[PR #6728] feat(ci): require live dependency security evidence for releases #7400

New issue

Open

opened 2026-11-01 21:47:35 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:47:35 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/6728
Author: @gensokyo-dev
Created: 10/23/2026
Status: 🔄 Open

Base: main ← Head: fix/dependency-security-gates-6708

📝 Commits (6)

48a1312 feat(ci): require live dependency security evidence for releases
473bcdd fix(ci): bind dependency evidence to original release inputs
1cd4714 chore: update main for dependency security verification
95eb175 fix(ci): redact authentication in case-insensitive URL schemes
08e8501 fix(ci): redact all retained dependency evidence at one boundary
8465514 fix(ci): preserve incomplete dependency evidence as unavailable

📊 Changes

33 files changed (+2079 additions, -81 deletions)

View changed files

📝 .github/workflows/ci.yml (+41 -0)
📝 .github/workflows/release-recovery.yml (+13 -2)
📝 .github/workflows/release.yml (+20 -2)
📝 docs/releasing.md (+32 -0)
➕ scripts/ci/dependency-security.mjs (+85 -0)
📝 scripts/ci/plan.mjs (+5 -0)
📝 scripts/ci/required.mjs (+4 -1)
📝 scripts/ci/scopes.mjs (+21 -0)
📝 scripts/generate-third-party-inventory.mjs (+6 -19)
➕ scripts/lib/dependency-security-facts.d.mts (+56 -0)
➕ scripts/lib/dependency-security-facts.mjs (+246 -0)
➕ scripts/lib/dependency-security.d.mts (+36 -0)
➕ scripts/lib/dependency-security.mjs (+352 -0)
➕ scripts/lib/npm-command.mjs (+24 -0)
➕ scripts/lib/npm-locked-packages.d.mts (+2 -0)
➕ scripts/lib/npm-locked-packages.mjs (+41 -0)
📝 scripts/lib/release-package-canary.mjs (+0 -21)
➕ scripts/lib/release-package-install.d.mts (+26 -0)
➕ scripts/lib/release-package-install.mjs (+95 -0)
➕ scripts/lib/transport-authentication.d.mts (+1 -0)

...and 13 more files

📄 Description

Summary

Fixes #6708. Follow-up to #6480.

CI previously had no required live advisory/signature evidence, and release canaries discarded the actual consumer lock. Source locks do not pin npm consumers. This adds fresh checks to qualification and the exact consumer installations already exercised before/after publication.

Change and scope

Share the lock parser with license inventory generation; join npm-reported installed identities/relationships to the selected lock's declared origins and integrity. Retain raw evidence, optional omissions, unknowns, fingerprints and source-version/integrity differences. Unknown/malformed/unavailable evidence fails; verified-signature count stays unknown.
Require a read-only dependency-security lane on relevant changes and fresh scans even when provider qualification is reused. Check the current published consumer daily. Bound registry concurrency to 2, sequential commands, 1 GiB Node heap, 180-second command deadlines and 16 MiB output budgets. Archive passes are never substituted for live results.
Reuse one hook-disabled consumer install for security checks and CLI/MCP canaries, retaining its generated lock; require the checks in release and recovery workflows before executing REA. Preserve floating semver resolution and record drift. Bind recovery to its original release source directory and SHA, independently of controller source. Preserve failed-attempt evidence with attempt-specific artifact names. Keep all real-package schemas; the protocol replay fixture omits unused output schemas while retaining all tool/input contracts and the called tool's result contract.

Semantic owners: shared npm lock facts, npm's installed identities/edges, and the existing archive-integrity verifier. Public REA CLI/MCP/provider contracts are unchanged; no target capability or maintainer scope decision applies. No publishing permission, administrative setting or npm release is changed here.

Validation performed

Focused CI/release/process suite: 389 passed, 1 Windows-only skip across 8 files. Final security/workflow/no-dependency preflight/inventory follow-up: 26 passed (overlaps that suite). Negative cases include unavailable/malformed/oversized output, signature/advisory failures, changed integrity, registry coverage, unresolved/conflicting identities and modified archive bytes.
npm run check: all 6 tasks and architecture guards passed; npm run docs:check: passed, including 9 consistency cases. Shared inventory stays at 775 locked / 180 runtime records with the same runtime fingerprint.
Real npm rea-agents@6.7.0 fresh consumers: cold npm cache 108.799 s elapsed / 17.340 s CPU / 359.7 MiB sampled family RSS; warmed cache with a new project 97.378 s / 14.861 s / 384.8 MiB. Both passed live checks: 175 nodes, 242 edges, 8 optional omissions, 0 unknowns, 9 version drifts, 0 changed locked integrities; equal content fingerprints. Node 24.22.1, npm 11.16.0, one CPU, 1 GiB Node heap. OS caches were warm; no general speedup or token savings claimed. Token costs were not measured.
Committed-source live check passed: 557 nodes / 965 edges / 264 optional omissions / 0 unknowns / no version or integrity drift, fingerprint 8b7c726d…. Local npm 11.16.0: 112.292 s elapsed / 26.096 s CPU / 692.9 MiB sampled family RSS; the first CI merge also passed with bundled npm 11.19.1 and the same fingerprint (host/environment timings are not comparable).
Real archive from commit 48a1312: complete verify:package passed, 393.243 s / 305.841 s CPU / 1251.5 MiB; 220 tools, 6 prompts, update/setup/evidence/CLI and verified cleanup. Local synthetic manifest run 123, not a GitHub qualification or npm publication. Controller 473bcdd then checked the same archive with its original source SHA/lock: live security plus complete CLI/MCP canary passed, 114.447 s / 41.837 s CPU / 1065.9 MiB. Later main changes are covered by final-head CI, not claimed as part of this older archive.
Review fixes: raw lock URL validation precedes credential redaction; one shared consumer context binds recovery lock and SHA. Updated regression subset: 73 passed / 1 Windows-only skip; final workflow/inventory follow-up: 7 passed. Final pre-sync npm run check: all 6 tasks and architecture guards passed (33.274 s / 32.790 s CPU / 1712.0 MiB). Latest main was merged to include its independent fixture fixes; current-head CI and focused post-sync checks are running.
Earlier prototype failures are retained: npm omits integrity/origin metadata when its hidden cache is stale or a node is deduplicated; the exact-path lock join fixes that representation problem rather than treating absent fields as a clean result.

Compatibility and limits

Linux live evidence covers the selected lock and npm-supported installed registry packages; it does not verify all platform packages, rehash installed files, detect all malware, pin future semver resolutions or validate optional native secondary downloads. No real provider behavior or npm publication is claimed. RSS is a sampled sum of descendant RSS (shared pages may double-count; short-lived/reparented children may be missed), not a hard aggregate cap. Source changes require the normal release process.

Author readiness

Human owner: @gensokyo-dev

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/6728 **Author:** [@gensokyo-dev](https://github.com/gensokyo-dev) **Created:** 10/23/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `fix/dependency-security-gates-6708` --- ### 📝 Commits (6) - [`48a1312`](https://github.com/morluto/rea/commit/48a13122376bf2f245d7d19dc39a32eade9a82d0) feat(ci): require live dependency security evidence for releases - [`473bcdd`](https://github.com/morluto/rea/commit/473bcdd20476f25596bfdad9e9cd6c80c70a41bc) fix(ci): bind dependency evidence to original release inputs - [`1cd4714`](https://github.com/morluto/rea/commit/1cd471487b2e603a5e2789c390a93530c241cbed) chore: update main for dependency security verification - [`95eb175`](https://github.com/morluto/rea/commit/95eb17545777588634987b7e32fd39fd328340ad) fix(ci): redact authentication in case-insensitive URL schemes - [`08e8501`](https://github.com/morluto/rea/commit/08e8501d7b411f45666d5b8064bc2e71e5116be2) fix(ci): redact all retained dependency evidence at one boundary - [`8465514`](https://github.com/morluto/rea/commit/8465514782441d5faad34e95cd078d3a16bec861) fix(ci): preserve incomplete dependency evidence as unavailable ### 📊 Changes **33 files changed** (+2079 additions, -81 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/ci.yml` (+41 -0) 📝 `.github/workflows/release-recovery.yml` (+13 -2) 📝 `.github/workflows/release.yml` (+20 -2) 📝 `docs/releasing.md` (+32 -0) ➕ `scripts/ci/dependency-security.mjs` (+85 -0) 📝 `scripts/ci/plan.mjs` (+5 -0) 📝 `scripts/ci/required.mjs` (+4 -1) 📝 `scripts/ci/scopes.mjs` (+21 -0) 📝 `scripts/generate-third-party-inventory.mjs` (+6 -19) ➕ `scripts/lib/dependency-security-facts.d.mts` (+56 -0) ➕ `scripts/lib/dependency-security-facts.mjs` (+246 -0) ➕ `scripts/lib/dependency-security.d.mts` (+36 -0) ➕ `scripts/lib/dependency-security.mjs` (+352 -0) ➕ `scripts/lib/npm-command.mjs` (+24 -0) ➕ `scripts/lib/npm-locked-packages.d.mts` (+2 -0) ➕ `scripts/lib/npm-locked-packages.mjs` (+41 -0) 📝 `scripts/lib/release-package-canary.mjs` (+0 -21) ➕ `scripts/lib/release-package-install.d.mts` (+26 -0) ➕ `scripts/lib/release-package-install.mjs` (+95 -0) ➕ `scripts/lib/transport-authentication.d.mts` (+1 -0) _...and 13 more files_ </details> ### 📄 Description ## Summary Fixes #6708. Follow-up to #6480. CI previously had no required live advisory/signature evidence, and release canaries discarded the actual consumer lock. Source locks do not pin npm consumers. This adds fresh checks to qualification and the exact consumer installations already exercised before/after publication. ## Change and scope - Share the lock parser with license inventory generation; join npm-reported installed identities/relationships to the selected lock's declared origins and integrity. Retain raw evidence, optional omissions, unknowns, fingerprints and source-version/integrity differences. Unknown/malformed/unavailable evidence fails; verified-signature count stays unknown. - Require a read-only dependency-security lane on relevant changes and fresh scans even when provider qualification is reused. Check the current published consumer daily. Bound registry concurrency to 2, sequential commands, 1 GiB Node heap, 180-second command deadlines and 16 MiB output budgets. Archive passes are never substituted for live results. - Reuse one hook-disabled consumer install for security checks and CLI/MCP canaries, retaining its generated lock; require the checks in release and recovery workflows before executing REA. Preserve floating semver resolution and record drift. Bind recovery to its original release source directory and SHA, independently of controller source. Preserve failed-attempt evidence with attempt-specific artifact names. Keep all real-package schemas; the protocol replay fixture omits unused output schemas while retaining all tool/input contracts and the called tool's result contract. Semantic owners: shared npm lock facts, npm's installed identities/edges, and the existing archive-integrity verifier. Public REA CLI/MCP/provider contracts are unchanged; no target capability or maintainer scope decision applies. No publishing permission, administrative setting or npm release is changed here. ## Validation performed - Focused CI/release/process suite: 389 passed, 1 Windows-only skip across 8 files. Final security/workflow/no-dependency preflight/inventory follow-up: 26 passed (overlaps that suite). Negative cases include unavailable/malformed/oversized output, signature/advisory failures, changed integrity, registry coverage, unresolved/conflicting identities and modified archive bytes. - `npm run check`: all 6 tasks and architecture guards passed; `npm run docs:check`: passed, including 9 consistency cases. Shared inventory stays at 775 locked / 180 runtime records with the same runtime fingerprint. - Real npm `rea-agents@6.7.0` fresh consumers: cold npm cache 108.799 s elapsed / 17.340 s CPU / 359.7 MiB sampled family RSS; warmed cache with a new project 97.378 s / 14.861 s / 384.8 MiB. Both passed live checks: 175 nodes, 242 edges, 8 optional omissions, 0 unknowns, 9 version drifts, 0 changed locked integrities; equal content fingerprints. Node 24.22.1, npm 11.16.0, one CPU, 1 GiB Node heap. OS caches were warm; no general speedup or token savings claimed. Token costs were not measured. - Committed-source live check passed: 557 nodes / 965 edges / 264 optional omissions / 0 unknowns / no version or integrity drift, fingerprint `8b7c726d…`. Local npm 11.16.0: 112.292 s elapsed / 26.096 s CPU / 692.9 MiB sampled family RSS; the first CI merge also passed with bundled npm 11.19.1 and the same fingerprint (host/environment timings are not comparable). - Real archive from commit `48a1312`: complete `verify:package` passed, 393.243 s / 305.841 s CPU / 1251.5 MiB; 220 tools, 6 prompts, update/setup/evidence/CLI and verified cleanup. Local synthetic manifest run 123, not a GitHub qualification or npm publication. Controller `473bcdd` then checked the same archive with its original source SHA/lock: live security plus complete CLI/MCP canary passed, 114.447 s / 41.837 s CPU / 1065.9 MiB. Later main changes are covered by final-head CI, not claimed as part of this older archive. - Review fixes: raw lock URL validation precedes credential redaction; one shared consumer context binds recovery lock and SHA. Updated regression subset: 73 passed / 1 Windows-only skip; final workflow/inventory follow-up: 7 passed. Final pre-sync `npm run check`: all 6 tasks and architecture guards passed (33.274 s / 32.790 s CPU / 1712.0 MiB). Latest main was merged to include its independent fixture fixes; current-head CI and focused post-sync checks are running. - Earlier prototype failures are retained: npm omits integrity/origin metadata when its hidden cache is stale or a node is deduplicated; the exact-path lock join fixes that representation problem rather than treating absent fields as a clean result. ## Compatibility and limits Linux live evidence covers the selected lock and npm-supported installed registry packages; it does not verify all platform packages, rehash installed files, detect all malware, pin future semver resolutions or validate optional native secondary downloads. No real provider behavior or npm publication is claimed. RSS is a sampled sum of descendant RSS (shared pages may double-count; short-lived/reparented children may be missed), not a hard aggregate cap. Source changes require the normal release process. ## Author readiness Human owner: @gensokyo-dev - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-11-01 21:47:35 +00:00

bsakaguchi referenced this issue

2026-11-03 00:29:32 +00:00

[GH-ISSUE #5653] [Tracker] New issue intake by area (October 2026) #3423