lael-labs/executor

.github/workflows/pkg-pr-new.yml+10−0

 on:
   pull_request:
+permissions:
+  contents: read
 jobs:
   # Per-platform matrix: build the executor binary, tar it, upload to R2.
   # The wrapper npm package is built later by the `publish` job which just
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@v2
         with:
     name: Publish
     needs: build-preview-binary
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@v2
         with:

.github/workflows/publish-desktop.yml+36−5

         type: string
 permissions:
-  contents: write
+  contents: read
 concurrency:
   group: publish-desktop-${{ github.ref }}
 jobs:
   build:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
       - name: Checkout
         uses: actions/checkout@v4
         with:
-          ref: refs/tags/${{ inputs.tag }}
+          persist-credentials: false
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
+      - name: Validate release tag
+        env:
+          RAW_RELEASE_TAG: ${{ inputs.tag }}
+        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
+      - name: Checkout release tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git -c http.extraheader="AUTHORIZATION: bearer $GH_TOKEN" fetch --force --tags origin "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          git checkout --detach "$RELEASE_TAG"
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           mkdir -p apps/desktop/resources
-          gh release download "${{ inputs.tag }}" --repo "${{ github.repository }}" --pattern "${{ matrix.cli-asset }}" --dir /tmp/cli-download
+          gh release download "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --pattern "${{ matrix.cli-asset }}" --dir /tmp/cli-download
           cd /tmp/cli-download
           if [[ "${{ matrix.cli-asset }}" == *.tar.gz ]]; then
             tar -xzf "${{ matrix.cli-asset }}"
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path "apps/desktop/resources"
-          gh release download "${{ inputs.tag }}" --repo "${{ github.repository }}" --pattern "${{ matrix.cli-asset }}" --dir "$env:TEMP/cli-download"
+          gh release download "$env:RELEASE_TAG" --repo "$env:GITHUB_REPOSITORY" --pattern "${{ matrix.cli-asset }}" --dir "$env:TEMP/cli-download"
           Expand-Archive -Path "$env:TEMP/cli-download/${{ matrix.cli-asset }}" -DestinationPath "$env:TEMP/cli-extract" -Force
           Copy-Item "$env:TEMP/cli-extract/executor.exe" "apps/desktop/resources/executor.exe"
           if (Test-Path "$env:TEMP/cli-extract/emscripten-module.wasm") {
   release:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
+      - name: Checkout validation script
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.3.11
+      - name: Validate release tag
+        env:
+          RAW_RELEASE_TAG: ${{ inputs.tag }}
+        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
       - name: Download all artifacts
         uses: actions/download-artifact@v4
         with:
         run: |
           find artifacts -type f \( -name "*.dmg" -o -name "*.exe" -o -name "*.AppImage" -o -name "*.deb" \) | while read file; do
             echo "Uploading: $file"
-            gh release upload "${{ inputs.tag }}" "$file" --repo "${{ github.repository }}" --clobber || true
+            gh release upload "$RELEASE_TAG" "$file" --repo "$GITHUB_REPOSITORY" --clobber || true
           done

.github/workflows/publish-executor-package.yml+18−6

         type: string
 permissions:
-  actions: write
+  contents: read
-  contents: write
-  id-token: write
 concurrency:
   group: publish-executor-package-${{ github.ref }}
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: write
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/tags/{0}', inputs.tag) || github.ref }}
+          persist-credentials: false
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
         with:
           bun-version: 1.3.11
+      - name: Validate release tag
+        env:
+          RAW_RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
+        run: bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG
+      - name: Checkout release tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          git -c http.extraheader="AUTHORIZATION: bearer $GH_TOKEN" fetch --force --tags origin "refs/tags/$RELEASE_TAG:refs/tags/$RELEASE_TAG"
+          git checkout --detach "$RELEASE_TAG"
       - name: Setup Node
         uses: actions/setup-node@v4
         with:
       - name: Publish package and create release
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
         run: |
           export GITHUB_REF_TYPE=tag
           export GITHUB_REF_NAME="$RELEASE_TAG"
       - name: Trigger desktop build
         env:
           GH_TOKEN: ${{ github.token }}
-          RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}
         run: gh workflow run publish-desktop.yml -f tag="$RELEASE_TAG"

.github/workflows/release.yml+23−11

       - main
 permissions:
-  actions: write
+  contents: read
-  contents: write
-  id-token: write
-  pull-requests: write
 concurrency:
   group: release-${{ github.ref }}
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      contents: write
+      id-token: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Bun
         uses: oven-sh/setup-bun@v2
           echo "version=$version" >> "$GITHUB_OUTPUT"
+      - name: Validate release tag
+        if: steps.changesets.outputs.hasChangesets == 'false' && steps.detect_release.outputs.changed == 'true'
+        id: validate_release
+        env:
+          RELEASE_VERSION: ${{ steps.detect_release.outputs.version }}
+        run: bun run scripts/validate-release-ref.ts --version-env RELEASE_VERSION --output tag
       - name: Create and push release tag
         if: steps.changesets.outputs.hasChangesets == 'false' && steps.detect_release.outputs.changed == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.validate_release.outputs.tag }}
         run: |
-          tag="v${{ steps.detect_release.outputs.version }}"
+          if git -c http.extraheader="AUTHORIZATION: bearer $GH_TOKEN" ls-remote --exit-code --tags origin "refs/tags/$RELEASE_TAG" >/dev/null 2>&1; then
-          if git ls-remote --exit-code --tags origin "refs/tags/$tag" >/dev/null 2>&1; then
+            echo "Tag $RELEASE_TAG already exists."
-            echo "Tag $tag already exists."
             exit 0
           fi
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git tag "$tag"
+          git tag "$RELEASE_TAG"
-          git push origin "$tag"
+          git -c http.extraheader="AUTHORIZATION: bearer $GH_TOKEN" push origin "$RELEASE_TAG"
       - name: Trigger CLI publish
         if: steps.changesets.outputs.hasChangesets == 'false' && steps.detect_release.outputs.changed == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.validate_release.outputs.tag }}
         run: |
-          tag="v${{ steps.detect_release.outputs.version }}"
+          gh workflow run publish-executor-package.yml --ref "$RELEASE_TAG" -f tag="$RELEASE_TAG"
-          gh workflow run publish-executor-package.yml --ref "$tag" -f tag="$tag"
       # Desktop build downloads CLI binaries from the release, so it must
       # run after CLI publish completes. Trigger it from the CLI workflow

scripts/validate-release-ref.ts+70−0

@@ -0,0 +1,70 @@
	1	#!/usr/bin/env bun
	2	import { appendFileSync } from "node:fs";
	3
	4	const RELEASE_VERSION_PATTERN =
	5	/^(0\|[1-9]\d)\.(0\|[1-9]\d)\.(0\|[1-9]\d)(?:-((?:0\|[1-9]\d\|[A-Za-z-][0-9A-Za-z-])(?:\.(?:0\|[1-9]\d\|[A-Za-z-][0-9A-Za-z-]))))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/u;
	6
	7	export const validateReleaseVersion = (value: string): string => {
	8	if (!RELEASE_VERSION_PATTERN.test(value)) {
	9	throw new Error(`Invalid release version: ${value}`);
	10	}
	11	return value;
	12	};
	13
	14	export const validateReleaseTag = (value: string): string => {
	15	if (!value.startsWith("v")) {
	16	throw new Error(`Invalid release tag: ${value}`);
	17	}
	18	validateReleaseVersion(value.slice(1));
	19	return value;
	20	};
	21
	22	const readEnv = (name: string): string => {
	23	const value = process.env[name];
	24	if (!value) {
	25	throw new Error(`Missing environment variable: ${name}`);
	26	}
	27	return value;
	28	};
	29
	30	const appendGitHubFile = (path: string \| undefined, line: string): void => {
	31	if (!path \|\| !line) return;
	32	appendFileSync(path, `${line}\n`, "utf8");
	33	};
	34
	35	const run = (): void => {
	36	const args = process.argv.slice(2);
	37	const tagEnv = readOption(args, "--tag-env");
	38	const versionEnv = readOption(args, "--version-env");
	39	const writeEnv = readOption(args, "--write-env");
	40	const outputName = readOption(args, "--output");
	41
	42	if (tagEnv && versionEnv) {
	43	throw new Error("Use either --tag-env or --version-env, not both");
	44	}
	45	if (!tagEnv && !versionEnv) {
	46	throw new Error("Expected --tag-env or --version-env");
	47	}
	48
	49	const tag = tagEnv
	50	? validateReleaseTag(readEnv(tagEnv))
	51	: `v${validateReleaseVersion(readEnv(versionEnv!))}`;
	52
	53	appendGitHubFile(process.env.GITHUB_ENV, writeEnv ? `${writeEnv}=${tag}` : "");
	54	appendGitHubFile(process.env.GITHUB_OUTPUT, outputName ? `${outputName}=${tag}` : "");
	55	console.log(`Validated release tag ${tag}`);
	56	};
	57
	58	const readOption = (args: ReadonlyArray<string>, name: string): string \| undefined => {
	59	const index = args.indexOf(name);
	60	if (index === -1) return undefined;
	61	const value = args[index + 1];
	62	if (!value \|\| value.startsWith("--")) {
	63	throw new Error(`Missing value for ${name}`);
	64	}
	65	return value;
	66	};
	67
	68	if (import.meta.main) {
	69	run();
	70	}

tests/release-workflows.test.ts+55−0

@@ -0,0 +1,55 @@
	1	import { describe, expect, it } from "@effect/vitest";
	2	import { readFileSync } from "node:fs";
	3	import { resolve } from "node:path";
	4
	5	import { validateReleaseTag, validateReleaseVersion } from "../scripts/validate-release-ref";
	6
	7	const workflow = (name: string): string =>
	8	readFileSync(resolve(import.meta.dirname, "..", ".github/workflows", name), "utf8");
	9
	10	describe("release workflow hardening", () => {
	11	it("accepts only semver release versions and v-prefixed semver tags", () => {
	12	expect(validateReleaseVersion("1.2.3")).toBe("1.2.3");
	13	expect(validateReleaseVersion("1.2.3-beta.4")).toBe("1.2.3-beta.4");
	14	expect(validateReleaseTag("v1.2.3")).toBe("v1.2.3");
	15	expect(validateReleaseTag("v1.2.3-beta.4+build.5")).toBe("v1.2.3-beta.4+build.5");
	16
	17	expect(() => validateReleaseVersion("v1.2.3")).toThrow();
	18	expect(() => validateReleaseVersion("1.2")).toThrow();
	19	expect(() => validateReleaseTag("1.2.3")).toThrow();
	20	expect(() => validateReleaseTag("v1.2.3; echo unsafe")).toThrow();
	21	expect(() => validateReleaseTag("v01.2.3")).toThrow();
	22	});
	23
	24	it("validates release values through environment variables before shell use", () => {
	25	const publishExecutor = workflow("publish-executor-package.yml");
	26	const release = workflow("release.yml");
	27	const publishDesktop = workflow("publish-desktop.yml");
	28
	29	expect(publishExecutor).toContain(
	30	"bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG",
	31	);
	32	expect(release).toContain(
	33	"bun run scripts/validate-release-ref.ts --version-env RELEASE_VERSION --output tag",
	34	);
	35	expect(publishDesktop).toContain(
	36	"bun run scripts/validate-release-ref.ts --tag-env RAW_RELEASE_TAG --write-env RELEASE_TAG",
	37	);
	38
	39	expect(release).not.toContain('tag="v${{ steps.detect_release.outputs.version }}"');
	40	expect(publishDesktop).not.toContain("ref: refs/tags/${{ inputs.tag }}");
	41	expect(publishDesktop).not.toContain('gh release download "${{ inputs.tag }}"');
	42	expect(publishExecutor).not.toMatch(/\n\s+RELEASE_TAG: \$\{\{ github\.event_name/u);
	43	});
	44
	45	it("does not persist checkout credentials in release workflows", () => {
	46	for (const name of [
	47	"publish-executor-package.yml",
	48	"release.yml",
	49	"publish-desktop.yml",
	50	"pkg-pr-new.yml",
	51	]) {
	52	expect(workflow(name)).toContain("persist-credentials: false");
	53	}
	54	});
	55	});