build(release): automate official and nightly releases by jatmn · Pull Request #110 · jatmn/Codex-warp

jatmn · 2026-08-31T00:09:45Z

Summary

Add Release Please-driven official versioning and changelog PRs, with the bootstrap release forced to 0.1.0.
Add pinned cargo-dist packaging for Linux, macOS Intel/ARM, and Windows plus immutable nightly releases and guarded recovery workflows.
Add offline policy/schema validation, exact asset contracts, provenance attestations, digest-verified tooling, and generated-workflow drift checks.
Add maintainer documentation, activation order, and the reviewed A-Z implementation plan.
Security-sensitive: every GitHub token remains read-only; only protected, fail-closed mutation jobs can mint a narrowed GitHub App token. All publication and recovery gates are committed false and no production secret, environment, tag, branch, or release is created by this PR.

Contribution checklist

I checked for duplicate or overlapping existing pull requests.
This PR does not introduce a new implementation language.
This PR does not add Python for any reason.
I can respond to review feedback within one week.
My PR title follows the repository conventional commit title policy.

Validation

bash scripts/ci-preflight.sh
Durable preflight hooks are installed with bash scripts/install-git-hooks.sh
932 Rust tests, Clippy, build, rustdoc, CLI smoke, mutation tests, cargo-deny, and cargo-audit behavior passed at commit and push.
Release policy fixtures, workflow pin/permission/mutation-gate validation, generated cargo-dist byte comparison, official archive contract, and local Linux nightly packaging passed.
Temporary four-platform PR upload proof and retained artifact inspection; this draft remains open for that proof, then returns to steady-state pr-run-mode = "plan".

Maintainer checklist

This PR is ready for review by @jatmn after the cross-platform artifact proof.
Security-sensitive changes are called out in the summary.
The PR should only be merged by @jatmn.

Release-As: 0.1.0

socket-security · 2026-08-31T00:10:03Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/ajv-formats@3.0.1
	npm/yaml@2.9.0
	npm/ajv@8.20.0
	npm/release-please@17.6.0

View full report

socket-security · 2026-08-31T00:10:05Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `yargs` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: tools/release-please-policy/package-lock.json → `npm/release-please@17.6.0` → `npm/yargs@17.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/yargs@17.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

jatmn · 2026-08-31T00:38:59Z

Security review completed for the Socket warning.

yargs@17.7.3 is a transitive dependency of the pinned release-please@17.6.0 CLI. The flagged build/index.cjs is its documented Rollup-generated CommonJS bundle; the lockfile integrity matches npm, npm's gitHead matches the official GitHub v17.7.3 tag, and npm audit signatures verified the registry package.
Commit e9dddce moves release-please and therefore yargs out of production dependencies. All workflow installs now use npm ci --omit=dev --ignore-scripts, and validation asserts that boundary.
The same review found a real moderate AJV advisory in 8.17.1; it is upgraded to exact 8.20.0. A blocking npm audit --audit-level=moderate now runs in the release-policy harness, and the current audit reports 0 vulnerabilities.
The evidence, expected integrity, and future upgrade procedure are recorded in tools/release-please-policy/SECURITY.md and enforced by policy tests.

The yargs alert is an acceptable false positive with the above containment and provenance checks:

@SocketSecurity ignore npm/yargs@17.7.3

Add the generated same-repository proof collector and metadata attestation path, validate official metadata again before attestation, and reconcile all target evidence into the exact non-publishable eleven-file candidate.\n\nAccept cargo-dist's real GNU checksum marker format while continuing to reject extra or mismatched checksum entries.\n\nValidated with bash scripts/ci-preflight.sh and a retained four-platform artifact assembly from workflow run 33344301744.

jatmn · 2026-08-31T14:14:09Z

Progress checkpoint: pushed the current release-automation work through commit e036bef.

Known issues still requiring remediation before merge:

P1: scripts/check-prior-official-releases.sh verifies historical official archives and metadata with repository-only attestations. These must be constrained to trusted Release or Release Recovery workflow provenance.
P1: scripts/advance-nightly-branch.sh uses the singular git/ref endpoint for PATCH. GitHub branch updates require the plural git/refs endpoint, so an existing nightly branch cannot currently fast-forward after publication.
P1: scripts/prepare-nightly.sh verifies historical nightly archives with repository-only attestations. These must be bound to trusted Nightly or Nightly Recovery workflow provenance and the expected source identity.

This PR intentionally remains a draft and is not merge-ready until these three issues are fixed and the resulting head is fully validated and reviewed.

The pushed checkpoint passed the repository pre-push suite, including 932 Rust tests, Clippy, build and docs checks, release and nightly harnesses, generated workflow validation, 2 of 2 mutants caught, cargo-deny, and cargo-audit.

Historical official and nightly archive checks now require trusted signer workflows, and nightly branch fast-forward uses the plural GitHub refs API.

Nightly archive verification looks up Actions runs, so repair and post-mutation checks must use the job token rather than the App token.

Include the packaging digest script in the canonical input list so an algorithm or selection change updates packagingContractSha256.

Temporarily select cargo-dist PR upload mode so this same-repository draft can build and retain the eleven-file proof. Restore plan mode after the artifacts are inspected.

Retain four-platform upload proof from Actions run 33428168802. The eleven-file candidate validated locally; official mutation jobs stayed skipped. cargo-dist is back to pr-run-mode = "plan".

GitHub leaves matrix join expressions unevaluated when the job is skipped, so plan-mode checks showed the raw template. Use a fixed label for that job instead.

sourcery-ai

Sorry @jatmn, your pull request is larger than the review limit of 300,000 diff characters

build(release): automate official and nightly releases

d641d2f

jatmn self-assigned this Aug 31, 2026

jatmn added 2 commits August 30, 2026 17:13

ci(release): enable temporary artifact proof

8e8d5e2

build(release): harden policy dependencies

e9dddce

jatmn added 9 commits August 30, 2026 17:42

ci(release): smoke-test official archives

e7709cf

ci(release): validate Windows archives portably

8705a67

ci(release): use native Windows extraction

e581324

ci(release): pass Windows archive paths via environment

2da75f4

ci(release): harden host portability checks

bbe5231

fix(release): harden publication recovery

414a41d

fix(release): close recovery verification gaps

bcefb30

fix(release): bind provenance and nightly state

e036bef

jatmn added 6 commits August 31, 2026 08:43

fix(release): bind nightly provenance and branch updates

65904b1

Historical official and nightly archive checks now require trusted signer workflows, and nightly branch fast-forward uses the plural GitHub refs API.

fix(release): use job tokens for nightly provenance

6ea2dbd

Nightly archive verification looks up Actions runs, so repair and post-mutation checks must use the job token rather than the App token.

fix(release): bind nightly digest helper into its contract

81fc80e

Include the packaging digest script in the canonical input list so an algorithm or selection change updates packagingContractSha256.

ci(release): enable temporary four-platform artifact proof

a52dffe

Temporarily select cargo-dist PR upload mode so this same-repository draft can build and retain the eleven-file proof. Restore plan mode after the artifacts are inspected.

ci(release): restore steady-state PR plan mode

cf8f3c8

Retain four-platform upload proof from Actions run 33428168802. The eleven-file candidate validated locally; official mutation jobs stayed skipped. cargo-dist is back to pr-run-mode = "plan".

ci(release): use a static name for skipped native archive builds

24d4aa6

GitHub leaves matrix join expressions unevaluated when the job is skipped, so plan-mode checks showed the raw template. Use a fixed label for that job instead.

jatmn marked this pull request as ready for review August 31, 2026 20:20

sourcery-ai Bot reviewed Aug 31, 2026

View reviewed changes

jatmn merged commit a73617d into main Aug 31, 2026
17 checks passed

jatmn deleted the release/release-automation branch August 31, 2026 20:31

Navigation Menu

build(release): automate official and nightly releases - #110

build(release): automate official and nightly releases#110
jatmn merged 18 commits into
mainfrom
release/release-automation

jatmn commented Aug 31, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Aug 31, 2026 •

edited

Loading

Uh oh!

jatmn commented Aug 31, 2026

Uh oh!

jatmn commented Aug 31, 2026

Uh oh!

sourcery-ai Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jatmn commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Contribution checklist

Validation

Maintainer checklist

Uh oh!

socket-security Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Aug 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jatmn commented Aug 31, 2026

Uh oh!

jatmn commented Aug 31, 2026

Uh oh!

sourcery-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jatmn commented Aug 31, 2026 •

edited

Loading

socket-security Bot commented Aug 31, 2026 •

edited

Loading

socket-security Bot commented Aug 31, 2026 •

edited

Loading