[Kevin Cho (chokevin)]

Summary

Complete releases previously mixed release-selected source with release control and depended on repository-side orchestration that could not be operated through the supported protected publisher path. Now an immutable annotated vX.Y.Z tag selects only the reviewed source and version, while protected control code independently validates the exact main revision and release SHA before packaging or publication.

pr-532-protected-complete-release.mp4

• Coordinated source charts remain release-neutral at 0.0.0-dev / dev; scripts/ci/release_artifacts.py copies and stamps release packages from the validated tag.
• .pipelines/publish-helm-charts.yml accepts the shared release contract (sourceRef, sourceTag, releaseTag, forcePublish=false) and separates protected self control from the pinned releaseSource checkout.
• scripts/ci/validate_release_source.py rejects lightweight tags, tag/SHA mismatches, commits outside main, and dirty release sources.
• The unsupported repository workflow, queue client, and repository-to-publisher identity were removed rather than weakening protections or suppressing security findings.
• Release-built CLI binaries pin their matching chart version; development builds retain the existing latest-published-chart behavior.
• The protected manual control pipeline can coordinate images, charts, CLI, and SDK assets from the same commit, publish last, and verify the public asset names, checksums, and bytes.

Related issue

N/A - coordinated release publication; no issue-closing reference.

Validation

python3 -m unittest scripts/ci/tests/release_artifacts_test.py scripts/ci/tests/validate_release_source_test.py
  PASS - 16 tests

bash scripts/ci/tests/release-workflow-contract_test.sh
bash scripts/ci/tests/publish-helm-charts_test.sh
bash scripts/ci/tests/release-image-provenance-contract_test.sh
  PASS

shellcheck --severity=warning scripts/ci/publish-helm-charts.sh scripts/ci/tests/release-workflow-contract_test.sh scripts/ci/tests/publish-helm-charts_test.sh scripts/ci/tests/release-image-provenance-contract_test.sh
  PASS

python3 scripts/check-license-headers.py
  PASS - 931 source files

git diff --check
  PASS

Protected chart-publisher preview
  PASS

GitHub checks at 37cd031aeb5482886b5f6e4888ece6c3e7c06ac9
  PASS - CodeQL
  PASS - Release / Detect preparation
  PASS - Release / Reproduce assets
  PASS - TauGrid Core Required
  PASS - all remaining required checks

Compatibility and operational impact

• No public API, command, or CRD contract changes.
• An annotated vX.Y.Z tag on the reviewed main commit is the sole coordinated release version source.
• Source chart metadata intentionally remains release-neutral; packaged charts receive the release version, app version, dependency versions, and first-party image defaults from the tag.
• Independently versioned dependencies retain their existing versions.
• Registry and repository credentials remain inside existing protected tasks and publishers; this change adds no long-lived credential.
• The first release requires the companion protected-control change to be merged and activated from main, then must use a new reviewed tag created after both changes merge.
• Publication fails closed on stale control code, source/tag mismatches, forced release replacement, or unexpected artifact bytes.

Checklist

• The change is focused and does not include unrelated edits.
• Tests cover the changed behavior, or I explained why tests are not needed.
• Documentation and examples are updated when public behavior changes.
• Generated files are updated from their source and included in this pull request.
• New dependencies are publicly available and their license and provenance were reviewed.
• The diff contains no secrets, private endpoints, customer data, or Microsoft-internal information.
• Fork-based CI can validate the change without repository secrets, or maintainer-only validation is clearly identified.

AI assistance: GitHub Copilot helped implement, test, document, and prepare evidence for this change; the author must verify the final behavior and text before merge.

[Kevin Cho (chokevin)]

18-second replay of the actual committed release-job dependency diff and actual offline synthetic packaging/receipt verification. The source-mismatch rejection is executed, not a narrated success claim. Registry, identity, and pipeline I/O are mocked; this is not live publication evidence. Detailed logs are retained separately.

release-builds-offline.mp4

[Kevin Cho (chokevin)]

Requesting authorized human review, not automatic dismissal, of the five actions/cache-poisoning/poisonable-step alerts reported on the original PR head: 17, 43, 54, 55, and 56.

The SARIF paths treat needs.validate.outputs.source_sha as untrusted code executed in the default-branch context. The release intentionally separates reviewed orchestration from the immutable product-tag commit. Before a consumer can run, the actual validator requires an annotated tag, verifies both product and orchestration commits are ancestors of origin/main, checks tag-owned release notes, and fails closed on unknown release-existence reads.

Follow-up commit f1c649759ff0f7f2ada8ab64c7bf4c5302f6ff76 adds executable tests using the actual workflow shell script and real temporary Git histories, rather than a substring proxy. A reviewed annotated main tag passes; off-main tags, lightweight tags, off-main orchestration, non-main dispatch, and unknown HTTP results fail before source outputs are emitted. Tests also require successful-validation dependencies for every payload consumer and nonpersistent credentials for every checkout. The immutable-source split remains unchanged; no output renaming, suppression, dismissal, or permission escalation was used.

python -m unittest discover -s scripts/ci/tests -p 'release_*_test.py'
PASS — 27 tests, including seven new workflow trust-boundary tests
actionlint .github/workflows/release-tau.yaml .github/workflows/taugrid-validation.yml
PASS
ruff check scripts/ci/tests/release_workflow_test.py
PASS
bash scripts/ci/tests/release-workflow-contract_test.sh
PASS
python3 scripts/check-license-headers.py
PASS
git diff --check
PASS

These are trust-gate regression results, not proof that all cache attacks are impossible. Disabling tool caches alone does not remove cache-service token exposure. CodeQL remains a pending review concern, and fresh analysis of the follow-up is not claimed green. Live integration and protected-resource activation also remain unverified. Please assess the source-trust evidence against the query's threat model before deciding whether an alert classification or a separate isolation design is appropriate.

[Pengfei Ni (feiskyer)]

LGTM