Isolate provenance verification downloads

[yui-stingray]

Summary

• run the documented provenance verification flow in a subshell-scoped temporary directory
• clean downloaded artifacts on success or failure without changing the caller's shell options or deleting a fixed caller-owned directory
• validate initial and redirect-final HTTPS hosts with bounded requests before writing downloaded artifacts
• extend the release documentation contract test for the isolated workflow

Verification

• TMPDIR=/tmp TEMP=/tmp TMP=/tmp .venv/bin/python -m pytest -q
• actionlint
• provenance snippet bash -n, Python compilation, and shellcheck
• .venv/bin/python scripts/check_changelog.py
• staged-diff secret-shaped and local-path hygiene check

Boundary check

• No package runtime network behavior was added; changes are limited to the documented provenance-download flow and its contract test.
• Scanner roots remain explicit, fail closed, and unchanged.
• The CLI exit-code contract remains compatible and unchanged.

[coderabbitai]

📝 Walkthrough

Walkthrough

The release verification example now uses a strict subshell, temporary directory, cleanup trap, and temporary paths for attestation checks. Contract tests verify these changes and the v0.3.4 tag reference.

Changes

Release verification

Layer / File(s)	Summary
Temporary verification flow README.md	The example uses strict shell options, a temporary verification directory, cleanup on exit, and temporary paths for Python and attestation verification.
README contract coverage tests/test_workflow_release_contract.py	Assertions cover temporary-directory setup, cleanup, inline Python verification, and the refs/tags/v0.3.4 source reference.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• yui-stingray/agent-guard#16: Updates the same release workflow and artifact-verification contract tests.
• yui-stingray/agent-guard#20: Updates the same README release-verification example.
• yui-stingray/agent-guard#27: Extends the same README example and contract assertions with temporary-directory isolation.

Poem

A rabbit checks the tags at night,
In a clean temp burrow, safe and bright.
The trap sweeps crumbs away,
Attestations pass the day,
And v0.3.4 shines just right.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: isolating provenance verification downloads.
Description check	✅ Passed	The description explains the changes, lists validation steps, and addresses all boundary checks; its Verification heading adequately replaces Validation.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/harden-provenance-example

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/test_workflow_release_contract.py`:
- Around line 833-836: The README contract test assertions should explicitly
verify that both gh attestation verify commands reference "$verify_dir/..."
artifact paths. Update the assertions near the existing verify_dir and
source-ref checks in the test covering the documented verification flow,
preserving the current checks while distinguishing and validating each temporary
attestation path.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0eab9563-7abc-4951-b662-912de6d993b2

📥 Commits

Reviewing files that changed from the base of the PR and between e3f7c3a and d9ad82c.

📒 Files selected for processing (2)

• README.md
• tests/test_workflow_release_contract.py