From 92b8f251c6d317ace2543079eaba1a61a7fdf1b0 Mon Sep 17 00:00:00 2001 From: admin Date: Wed, 8 Jul 2026 09:19:36 -0500 Subject: [PATCH] ci(gate-attestation): waive release-please PRs branch-shaped, not author-shaped MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The reusable waived release-please by author login (release-please[bot]), but RP running under GITHUB_TOKEN authors its PRs as github-actions[bot] — the waiver never matched, so every library-repo release PR failed gate-attestation ("No Gate-Passed trailer found"). Waive by head-ref pattern (release-please--branches--*) alongside the author waivers: the author varies across token setups, the branch pattern does not. Mirrors kanon's inline gate-attestation, which learned this the same way. --- .github/workflows/gate-attestation.yml | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/.github/workflows/gate-attestation.yml b/.github/workflows/gate-attestation.yml index 445640b..23a8e7d 100644 --- a/.github/workflows/gate-attestation.yml +++ b/.github/workflows/gate-attestation.yml @@ -16,18 +16,28 @@ jobs: steps: # WHY: waiver keys off the PR author login, not github.actor — actor flips # to a maintainer login on "Re-run failed jobs", re-arming the check on bot PRs. + # Release-please is ALSO waived branch-shaped: under GITHUB_TOKEN its PRs + # are authored as github-actions[bot] (and as the PAT owner once a PAT is + # wired) — the author varies, the branch pattern does not. Release-PR + # content is generated version bumps; its verification is the live + # deny/audit/osv checks. - name: Pass trusted automation PRs - if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'release-please[bot]' }} - run: echo "Gate attestation waived for trusted automation PR author ${{ github.event.pull_request.user.login }}." + if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' || github.event.pull_request.user.login == 'release-please[bot]' || startsWith(github.head_ref, 'release-please--branches--') }} + env: + # WHY: head_ref is attacker-controlled text — env-var indirection keeps + # it out of shell interpolation (actionlint expression rule). + PR_AUTHOR: ${{ github.event.pull_request.user.login }} + PR_HEAD_REF: ${{ github.head_ref }} + run: echo "Gate attestation waived for trusted automation PR (author ${PR_AUTHOR}, branch ${PR_HEAD_REF})." - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'release-please[bot]' }} + if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'release-please[bot]' && !startsWith(github.head_ref, 'release-please--branches--') }} with: fetch-depth: 0 persist-credentials: false - name: Verify Gate-Passed trailer - if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'release-please[bot]' }} + if: ${{ github.event.pull_request.user.login != 'dependabot[bot]' && github.event.pull_request.user.login != 'release-please[bot]' && !startsWith(github.head_ref, 'release-please--branches--') }} run: | commits=$(git log --format="%H" "origin/${{ github.base_ref }}..HEAD") if [ -z "$commits" ]; then