Repository navigation
feat: verify retained publication attestations - #23
Conversation
Pin the GitHub CLI verifier by archive and executable digest, challenge the exact retained Sigstore bundle under closed workflow identity constraints, and preserve a non-authoritative typed verification record.
|
Warning Review limit reached
Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (13)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Fresh-runner checkpoint: CI run |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3e5e04ca0d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| jq -e --arg report_hash "$report_hash" --arg predicate_type "$predicate_type" ' | ||
| type == "array" and length > 0 and | ||
| all(.[].verificationResult.statement.predicateType == $predicate_type) and |
There was a problem hiding this comment.
all directly to each verification result
When gh attestation verify --format json produces the array this filter expects, jq's one-argument all(condition) already evaluates the condition against each array element. The extra .[] here—and in the timestamp check on line 68—descends into each attestation's field values, where .verificationResult is absent, so the filter returns false even for a valid result. Because the script uses set -e, every successful protected-main verification stops here and the verification artifacts are never uploaded; remove the inner .[] or use jq's generator form of all.
Useful? React with 👍 / 👎.
Closes the second infrastructure slice of #21 without claiming proof authority.
Product outcome
mainref, commit, predicate, and GitHub-hosted-runner constraintspublication_attestation_verification/1recordmainboundary evidence and dev diary entry 32Local evidence
a2f57f427d5e59b4042bcbdd703436595014bdd3cargo fmt --checkTrust boundary
This PR does not create authoritative evidence and cannot derive mathematical status. The protected
mainworkflow must first prove the real pinned attestation-verification path. Controlled canonical ingestion of a realpublication_report/1and authoritative exact proof or refutation evidence remain open in #21.