From 8872bd3fa5ae4021af5127c39188cc87a59ca494 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Fri, 9 Oct 2026 18:22:36 -0400 Subject: [PATCH] Stage Go1.27.2 authority for provider CI --- .github/public-workflow-action-allowlist.json | 40 +++++ .../public-workflow-command-allowlist.json | 152 ++++++++++++++++++ .../public-workflow-executable-allowlist.json | 16 ++ .../public-workflow-presence-allowlist.json | 6 + recovery_workflow_test.go | 4 +- 5 files changed, 216 insertions(+), 2 deletions(-) diff --git a/.github/public-workflow-action-allowlist.json b/.github/public-workflow-action-allowlist.json index ec6edb3..18b2d93 100644 --- a/.github/public-workflow-action-allowlist.json +++ b/.github/public-workflow-action-allowlist.json @@ -118,5 +118,45 @@ "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", "rationale": "Exact reviewed immutable action node and inherited execution context.", "state": "active" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956", + "nodeSHA256": "2e0ab657507095c018435a0da34a76ffffd3ca15eb3ceff7c2b17e13ebbb9383", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "GoCodeAlone/setup-wfctl@bcd880980f5bbe8d192d0c20ff6279d25331f956", + "nodeSHA256": "50a4a8d5a662beda4b4b57507d7342495a175dd663e5c1e247961dcbb5d83bee", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5", + "nodeSHA256": "72a9f885834e7e7cfc170d24954ed15b9c11a222760a6b919510993561321f03", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff", + "nodeSHA256": "5f52e8bc5d4f74ac39c486b8605c4e16db070ea05934d4d741f739f34e43394a", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "uses": "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02", + "nodeSHA256": "0fe822ed8559961639e22a7249495326099fd0c0302ee96b5ecdf0e6434d6385", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed immutable action node and inherited execution context.", + "state": "staged" } ] diff --git a/.github/public-workflow-command-allowlist.json b/.github/public-workflow-command-allowlist.json index f2e8de3..77ea891 100644 --- a/.github/public-workflow-command-allowlist.json +++ b/.github/public-workflow-command-allowlist.json @@ -854,5 +854,157 @@ "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", "rationale": "Exact reviewed wfctl statement and inherited execution context.", "state": "active" + }, + { + "path": ".github/workflows/ci.yml", + "command": "$assignment", + "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed $assignment statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "check-public-workflow-policy.sh", + "statementSHA256": "059267b9a877a8957428b61e6450583c9962076265d2e5021c62503cbaaa80cd", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed check-public-workflow-policy.sh statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "cp", + "statementSHA256": "0d014a1d348020afc447050504e37ef90fff840616f0bd14bbe55fa8691ff82c", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed cp statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "cp", + "statementSHA256": "f24c02e0a37916516a87e3adb67605ee89a9829472e4b8c1ea728f5e6b30fc13", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed cp statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "echo", + "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed echo statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "exit", + "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed builtin statement and complete workflow context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "go", + "statementSHA256": "4b2eb9bc1a70c92294c2a9f9ff2429166f819eec67e05a3db30b46dfc3ea08de", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed go statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "go", + "statementSHA256": "f9f85ad974896d0638b921502dcc30e4a553f92830be8bdc9914a8959bf142ee", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed go statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "mktemp", + "statementSHA256": "cce7b2dcf90f57e6c0debcae2ec8f47163c98bb92c8897577af9633e6091549b", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed mktemp statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "rm", + "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed rm statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "rm", + "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed rm statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "rm", + "statementSHA256": "abca00ffde9ce2b84108aa4b5161a54703373b74d9cd4d64625103d19db1b800", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed rm statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "sed", + "statementSHA256": "3da3a2022e982564e297bf3d72804a5c1681565348f74bd7aa037e6b0270d972", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed sed statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "sed", + "statementSHA256": "55776ebdb126dba0c3b4ff10113a6308b3322726b60c7ad3d327eed567a58c5c", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed sed statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "test", + "statementSHA256": "3fd6aea73eb83ad70cab82347f03c893206cc7f8b8f70e4649aa8270d2c054c9", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed builtin statement and complete workflow context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "test-public-workflow-policy.sh", + "statementSHA256": "c133baf851f841a2a19da61077e346d5f5d6d7640e23b310a3c11f8307370a2a", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed test-public-workflow-policy.sh statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "wfctl", + "statementSHA256": "10a8deeda60dd3240448a5f198fa8b22207e27f405c1bc21fd9178b8d27b94bf", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed wfctl statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "wfctl", + "statementSHA256": "67815ba97241cf4f93fa278d1412e0fae91e87afc65f43fe52d211243a2bb95e", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed wfctl statement and inherited execution context.", + "state": "staged" + }, + { + "path": ".github/workflows/ci.yml", + "command": "wfctl", + "statementSHA256": "95886645768adfe207686bd3667365dff6bcdd9a4fdf24a4365b54afaf9fbd75", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "rationale": "Exact reviewed Go1.27.2 CI context; Exact reviewed wfctl statement and inherited execution context.", + "state": "staged" } ] diff --git a/.github/public-workflow-executable-allowlist.json b/.github/public-workflow-executable-allowlist.json index 1966df0..17abd62 100644 --- a/.github/public-workflow-executable-allowlist.json +++ b/.github/public-workflow-executable-allowlist.json @@ -30,5 +30,21 @@ "state": "active", "sha256": "8728ddcc4dedb0057f331e587a821698e797950d3a3e5d7dcd4639471a4751a9", "rationale": "Exercises fail-closed workflow policy mutations in the CI test job." + }, + { + "path": ".github/workflows/scripts/check-public-workflow-policy.sh", + "workflowPath": ".github/workflows/ci.yml", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "state": "staged", + "sha256": "3fbf786aad1448c55a934f3fc3ed22644d5e83fef2a1a299a09b48b803ae7d37", + "rationale": "Exact reviewed Go1.27.2 CI context; Enforces the credential-free public workflow boundary before other CI proof." + }, + { + "path": ".github/workflows/scripts/test-public-workflow-policy.sh", + "workflowPath": ".github/workflows/ci.yml", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "state": "staged", + "sha256": "8728ddcc4dedb0057f331e587a821698e797950d3a3e5d7dcd4639471a4751a9", + "rationale": "Exact reviewed Go1.27.2 CI context; Exercises fail-closed workflow policy mutations in the CI test job." } ] diff --git a/.github/public-workflow-presence-allowlist.json b/.github/public-workflow-presence-allowlist.json index ccbec18..9ed0f3b 100644 --- a/.github/public-workflow-presence-allowlist.json +++ b/.github/public-workflow-presence-allowlist.json @@ -28,5 +28,11 @@ "contextSHA256": "9790e7f657993b45b4f49a478f788fe25744aabe48678cccd058a97ee967a9c2", "state": "active", "presence": "present" + }, + { + "path": ".github/workflows/ci.yml", + "contextSHA256": "587ecdb66f8ea81d24fa090aadec0adde17fef877cbe7ed5aea9b0208f4d15e1", + "state": "staged", + "presence": "present" } ] diff --git a/recovery_workflow_test.go b/recovery_workflow_test.go index 5be293f..c6e5f77 100644 --- a/recovery_workflow_test.go +++ b/recovery_workflow_test.go @@ -11,8 +11,8 @@ import ( "testing" ) -// Entire CI, trust and executable inventory at the approved check-contract trust cleanup baseline. -const recoveryTrustedInventorySHA256 = "9decad275cbdcb642c21311bc2996931432f2046fe969db07e6b9fa0deb63a05" +// Exact CI, trust and executable inventory with the reviewed future Go 1.27.2 context staged. +const recoveryTrustedInventorySHA256 = "8a5d9135873ceb37d3c9fa45f206739256d3a3e09c685ca178ad6b528c34a07f" func recoveryTrustedInventory(root string) (string, int, error) { var paths []string