Repository navigation
ci(release): the published installer can be verified, and its build is pinned - #7
Merged
Merged
Conversation
…s pinned Pin PyInstaller and Inno Setup to specific versions so the build is reproducible instead of drifting to whatever chocolatey and pip happen to resolve on a given day. Pass the workflow_dispatch version through the environment rather than interpolating it into the PowerShell script body, so a crafted dispatch input is read as data instead of executed. SHA-pin the three third-party actions instead of trusting a mutable version tag. Hash the installer after it is built, ship the SHA256SUMS file as a release asset, and repeat the checksum in the release notes so a download can be verified without fetching anything else. Release notes are now generated fresh on every run instead of accreted with --generate-notes, so re-running a release cannot append a second checksum block to notes that already have one.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Release supply-chain hardening, applied identically across keycut, redactcam, agent-audit and claude-batch-runner so the four installers stay one shape.
SHA256SUMSas a release asset, and repeats the hash in the release notes under "Verify the download". Until now a downloader had nothing to check the binary against.pyinstaller==6.21.0andchoco install innosetup --version=6.7.1instead of floating on whatever the runner resolves that day, and the threeactions/*are SHA-pinned so a retagged action cannot swap in different code under the same label.${{ inputs.version }}was expanded into the PowerShell script body before PowerShell parsed it; it now arrives through the environment as$env:DISPATCH_VERSION. This workflow holdscontents: write..isstemplating. The three lines that hardcoded the app name (UninstallDisplayIcon,OutputBaseFilename,Source:) now use the{#AppName}define the file already declared, matching what claude-batch-runner already did. The pure-ASCII warning comment agent-audit carried is now in all four.Test plan
This workflow only runs on Windows, on a
v*tag push, so CI here cannot exercise it. What was checked:yaml.safe_loadparses the editedrelease.yml..issstill decodes as pure ASCII — the property its own comment asks for.git statusconfirms only.github/workflows/release.ymlandinstaller/<name>.isschanged.The first real proof is a
workflow_dispatchdry run, which builds everything and deliberately publishes nothing — worth doing on one repo before the next tagged release.Note
The version pins were resolved live against PyPI and the Chocolatey package page on 2026-08-04. They will need bumping like any other pin; that is the tradeoff being bought.