @codeforester @rameshulugar +/scripts/verify_pypi_metadata.py @codeforester @rameshulugar +/scripts/verify_release_assets.py @codeforester @rameshulugar /scripts/generate_release_metadata.py @codeforester @rameshulugar /scripts/release_metadata_helpers.py @codeforester @rameshulugar +/docs/releasing.md @codeforester @rameshulugar diff --git a/docs/releasing.md b/docs/releasing.md index c2a481a..992404e 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -20,17 +20,24 @@ Production releases use a matching annotated tag such as `v0.1.0`, created from updates, and tags that do not exactly match `v${VERSION}` are rejected before publication. The workflow fetches the complete trusted `main` history so an ancestor check fails closed instead of relying on shallow checkout state. -The active default-branch ruleset also requires one approving pull-request -review, approval from someone other than the last pusher, strict up-to-date -status checks, and the policy, quality, runtime, and consumer checks listed in -the repository ruleset. Deletion and non-fast-forward updates are disabled. +The default-branch and `v*` tag rulesets are release prerequisites. Before a +production tag is created, an independent maintainer must verify in the live +repository settings that the default branch requires one approving pull-request +review from someone other than the last pusher, strict up-to-date status checks, +and the policy, quality, runtime, and consumer checks listed in the ruleset. +The same verification must confirm that tag deletion and non-fast-forward +updates are disabled and that no unreviewed bypass actor is configured. This +document describes the required controls; it does not treat a ruleset as active +until that live readback has been recorded in the release evidence. Release-path changes are additionally covered by `.github/CODEOWNERS`, including -the package workflow, `VERSION`, packaging metadata, release locks, and release -validators. Maintainers must review the complete diff, and the independent -reviewer must rerun the quality and release gates before a production tag is -created. The repository ruleset protects `v*` tags from deletion and force -updates; bypass actors are intentionally empty. +the package workflows, `VERSION`, the hash-locked release toolchain, the +artifact/provenance validators, and this release procedure. CODEOWNERS is a +review-routing control, not enforcement by itself: the protected-branch +ruleset must require the matching owner review and protect the CODEOWNERS file. +The independent reviewer must rerun the quality and release gates before a +production tag is created. The tag ruleset must protect `v*` tags from deletion +and force updates; bypass actors must be intentionally empty. If a maintainer credential is suspected to be compromised, pause publication, revoke the affected token or OIDC trust, preserve the workflow run and review @@ -78,8 +85,9 @@ the exact reviewed wheel, sdist, `SHA256SUMS`, `SBOM.spdx.json`, and `RELEASE-BOM-ROW.json` downloaded from the build job. GitHub-generated comparison notes are supplemented by the dated section in `CHANGELOG.md`; the tagged release is rejected when `VERSION` -or that section does not match the tag. Published tags and release assets are -immutable. Before creating a release, the workflow verifies that the tag still +or that section does not match the tag. Once the live `v*` tag ruleset has been +verified, published tags and release assets are treated as immutable. Before +creating a release, the workflow verifies that the tag still resolves to the reviewed commit, that the wheel and sdist have provenance and SBOM attestations for that tag and commit, and that the release metadata binds the same version, commit, and assets. If an existing GitHub Release is found,