Repository navigation
ci(release): the published installer can be verified, and its build is pinned - #4
Merged
Merged
Conversation
…s pinned
Pin PyInstaller and Inno Setup to specific known-good versions instead
of floating on whatever the runner happens to have, and SHA-pin the
three actions this workflow uses so a compromised tag can't swap in
different code under the same version label.
Pass the workflow_dispatch version input through the environment
instead of interpolating it into the PowerShell script body, so a
crafted dispatch input is read as data rather than executed.
After the installer is built, hash it with SHA256 and carry that hash
through: into the dry-run artifact alongside the exe, and into the
published release notes under a "Verify the download" section, so a
download can be checked without having to trust the hosting alone.
Release notes are regenerated from scratch on every run so a re-run
never appends a second checksum block to notes that already have one.
installer/agent-audit.iss now templates the app name via the existing
{#AppName} define on the three lines that previously hardcoded it, so
the installer filename, install icon, and packaged source name track
a single source of truth.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release supply-chain hardening, applied identically across keycut, redactcam, agent-audit and claude-batch-runner so the four installers stay one shape.
SHA256SUMSas a release asset, and repeats the hash in the release notes under "Verify the download". Until now a downloader had nothing to check the binary against.pyinstaller==6.21.0andchoco install innosetup --version=6.7.1instead of floating on whatever the runner resolves that day, and the threeactions/*are SHA-pinned so a retagged action cannot swap in different code under the same label.${{ inputs.version }}was expanded into the PowerShell script body before PowerShell parsed it; it now arrives through the environment as$env:DISPATCH_VERSION. This workflow holdscontents: write..isstemplating. The three lines that hardcoded the app name (UninstallDisplayIcon,OutputBaseFilename,Source:) now use the{#AppName}define the file already declared, matching what claude-batch-runner already did. The pure-ASCII warning comment agent-audit carried is now in all four.Test plan
This workflow only runs on Windows, on a
v*tag push, so CI here cannot exercise it. What was checked:yaml.safe_loadparses the editedrelease.yml..issstill decodes as pure ASCII — the property its own comment asks for.git statusconfirms only.github/workflows/release.ymlandinstaller/<name>.isschanged.The first real proof is a
workflow_dispatchdry run, which builds everything and deliberately publishes nothing — worth doing on one repo before the next tagged release.Note
The version pins were resolved live against PyPI and the Chocolatey package page on 2026-08-04. They will need bumping like any other pin; that is the tradeoff being bought.