[WillIsback]

Context

While cutting v0.7.0 we hit two release-only failure modes that PR CI cannot catch: a tag pointing at a diverged commit (run rejected by GitHub after the ref moved), and the risk of forgetting the Cargo.toml version bump. Neither the cross-compiled binaries' ability to actually run, nor the integrity of uploaded assets was ever verified.

Changes to release.yml

1. release-gate job (runs first, fails fast)
   • Tag must point at the default branch HEAD — prevents releasing from a diverged/orphan commit
   • Tag version must match crates/code-review-cli/Cargo.toml — prevents "b tagged, binary says 0.(b-1)"
2. Per-platform smoke tests — after building, each binary is executed and must print the startup banner and exit 1 (missing GITHUB_TOKEN): catches cross-compiled builds that link but do not run (wrong arch, missing shared libs, glibc too new)
3. verify-release job (runs last) — re-downloads all 10 published assets and runs sha256sum -c, then smoke-tests the published linux-amd64 binary
4. concurrency: release-<tag> — serializes runs of the same tag, no duplicate release races

Verification

• YAML parses (yaml.safe_load)
• Gate logic executed locally against the real repo state (tag==HEAD ✅, version match ✅)
• pre-commit hooks passed
• Full effect will be exercised at the next tag push

[aikido-pr-checks]

Template Injection in GitHub Workflows Action - high severity
A GitHub Actions workflow step contains a template expression referencing potentially untrusted GitHub context fields. This may allow malicious input to be injected into shell commands, leading to a potential supply chain attack as tokens of the CI/CD pipeline could be exfiltrated.

Show fix

Suggested change

	run: |
	DEFAULT_BRANCH="${{ github.event.repository.default_branch }}"
	TAG_SHA=$(git rev-parse "${{ github.ref_name }}^{commit}")
	HEAD_SHA=$(git rev-parse "origin/${DEFAULT_BRANCH}")
	if [ "$TAG_SHA" != "$HEAD_SHA" ]; then
	echo "::error::Tag ${{ github.ref_name }} ($TAG_SHA) does not point at ${DEFAULT_BRANCH} HEAD ($HEAD_SHA)."
	exit 1
	fi
	env:
	DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
	REF_NAME: ${{ github.ref_name }}
	run: |
	TAG_SHA=$(git rev-parse "${REF_NAME}^{commit}")
	HEAD_SHA=$(git rev-parse "origin/${DEFAULT_BRANCH}")
	if [ "$TAG_SHA" != "$HEAD_SHA" ]; then
	echo "::error::Tag ${REF_NAME} ($TAG_SHA) does not point at ${DEFAULT_BRANCH} HEAD ($HEAD_SHA)."
	exit 1
	fi

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}

[aikido-pr-checks]

Binary, code or archive is pulled from a remote source without integrity verification - medium severity
A GitHub Actions Workflow was built using an artifact from a remote source without any integrity verification. If the remote artifact were silently replaced with a malicious version (for example, through a supply chain attack), the integrity and confidentiality of the environment in which the container is deployed could be compromised.

Show fix

Remediation: Validate the artifact against a trusted SHA-512 checksum in the CI/CD pipeline using sha512sum in check mode. Store the expected checksum in a file (e.g., artifact.sha512), then verify it with: sha512sum -c artifact.sha512. Enable strict error handling (for example, set -e in shell scripts) so the pipeline fails if verification fails or outputs errors.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info}