Promote Develop to Main

[ptr727]

Summary

• Promote fail-closed release validation and audit path discovery.
• Promote explicit Bash labels for executable audit commands.
• Promote the canonical PyPI artifact-name regression guard.
• Promote the executable Python entry point for the release-guard test.
• Promote the internally consistent missing-job audit fixture.

Source

• Fail Closed at Release and Audit Boundaries #844 (a08713a)
• Fail Loudly on Audit Declaration Reads #847 (af2c8ff)
• Label Audit Commands as Bash #848 (1cd5b84)
• Guard Canonical PyPI Artifact Naming #849 (87c3960)
• Make Release Guard Test Executable #850 (9b6c01f)
• Keep Missing-Job Fixture Internally Consistent #851 (bb4d603)

Validation

• 730 Python tests
• audit self-tests and spec validation
• ruff, mypy, and coverage
• actionlint, markdownlint, EditorConfig, CSpell, ShellCheck, and PSScriptAnalyzer
• Copilot full-diff review on each feature pull request

Closes #842
Closes #843
Closes #845

[Copilot]

Pull request overview

Promotes the develop changes that make release publishing and audit path discovery fail closed (rather than fail open) by tightening the publish workflow gate, updating the spec/audit interface contract and selftests, and adding a regression test to prevent future drift.

Changes:

• Gate publish on successful validate in .github/workflows/publish-release.yml, and encode that requirement in the interface contract (spec/files.json) + selftests (spec/audit.py).
• Make audit path discovery fail loudly on gh api errors by prefetching root and .github directory listings in AUDIT.md.
• Add scripts/tests/test_release_guards.py to regression-test both guards.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
spec/files.json	Extends the publish-release interface contract to require the validation-success guard token in the publish job.
spec/audit.py	Updates interface selftest fixtures/cases to enforce and regression-test the new publish guard.
scripts/tests/test_release_guards.py	Adds executable regression coverage for the release validation gate and audit probe error handling.
AUDIT.md	Switches audit path discovery from a fail-open probe to fail-loud directory listing + local membership checks.
.github/workflows/publish-release.yml	Makes publish conditional on needs.validate.result == 'success' in addition to the plan output.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

AUDIT.md:145

• The snippet is fenced as sh, but these lines rely on bash-specific features (<<< here-strings and $'\n'). If a reader runs the command under POSIX sh (e.g., dash), it will fail and the audit procedure won't be reproducible as written. Consider rewriting to POSIX-compatible stdin pipes (or otherwise clearly make it bash-only).

  dependabot_yaml=$(base64 -d <<<"$dependabot_content") || exit 1
  decl=$(grep -oE '^[[:space:]]*-?[[:space:]]*package-ecosystem:[[:space:]]*"?[a-z-]+' <<<"$dependabot_yaml" | grep -oE '[a-z-]+$' | sort -u)
  root_paths=$(gh api "repos/<owner>/<repo>/contents?ref=<ground>" --jq '.[].path') || exit 1
  github_paths=$(gh api "repos/<owner>/<repo>/contents/.github?ref=<ground>" --jq '.[].path') || exit 1
  has() { grep -Fxq "$1" <<<"$root_paths"$'\n'"$github_paths"; }

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

scripts/tests/test_release_guards.py:1

• Add the standard #!/usr/bin/env python3 shebang used by the other scripts/tests/*.py files in this repo, so the new test file is consistent and can be run directly the same way.

"""Protect release and audit boundaries from fail-open regressions."""

[ptr727]

Suppressed finding from review round (1): AUDIT.md:145 says the sh fence contains Bash-only here-strings and dollar-quoted text. Fixed in 1cd5b84. The audit command fences that contain Bash syntax are labeled bash, and the regression test in scripts/tests/test_release_guards.py verifies the class.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[ptr727]

Suppressed finding from review round (1): scripts/tests/test_release_guards.py:1 says the standard executable Python shebang is missing. Fixed in 9b6c01f. The file carries #!/usr/bin/env python3 with mode 100755, and direct execution runs all 4 release-guard tests.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

spec/audit.py:2447

• The "publish-release.yml stub missing the validate job" test fixture builds a publish job that declares needs: [plan] but then references needs.validate.result. In GitHub Actions, needs.<job> is only populated for jobs listed in needs, so this stub is internally inconsistent and less representative of a real workflow shape.

Adjust the stub to keep the publish job’s needs list consistent with the if: expression (while still omitting the validate: job definition to exercise the missing-job finding).

            "    needs: [plan]\n"
            "    if: ${{ needs.validate.result == 'success' }}\n"

[ptr727]

Suppressed finding from review round (1): spec/audit.py:2447 says the missing-validate-job fixture references needs.validate without declaring that dependency. Fixed in bb4d603. The publish job lists needs: [plan, validate] while the validate job definition remains absent, so the self-test isolates the intended missing-job finding and still reports exactly once.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.