Bind safe-output patch and bundle application to validated bytes

[Copilot]

Summary

Bind safe-output patch validation, bundle import, and publication to the same captured bytes. Both create_pull_request and push_to_pull_request_branch reject changed or ambiguous artifacts instead of applying or publishing unvalidated content.

• Shared qualified repository identity: Producer and consumer derive patch/bundle filenames from the same authorized, fully qualified target repository slug. Normalize bare names and surrounding whitespace before resolution. Qualify filenames even for the implicit workflow repository; fork-backed delivery still uses the target repository, not the head repository, for transport naming. Consumers no longer search raw repository input or a different default repository after resolving the target.
• Fail-closed candidate selection: Resolve patch and bundle together from one namespace. Retain compatibility with a unique legacy unqualified namespace, but reject multiple matching namespaces—including duplicate patches/bundles and a qualified patch paired with a legacy bundle. Ambiguity returns permanent ERR_TRANSPORT_INTEGRITY, with a safe diagnostic, before capture, Git commands, publication, retries, or fallback issues; allow-empty does not bypass it.
• Capture and attestation: Retain raw bytes, SHA-256 digests, and device/inode identities in trusted runtime memory. Nonblocking, no-follow descriptor opens reject symlinks, replacements, deletions, and nonregular files—including FIFOs—without hanging the handler.
• Stable application: Route Git consumers through private, read-only snapshots outside the checkout. Preserve full byte verification at transport reads, application, publication boundaries, and handler completion. Unrelated local commands use lightweight identity checks; snapshot digests are cached to avoid repeated full-bundle scans.
• Trusted transformations and retries: Resolve temporary IDs and commit-title suffixes from captured bytes without rewriting canonical artifacts or resetting their integrity baselines. Integrity failures remain permanent regardless of branch/path text; recheck before remote writes and retried publication, without conflict recovery or fallback publication after failure.
• Restricted cleanup and diagnostics: Allow only registered local Git cleanup after integrity failure, including temporary bundle-ref deletion and patch abort, pinned to the original checkout. Dispose snapshots on every exit path and surface cleanup failures. Preserve filesystem causes while logging safe operation/reason/system-code diagnostics, not artifact contents, secrets, or raw cause text.
• Specifications: Update Safe Outputs v1.29.12 with PTI-001–007 and conformance mappings, clarify the runtime boundary in Compiler Threat Detection v1.0.52 without adding a CTR rule, and add a bounded TLA+ transport lifecycle model and pinned-runtime checker.

Integration with main

Merged origin/main through 727195a53b, including the environment-resolved cross-repository checkout fix, session parser dependencies, runtime publishing, and work-queue fixes. Preserved qualified transport resolution and added producer/consumer round-trip coverage for environment-selected side repositories. Regenerated workflow locks to include the upstream target-repository environment forwarding.

Validation

• Integrated transport, repository resolution, producer/consumer, PR handlers, retry, manual recovery, and real-Git coverage: 1,114 tests passed, 1 skipped across 11 suites.
• Producer/consumer regressions cover implicit targets, bare names, padded slugs, explicit targets overriding defaults, fork-backed head repositories, and environment-selected side repositories. Resolver/handler tests cover duplicate and mixed namespaces, permanent failure classification, safe diagnostics, and absence of Git/publication side effects.
• TLA+ checker verified 34 cases: two exhaustive secure profiles, 22 expected negative controls, and 10 reachability witnesses. Includes qualified-slug agreement and ambiguity-rejection invariants. 15 Python checker-contract tests passed.
• Final branch-scoped build, formatting/lint, schema freshness, and workflow drift validation passed. 344 workflows compiled successfully, with generated locks in sync.
• Manual bundle helper tests use TMPDIR=/tmp to match their hardcoded recovery paths on macOS and a 60-second test timeout. The initial default-environment failures were rerun successfully with those settings.
• Existing regressions also cover FIFO rejection, sticky errors, checkout-pinned cleanup, cleanup-error propagation, and an I/O budget requiring zero full-file reads/hashes across 100 unrelated commands with an 8 MiB bundle.

Related issues

Addresses #68786, #68787, #68788, #68789, and #68790; all five are closed.

Readiness

The PR is open and not draft. Local validation above covers the integrated code; GitHub CI/review readiness for the newly pushed HEAD has not been verified by this pass. No workflow runs, merge, or auto-merge were triggered.

[github-actions]

Great work binding patch/bundle application to validated bytes! Focused, tested, and well described — this looks ready for review.

Generated by ✅ Contribution Check · copilot · auto · 44.5 AIC · ⌖ 0.613 AIC · ⊞ 9.3K · ◷

[Copilot]

🔵 Needs a closer look

Security-sensitive integrity, recovery, and publication changes retain unresolved gaps and require final human review.

5 open findings

• Integrity failures bypass custom retry classification · New
• Rewrite rebase lacks scoped cleanup on integrity failure · New
• Unconditional git am abort masks malformed patch errors · New
• Missing post-creation integrity check enables follow-on actions · New
• Missing post-issue integrity check enables agent assignment · New

What changed in this PR

Strengthens gh-aw safe-output handling by binding patch and bundle validation, application, and publication to captured bytes.

Changes:

• Adds captured-byte integrity checks and private Git snapshots.
• Guards transformations, retries, and remote publication.
• Expands cleanup, diagnostics, and regression coverage.

File	Description
actions/​setup/​js/​transport_integrity.test.cjs	Tests integrity, snapshots, cleanup, and I/O limits.
actions/​setup/​js/​transport_integrity.cjs	Implements capture, verification, snapshots, and cleanup.
actions/​setup/​js/​transport_integrity_handlers.test.cjs	Tests handler tampering and publication boundaries.
actions/​setup/​js/​transport_integrity_git.test.cjs	Tests cleanup with real Git.
actions/​setup/​js/​push_to_pull_request_branch.test.cjs	Updates snapshot and transformation assertions.
actions/​setup/​js/​push_to_pull_request_branch.cjs	Integrates integrity guards into branch updates.
actions/​setup/​js/​push_signed_commits.cjs	Checks integrity before remote writes.
actions/​setup/​js/​extra_empty_commit.cjs	Guards CI-trigger commit publication.
actions/​setup/​js/​error_recovery.test.cjs	Tests permanent integrity-error classification.
actions/​setup/​js/​error_recovery.cjs	Excludes integrity errors from default retries.
actions/​setup/​js/​create_pull_request.test.cjs	Updates bundle snapshot tests and fixtures.
actions/​setup/​js/​create_pull_request.cjs	Guards application, transformations, and publication.
actions/​setup/​js/​create_or_update_pull_request.test.cjs	Tests integrity checks across API retries.
actions/​setup/​js/​create_or_update_pull_request.cjs	Checks integrity before each creation attempt.

🧠 Review effort: Max

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.
2. Review (actions/setup/js/error_recovery.cjs:81): The new check only protects isTransientError. withTransientPushRetry overrides it with isWorkflowsScopeTimeoutError, which still classifies errors by message text. Filename sanitization preserves spaces, so an artifact path containing unable to determine if workflow can be created or updated makes a typed integrity failure trigger six attempts and five sleeps totaling about 690 seconds. Reject ERR_TRANSPORT_INTEGRITY in the shared retry loop before calling any custom classifier, and add push-retry coverage for this path. - Bind safe-output patch and bundle application to validated bytes #68732 (comment)
3. Review (actions/setup/js/transport_integrity.cjs:153): The sticky failure also blocks bundle-rewrite rollback, but only patch aborts and temporary bundle-ref deletion are registered for cleanup. rewriteBundleBranchAsSingleCommit calls linearizeRangeAsCommit, which can start a rebase. If an artifact is deleted or replaced during a conflicting rebase, this check rejects both the helper's git rebase --abort and git reset --hard <originalHead>. Final cleanup cannot restore the checkout, leaving the rebase unfinished. Register narrowly scoped cleanup for this rewrite, pinned to its checkout and trusted original HEAD, rather than allowing arbitrary resets after failure. - Bind safe-output patch and bundle application to validated bytes #68732 (comment)
4. Review (actions/setup/js/transport_integrity.cjs:159): This registers an unconditional abort before git am starts. A malformed patch can fail with Patch format detection failed without creating an apply session; git am --abort then exits 128. Both PR handlers can leave that cleanup registered, so the finalizer throws Failed to clean up safe-output Git state instead of preserving the patch-apply failure. Make explicit and finalizer abort cleanup a no-op when no am session exists in the pinned checkout. Preserve genuine abort failures and add malformed-patch coverage. - Bind safe-output patch and bundle application to validated bytes #68732 (comment)
5. Review (actions/setup/js/create_or_update_pull_request.cjs:10): If an artifact changes while successful PR creation is in flight, this helper returns without detecting it. The caller can then enable auto-merge and close older PRs before its next byte check reports failure. Await creation and recheck integrity before returning the response, so those follow-on actions do not run after an in-flight mutation. - Bind safe-output patch and bundle application to validated bytes #68732 (comment)
6. Review (actions/setup/js/create_pull_request.cjs:492): If an artifact changes during successful fallback-issue creation, this pre-request check is the last check before the response reaches callers. They can immediately assign the Copilot coding agent, starting follow-on work before handler completion rejects the mutation. Recheck integrity after the awaited request and before returning the issue. - Bind safe-output patch and bundle application to validated bytes #68732 (comment)

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: 1fbab21
Sous-chef work: 1ef772e4271a29338d076c326f87621da6bd44e55a95b9a3df8c6e29b22af741 43696e57c444ffdd8f11cc70a65a6010767d924f6e00cdea231de7a3c57117f8 8068bcd4a1557c03fd5110d9746acd9eaa3d5b62de99bebe9018a5b64198e43a 898ae2b785621a4e008b6df51509a04e0f3b90595f5aa3f54e05bd7c2b204cc6 a5daa7a0b05f9facbf0b933a9b371ac15a14f25a5d2d0bc97f42b37179e1a399
Sous-chef state: c50f96ae7d053a8f8dfcd042a4354ae6a79a4d5cecf6e6a805ca15bf9d5138be

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 4.65 AIC · ⌖ 6.91 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

[gh-aw-bot]

@copilot address the following outstanding work in one pass:

1. Update this branch with the latest main using make merge-main, resolving any conflicts and preserving the intended changes.

Push the necessary fixes, reply to each listed review thread and resolve it when addressed. Ignore feedback already answered or resolved. Use the pr-finisher skill and stop when only human review or CI remains; do not trigger CI.

Sous-chef head: fa22065
Sous-chef work:
Sous-chef state: 751ed6bc5976bc0473aacf471ca1d259717c3635f6fe181b5d80d1f83ee6967d

Generated by 👨‍🍳 PR Sous Chef · pi · haiku45 · 3.64 AIC · ⌖ 7.1 AIC · ⊞ 1.1K · ◷
_{Comment /souschef to run again}

[pelikhan]

/smoke

[github-actions]

🍳 skillet has started processing this pull request comment

[github-actions]

🎉 This pull request is included in a new release.

Release: v0.92.0