[goosewobbler]

Summary

Hardens the standing-PR publish path, which previously trusted the <!-- releasekit-manifest --> comment verbatim — a repo write-access actor could edit the comment's hidden base64 to forge versionOutput and drive arbitrary git tags and registry publishes under the project's identity (an insider/confused-deputy supply-chain path). The draft flow already recomputed-and-compared; standing-pr did not.

New trust model — what is now recomputed / validated / authenticated

Before publishFromManifest creates any tag or touches any registry:

• Recomputed against source (Standing-PR publish trusts the manifest comment verbatim — recompute, validate & authenticate before publishing #556 layer 1). The merged commit's package manifests — bumped by the reviewed-and-merged release-prep commit — are the ground truth. assertManifestMatchesSource reads each package's actual on-disk version (getWorkspacePackageVersions, ecosystem-aware) and refuses if the manifest names a package the workspace lacks, a version that diverges from the source, or a consumer tag that encodes no published version. The baseSha ancestry check is upgraded from a warn() to a hard refusal (a manifest computed off this branch's history is rejected). A single divergence rejects the whole manifest before anything is published.
• Schema-validated (Standing-PR publish trusts the manifest comment verbatim — recompute, validate & authenticate before publishing #556 layer 2). parseManifest now runs the decoded payload through a Zod schema, requires an exact schemaVersion ∈ {1,2} (the old < MIN || > MAX range let an absent version through — both comparisons are false for undefined), and rejects oversized/malformed manifests.
• Authenticated / author-bound (Standing-PR publish trusts the manifest comment verbatim — recompute, validate & authenticate before publishing #556 layer 3). ForgeComment now carries the comment author. findComment prefers a bot-authored marker match, upsertMarkerComment only adopts a bot-authored comment (fixing the pre-seed/adoption race for every marker), and the publish refuses a manifest comment that isn't bot-authored.

Before: createReleaseTags/runPublishStep ran on manifest.versionOutput as-is; the only guards were who merged, ancestry (warn-only), and override-label staleness — never the version/tag/target content, and no schema or author check. After: the package set, versions and tags are re-derived from and cross-checked against the merged source, the manifest is schema-validated, and the manifest comment must come from the bot.

DoS hardening (#558)

Release-notes length was unbounded and the body cap never shed the notes region, so inflated notes could push the PR body past GitHub's limit and 422 every standing-PR update. Now per-package notes are truncated at a documented bound (…(truncated)), and the notes region is part of the body-cap shed order — an over-long body collapses/drops notes instead of failing the update.

Test plan

• New unit tests — Standing-PR publish trusts the manifest comment verbatim — recompute, validate & authenticate before publishing #556: forged manifest rejected for a bumped version, an extra package, and a rogue tag; a non-bot-authored manifest comment is rejected; a pre-seeded human comment is shadowed by the bot's real one; a non-ancestor baseSha is refused; an absent schemaVersion is rejected. Unbounded release-notes length wedges standing-PR updates (body-cap DoS) #558: renderNotesRegion/truncatePackageNotes truncate oversized per-package notes at the bound with the marker; an inflated multi-package notes body renders under the cap and updatePullRequest is never handed an over-limit body.
• Rebased onto current main (clean); re-verified the CI way: biome check . exit 0, forced turbo run typecheck test → 24/24.

Closes #556
Closes #558

🤖 Generated with Claude Code

https://claude.ai/code/session_01BT6fVBZrmExXZj7vQ29881

Greptile Summary

This PR hardens the standing-PR publish path against insider/confused-deputy supply-chain attacks where a write-access actor could edit the hidden base64 in the release manifest comment to drive arbitrary git tags and registry publishes. It also caps per-package release notes to prevent inflated notes from wedging the standing PR via GitHub's 65 536-char body limit.

• Manifest integrity (three layers): assertManifestMatchesSource recomputes on-disk package versions and validates every tag in the manifest against them before any publish operation; parseManifest now schema-validates via Zod and requires an exact known schemaVersion (closing the undefined bypass in the old range); and findComment/upsertMarkerComment now prefer bot-authored matches and refuse to adopt human-authored marker comments.
• Author-binding: publishFromManifest hard-rejects a manifest comment not authored by the bot; fetchStandingPRSnapshot applies the same check so a forged manifest isn't surfaced in the preview either.
• DoS hardening (Unbounded release-notes length wedges standing-PR updates (body-cap DoS) #558): truncatePackageNotes caps each package's notes at 8 000 chars; the progressive body-shedding logic collapses/drops the notes region when even a fully-shed changelog still overflows.

Confidence Score: 5/5

Safe to merge — the validation guards are well-structured and every new code path has a dedicated test.

All three hardening layers are correctly implemented. The tag-boundary regex blocks digit-suffix and hyphen/plus-suffix version-embedding bypasses. The schema version membership check closes the undefined-bypass. No correctness issues found.

No files require special attention.

Important Files Changed

Filename	Overview
packages/release/src/standing-pr/standing-pr.ts	Core publish hardening: schema validation, author-binding, baseSha ancestry guard upgraded to hard error, and assertManifestMatchesSource added. Tag validation regex correctly uses (?![\d.+-]) to block version-embedding and -suffix bypasses.
packages/forge/src/types.ts	Adds CommentAuthor interface and isBotComment helper; fail-open on absent user is intentional and documented for legacy/fake paths.
packages/forge/src/github.ts	findComment now prefers bot-authored matches over human ones; upsertMarkerComment only adopts bot-authored existing comments.
packages/version/src/workspace.ts	New getWorkspacePackageVersions reads on-disk versions across all ecosystems; silently skips packages without name/version (safe).
packages/release/src/standing-pr/notes-region.ts	Adds truncatePackageNotes at 8000 chars/package with correct budget accounting for the marker string.
packages/release/test/unit/standing-pr.spec.ts	Comprehensive new tests covering all attack paths: forged version, extra package, rogue tag, version-embedding tag, scoped-package mismatch, non-bot manifest, baseSha non-ancestor, and absent schemaVersion.

Comments Outside Diff (1)

1. packages/release/src/standing-pr/standing-pr.ts, line 607-624 (link)

   fetchStandingPRSnapshot does not author-check the manifest comment

   findManifestComment now returns a human-authored comment as a fallback when no bot-authored one exists. fetchStandingPRSnapshot parses that comment without calling isBotComment, so a pre-seeded forged manifest would be surfaced in the preview. This is a display-only path (it feeds preview, not publishFromManifest), so the impact is showing misleading version information rather than triggering a publish — but it is an inconsistency with the rest of the hardening.

   

_{Reviews (7): Last reviewed commit: "fix(standing-pr): validate the manifest ..." | Re-trigger Greptile}

[github-actions]

Standing release PR: #582 · v0.41.1 queued (4 packages) · open 3h 2m · ✅ ready to merge

Release Preview — this PR contributes no changes

No bump label detected.
Note: Add bump:patch, bump:minor, or bump:major to trigger a release.

Currently queued for release

Package	Current	Next
monorepo	0.41.0	0.41.1

---

Updated automatically by ReleaseKit

[goosewobbler]

@greptileai review plz