Harden request and release security boundaries

[Deathcharge]

Closes all six validated findings from the standard repository security scan. Moves request materialization behind concurrency control, serializes one route at a time, severs secret-bearing exception chains, safely represents provider text in examples, gates tags to current main, hash-locks the artifact builder, and isolates attestation OIDC permissions. Verified locally with 135 tests at 94.69% coverage, Ruff, strict mypy, release contract tests, and a clean hash-locked no-isolation distribution build.

[coderabbitai]

Warning

Review limit reached

@Deathcharge, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 47 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 33a4ffd5-6d48-4ae7-be9d-db03f99d7ab3

📥 Commits

Reviewing files that changed from the base of the PR and between 93b3e2f and efae560.

📒 Files selected for processing (3)

• pyproject.toml
• requirements/release-build.txt
• tests/test_release_contract.py

Summary by CodeRabbit

• Bug Fixes

  • Improved provider error handling to prevent sensitive exception details from appearing in terminal output or tracebacks.
  • Strengthened request validation for concurrent and multi-route requests.
  • Improved example output clarity by explicitly displaying generated content and provider metadata.

• Security

  • Hardened release artifact verification and provenance checks.
  • Added safeguards for untrusted provider text and terminal control characters.

• Documentation

  • Updated release and security guidance for safer publishing and output handling.

Walkthrough

The release workflow now separates quality checks, building, validation, attestation, and publishing. Runtime changes move validation inside concurrency control, sanitize provider errors, serialize routes individually, and represent untrusted example output safely.

Changes

Release pipeline hardening

Layer / File(s)	Summary
Quality checks and reproducible builds .github/workflows/release.yml, pyproject.toml, requirements/release-build.txt, tests/test_release_contract.py	Release tags must match main. Builds use pinned, hash-locked tooling and --no-isolation.
Artifact validation, attestation, and publication .github/workflows/release.yml, docs/RELEASING.md, tests/test_release_contract.py	Artifact validation, provenance attestation, and PyPI publication run in dependent jobs. Attestation permissions remain isolated.

Runtime validation and safe output

Layer / File(s)	Summary
Concurrency-bound request validation unified_llm/unified_llm.py, CHANGELOG.md	Validation runs inside the semaphore. Each selected route payload is serialized and checked separately.
Sanitized provider-error flow unified_llm/unified_llm.py, tests/test_router.py	Provider failures become sanitized terminal errors without preserved causes or contexts.
Safe provider output handling examples/from_env.py, examples/responses_api.py, SECURITY.md	Examples use repr for provider output. Security guidance treats normalized provider text and metadata as untrusted.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• Deathcharge/unified-llm#3: Both changes modify per-route request serialization and payload-size accounting.
• Deathcharge/unified-llm#4: This PR extends related payload serialization changes and updates response example output.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main request and release security hardening changes.
Description check	✅ Passed	The description directly explains the security findings addressed, key changes, and verification results.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/security-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pyproject.toml`:
- Line 2: Update the setuptools pin from 80.9.0 to 83.0.0 in pyproject.toml at
lines 2-2 and requirements/release-build.txt at lines 10-11, and replace the
release-lock hash with
29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3.

In `@tests/test_release_contract.py`:
- Around line 45-54: Update
test_release_attestation_privileges_are_isolated_from_project_code to split
attest_job at the publish-to-pypi job boundary, then assert the isolated attest
job contains the required id-token and attestation permissions and
actions/attest invocation. Also assert the publish-to-pypi section declares
needs: attest, while preserving the existing build-job and attest-job checks.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fc4fea5c-2b75-4980-ab35-57476c2afdc2

📥 Commits

Reviewing files that changed from the base of the PR and between a56a0ea and 93b3e2f.

📒 Files selected for processing (11)

• .github/workflows/release.yml
• CHANGELOG.md
• SECURITY.md
• docs/RELEASING.md
• examples/from_env.py
• examples/responses_api.py
• pyproject.toml
• requirements/release-build.txt
• tests/test_release_contract.py
• tests/test_router.py
• unified_llm/unified_llm.py