npm - mandrel-platform - Versions diffs - 0.21.0 → 0.25.0 - Mend

mandrel-platform 0.21.0 → 0.25.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/package.json +2 -2
package/scripts/check-pin-drift.mjs +66 -1
package/scripts/check-pin-drift.test.mjs +125 -0
package/scripts/check-runner-health.mjs +469 -0
package/scripts/check-runner-health.test.mjs +389 -0
package/scripts/deploy-boot-smoke.mjs +116 -36
package/scripts/deploy-boot-smoke.test.mjs +138 -17
package/scripts/platform-repair.mjs +38 -2
package/scripts/platform-repair.test.mjs +113 -0
package/scripts/platform-sync.test.mjs +36 -9
package/scripts/runner-fleet-consumers.json +20 -0
package/scripts/semgrep-requirements.txt +169 -0
package/templates/runbooks/runner-fleet-health.md +150 -0
package/templates/workflows/deploy-staging-run.yml +117 -0
package/templates/workflows/deploy-staging.yml +125 -64

package/scripts/deploy-boot-smoke.test.mjs CHANGED Viewed

@@ -11,6 +11,8 @@ import {
   probeUrl,
   runSmoke,
   resolveFailedFile,
+  defaultDeriveSubdomain,
+  writeRollbackState,
 } from "./deploy-boot-smoke.mjs";
 // ---------------------------------------------------------------------------
@@ -29,26 +31,67 @@ test("parseSmokePaths enforces a leading slash", () => {
 });
 // ---------------------------------------------------------------------------
-// extractSubdomain
+// extractSubdomain — parses the Cloudflare REST subdomain response (M14)
 // ---------------------------------------------------------------------------
-test("extractSubdomain finds the first workers.dev slug in whoami output", () => {
-  const whoami = [
-    "Getting User settings...",
-    "👋 You are logged in!",
-    "┌──────────────┬──────────────────────────┐",
-    "│ Account Name │ dsj1984's Account        │",
-    "│ Subdomain    │ dsj1984.workers.dev      │",
-    "└──────────────┴──────────────────────────┘",
-  ].join("\n");
-  assert.equal(extractSubdomain(whoami), "dsj1984");
+test("extractSubdomain reads result.name from the REST subdomain response", () => {
+  assert.equal(
+    extractSubdomain('{"success":true,"errors":[],"messages":[],"result":{"name":"dsj1984"}}'),
+    "dsj1984"
+  );
+});
+test("extractSubdomain strips a trailing .workers.dev when the API echoes the host", () => {
+  assert.equal(extractSubdomain('{"success":true,"result":{"name":"dsj1984.workers.dev"}}'), "dsj1984");
 });
-test("extractSubdomain returns null when no slug is present", () => {
-  assert.equal(extractSubdomain("no subdomain here"), null);
+test("extractSubdomain returns null for unsuccessful, malformed, or missing bodies", () => {
+  assert.equal(extractSubdomain('{"success":false,"result":null}'), null);
+  assert.equal(extractSubdomain('{"result":{"name":""}}'), null);
+  assert.equal(extractSubdomain('{"result":{"name":42}}'), null);
+  assert.equal(extractSubdomain('{"result":{}}'), null);
+  assert.equal(extractSubdomain('{"result":"dsj1984"}'), null);
+  assert.equal(extractSubdomain("<html>not json</html>"), null);
   assert.equal(extractSubdomain(""), null);
 });
+// ---------------------------------------------------------------------------
+// defaultDeriveSubdomain — the REST GET /accounts/{id}/workers/subdomain call
+// ---------------------------------------------------------------------------
+test("defaultDeriveSubdomain calls the workers/subdomain endpoint with a bearer token", async () => {
+  let seenUrl;
+  let seenOptions;
+  const fetchImpl = async (url, options) => {
+    seenUrl = url;
+    seenOptions = options;
+    return { ok: true, text: async () => '{"success":true,"result":{"name":"dsj1984"}}' };
+  };
+  const slug = await defaultDeriveSubdomain({ accountId: "acct-123", apiToken: "tok-abc" }, fetchImpl);
+  assert.equal(slug, "dsj1984");
+  assert.equal(
+    seenUrl,
+    "https://api.cloudflare.com/client/v4/accounts/acct-123/workers/subdomain"
+  );
+  assert.equal(seenOptions.method, "GET");
+  assert.equal(seenOptions.headers.Authorization, "Bearer tok-abc");
+});
+test("defaultDeriveSubdomain returns null without creds, on non-2xx, and on network error", async () => {
+  assert.equal(await defaultDeriveSubdomain({ accountId: "", apiToken: "tok" }, async () => ({})), null);
+  assert.equal(await defaultDeriveSubdomain({ accountId: "a", apiToken: "" }, async () => ({})), null);
+  assert.equal(
+    await defaultDeriveSubdomain({ accountId: "a", apiToken: "t" }, async () => ({ ok: false, text: async () => "" })),
+    null
+  );
+  assert.equal(
+    await defaultDeriveSubdomain({ accountId: "a", apiToken: "t" }, async () => {
+      throw new Error("ECONNRESET");
+    }),
+    null
+  );
+});
 // ---------------------------------------------------------------------------
 // parseVersionField — the jq/JSON.parse replacement for grep-for-"version"
 // ---------------------------------------------------------------------------
@@ -315,21 +358,30 @@ test("runSmoke fails without a rollback list when no subdomain is derivable", as
   const { log, lines } = collectLogs();
   const result = await runSmoke(
     { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
-    { log, whoami: () => "not logged in", probe: async () => ({ status: 200, body: "{}" }) }
+    { log, deriveSubdomain: async () => null, probe: async () => ({ status: 200, body: "{}" }) }
   );
   assert.equal(result.exitCode, 1);
   assert.deepEqual(result.failedWorkers, []);
   assert.ok(lines.some((l) => l.includes("Could not derive workers.dev subdomain")));
 });
-test("runSmoke derives the subdomain from whoami output when not provided", async () => {
+test("runSmoke derives the subdomain via the REST endpoint when not provided", async () => {
   const { log } = collectLogs();
   const probed = [];
+  let seenCreds;
   const result = await runSmoke(
-    { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
+    {
+      DEPLOYED_WORKERS: "api",
+      SMOKE_PATHS: "/health",
+      CLOUDFLARE_ACCOUNT_ID: "acct-123",
+      CLOUDFLARE_API_TOKEN: "tok-abc",
+    },
     {
       log,
-      whoami: () => "│ Subdomain │ dsj1984.workers.dev │",
+      deriveSubdomain: async (creds) => {
+        seenCreds = creds;
+        return "dsj1984";
+      },
       probe: async (url) => {
         probed.push(url);
         return { status: 200, body: "{}" };
@@ -338,6 +390,8 @@ test("runSmoke derives the subdomain from whoami output when not provided", asyn
   );
   assert.equal(result.exitCode, 0);
   assert.deepEqual(probed, ["https://api.dsj1984.workers.dev/health"]);
+  // The REST creds are threaded through from the environment.
+  assert.deepEqual(seenCreds, { accountId: "acct-123", apiToken: "tok-abc" });
 });
 // ---------------------------------------------------------------------------
@@ -379,3 +433,70 @@ test("resolveFailedFile creates a private temp dir when SMOKE_FAILED_FILE is uns
   assert.equal(path, "/var/folders/xyz/deploy-boot-smoke-Zzz999/smoke-failed-workers.txt");
   assert.notEqual(path, "/tmp/smoke-failed-workers.txt");
 });
+// ---------------------------------------------------------------------------
+// writeRollbackState — the shared terminal writer (crash-path fix, M2)
+// ---------------------------------------------------------------------------
+test("writeRollbackState writes the sorted list and the smoke_failed flag", () => {
+  const writes = [];
+  const appends = [];
+  writeRollbackState("/tmp/failed.txt", ["api", "worker-cron"], {
+    githubEnv: "/tmp/gh-env",
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: (path, data) => appends.push({ path, data }),
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\nworker-cron\n" }]);
+  assert.deepEqual(appends, [{ path: "/tmp/gh-env", data: "smoke_failed=true\n" }]);
+});
+test("writeRollbackState is a no-op for an empty worker list", () => {
+  let wrote = false;
+  let appended = false;
+  writeRollbackState("/tmp/failed.txt", [], {
+    githubEnv: "/tmp/gh-env",
+    writeFile: () => {
+      wrote = true;
+    },
+    appendFile: () => {
+      appended = true;
+    },
+  });
+  assert.equal(wrote, false);
+  assert.equal(appended, false);
+});
+test("writeRollbackState skips the GITHUB_ENV append when githubEnv is unset (still writes the list)", () => {
+  const writes = [];
+  let appended = false;
+  writeRollbackState("/tmp/failed.txt", ["api"], {
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: () => {
+      appended = true;
+    },
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\n" }]);
+  assert.equal(appended, false);
+});
+// ---------------------------------------------------------------------------
+// Crash-path terminal write (M2): runSmoke throwing must still mark every
+// deployed worker for rollback. main() catches and calls writeRollbackState
+// with uniqueSorted(parseCsv(DEPLOYED_WORKERS)); this asserts the exact
+// derivation main() feeds the writer on the crash path.
+// ---------------------------------------------------------------------------
+test("crash-path derives the full deployed-worker rollback set (uniqueSorted + parseCsv)", () => {
+  // Mirrors main()'s catch block: on an unhandled error, EVERY deployed
+  // worker is marked (no per-worker attribution survives a crash).
+  const deployed = uniqueSorted(parseCsv("worker-cron, api ,worker-cron"));
+  const writes = [];
+  const appends = [];
+  writeRollbackState("/tmp/failed.txt", deployed, {
+    githubEnv: "/tmp/gh-env",
+    writeFile: (path, data) => writes.push({ path, data }),
+    appendFile: (path, data) => appends.push({ path, data }),
+  });
+  assert.deepEqual(writes, [{ path: "/tmp/failed.txt", data: "api\nworker-cron\n" }]);
+  assert.deepEqual(appends, [{ path: "/tmp/gh-env", data: "smoke_failed=true\n" }]);
+});

package/scripts/platform-repair.mjs CHANGED Viewed

@@ -68,7 +68,12 @@ import { tmpdir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { buildReport, isFullSha } from "./check-pin-drift.mjs";
+import {
+  allConsumersErrored,
+  buildReport,
+  isFullSha,
+  pinDriftTokenProvided,
+} from "./check-pin-drift.mjs";
 import { defaultGhRunner } from "./lib/gh-json.mjs";
 import { parseSemver } from "./lib/semver-duration.mjs";
@@ -602,6 +607,13 @@ export function runRepair({
 }) {
   // Reuse the detector to classify every consumer (single SSOT for drift).
   const report = buildReport(config, runGh, nowMs);
+  // M11: mirror check-pin-drift's dead-credential signal. When EVERY consumer
+  // row errored the detector could read no repo at all — the signature of a
+  // provided-but-dead PIN_DRIFT_TOKEN (an expired PAT). The caller pairs this
+  // with `tokenProvided` to fail the run instead of silently reporting a green
+  // "no repairable drift" (which is what an all-error sweep degrades to, since
+  // every error row classifies `repairable: false, reason: "error"`).
+  const allErrored = allConsumersErrored(report);
   const latestTag = report.latestRelease?.tag ?? null;
   const targetSha = report.latestRelease?.sha ?? null;
   // The pin target is the latest release tag (so the `# <ref>` annotation reads
@@ -648,7 +660,14 @@ export function runRepair({
     }
   }
-  return { ref: effectiveRef, targetSha, dryRun, hasToken: Boolean(token), rows };
+  return {
+    ref: effectiveRef,
+    targetSha,
+    dryRun,
+    hasToken: Boolean(token),
+    allErrored,
+    rows,
+  };
 }
 // ---------------------------------------------------------------------------
@@ -743,6 +762,23 @@ export function runCli({
       }
     }
   }
+  // M11: the repair loop reads consumers with the SAME cross-repo credential the
+  // dashboard uses (PIN_DRIFT_TOKEN → GH_TOKEN). When that token was PROVIDED
+  // but every detector row errored, the credential is dead (expired PAT) rather
+  // than not-yet-provisioned — every consumer degraded to `error` / repairable
+  // false, which otherwise renders a reassuring green "no repairable drift". Fail
+  // the run loudly so the dead credential is fixed. The absent-token bootstrap
+  // (pinDriftTokenProvided false) keeps its exit-0 read-only behavior.
+  if (pinDriftTokenProvided(env) && report.allErrored) {
+    stderr.write(
+      "::error::[platform-repair] PIN_DRIFT_TOKEN was provided but every " +
+        "cross-repo consumer read errored — the credential is dead (likely an " +
+        "expired fine-grained PAT), not a not-yet-provisioned bootstrap. Rotate " +
+        "the token. See docs/runbooks/pin-drift-dashboard.md.\n",
+    );
+    return 1;
+  }
   return 0;
 }

package/scripts/platform-repair.test.mjs CHANGED Viewed

@@ -21,6 +21,9 @@
  */
 import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { test } from "node:test";
 import {
@@ -32,6 +35,7 @@ import {
   parsePrNumberFromUrl,
   renderRepairPrBody,
   renderRepairReport,
+  runCli,
   runRepair,
 } from "./platform-repair.mjs";
@@ -269,6 +273,12 @@ function makeGh({ consumerWorkflow, npmVersion, openPrs = {}, calls }) {
 const noopGit = () => "";
+/** A minimal write-sink that records everything written, for stdout/stderr. */
+function capture() {
+  const chunks = [];
+  return { write: (s) => chunks.push(s), text: () => chunks.join("") };
+}
 function laggingConfig() {
   return {
     platformRepo: PLATFORM_REPO,
@@ -456,3 +466,106 @@ test("renderRepairReport tabulates outcomes and a repaired section", () => {
   assert.ok(text.includes("Repaired (1)"));
   assert.ok(text.includes("#101"));
 });
+// ---------------------------------------------------------------------------
+// M11 — provided-but-dead read credential vs. not-yet-provisioned bootstrap.
+// The repair loop reads consumers with the SAME cross-repo PAT the dashboard
+// uses (PIN_DRIFT_TOKEN → GH_TOKEN). When that PAT is provided-but-dead every
+// detector row errors → every consumer classifies `error`/repairable-false,
+// which otherwise renders a reassuring green "no repairable drift". runCli must
+// hard-fail on that when the token was provided, and stay exit-0 when it was
+// absent (bootstrap). Mirrors scripts/check-runner-health.mjs error-row
+// handling. (temp/audits/workflow-robustness-review-2026-07-05.md M11)
+// ---------------------------------------------------------------------------
+/**
+ * A gh runner where the platform's own release resolution succeeds but EVERY
+ * cross-repo consumer read fails non-404 (auth/transport) — the shape of a dead
+ * cross-repo PAT. No PR surface is reached because every consumer errors out
+ * before repair.
+ */
+function makeAllConsumersFailGh() {
+  return (args) => {
+    const path = args[1];
+    if (args[0] !== "api") {
+      throw new Error(`unexpected non-api gh call under dead credential: ${args.join(" ")}`);
+    }
+    if (path === `repos/${PLATFORM_REPO}/releases/latest`) {
+      return JSON.stringify({ tag_name: "mandrel-platform-v1.2.3", published_at: "2020-01-01T00:00:00Z" });
+    }
+    if (path === `repos/${PLATFORM_REPO}/git/ref/tags/mandrel-platform-v1.2.3`) {
+      return JSON.stringify({ object: { sha: LATEST_SHA, type: "commit" } });
+    }
+    if (/\/contents\/\.github\/workflows/.test(path)) {
+      // 403 (not 404) → fail-closed error row, mirroring an expired PAT.
+      const err = new Error("gh: Forbidden (HTTP 403)");
+      err.stderr = "gh: Forbidden (HTTP 403)\n";
+      throw err;
+    }
+    if (/^repos\/[^/]+\/[^/]+$/.test(path)) {
+      return JSON.stringify({ default_branch: "main" });
+    }
+    throw new Error(`unexpected gh api path: ${path}`);
+  };
+}
+function deadCredConfigFile() {
+  const dir = mkdtempSync(join(tmpdir(), "platform-repair-dead-"));
+  const p = join(dir, "consumers.json");
+  writeFileSync(
+    p,
+    JSON.stringify({
+      platformRepo: PLATFORM_REPO,
+      consumers: [
+        { name: "domio", repo: "dsj1984/domio" },
+        { name: "athportal", repo: "dsj1984/athportal" },
+      ],
+    }),
+  );
+  return { dir, p };
+}
+test("runCli: PROVIDED-but-dead PIN_DRIFT_TOKEN (every consumer read errors) exits 1 with ::error::", () => {
+  const { dir, p } = deadCredConfigFile();
+  const stderr = capture();
+  try {
+    const code = runCli({
+      argv: ["--config", p],
+      env: { PIN_DRIFT_TOKEN: "ghp_expired" },
+      runGh: makeAllConsumersFailGh(),
+      runGit: noopGit,
+      runSync: () => {
+        throw new Error("must not sync under a dead credential");
+      },
+      stdout: capture(),
+      stderr,
+      summaryPath: undefined,
+    });
+    assert.equal(code, 1);
+    assert.match(stderr.text(), /::error::/);
+    assert.match(stderr.text(), /credential is dead/);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+test("runCli: ABSENT PIN_DRIFT_TOKEN bootstrap (every consumer read errors, token unset) stays exit 0", () => {
+  const { dir, p } = deadCredConfigFile();
+  try {
+    const code = runCli({
+      argv: ["--config", p],
+      env: {}, // PIN_DRIFT_TOKEN absent → not-yet-provisioned bootstrap.
+      runGh: makeAllConsumersFailGh(),
+      runGit: noopGit,
+      runSync: () => {
+        throw new Error("must not sync during bootstrap");
+      },
+      stdout: capture(),
+      stderr: capture(),
+      summaryPath: undefined,
+    });
+    assert.equal(code, 0);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/scripts/platform-sync.test.mjs CHANGED Viewed

@@ -570,22 +570,49 @@ test("--check-ruleset requires --consumer-repo", () => {
   }, /consumer-repo/);
 });
-test("apply materializes the canonical deploy-staging.yml workflow caller template", () => {
+test("apply materializes the canonical deploy-staging dispatcher + run templates (Story #272)", () => {
   const out = JSON.parse(run([]));
-  const stub = join(consumer, ".github", "workflows", "deploy-staging.yml");
-  assert.ok(existsSync(stub));
+  const dispatcher = join(consumer, ".github", "workflows", "deploy-staging.yml");
+  const runner = join(consumer, ".github", "workflows", "deploy-staging-run.yml");
+  assert.ok(existsSync(dispatcher), "deploy-staging.yml (dispatcher) materialized");
+  assert.ok(existsSync(runner), "deploy-staging-run.yml (deploy) materialized");
   assert.ok(
     out.workflowStubs.created.some((f) => f.endsWith("deploy-staging.yml")),
-    "deploy-staging.yml reported as created"
+    "deploy-staging.yml (dispatcher) reported as created"
+  );
+  assert.ok(
+    out.workflowStubs.created.some((f) => f.endsWith("deploy-staging-run.yml")),
+    "deploy-staging-run.yml (deploy) reported as created"
+  );
+  const dispatcherBody = readFileSync(dispatcher, "utf8");
+  const runnerBody = readFileSync(runner, "utf8");
+  // Both halves carry the never-clobber template marker.
+  assert.ok(
+    dispatcherBody.includes("Canonical staging-deploy caller template"),
+    "dispatcher carries the template marker"
+  );
+  assert.ok(
+    runnerBody.includes("Canonical staging-deploy caller template"),
+    "run template carries the template marker"
+  );
+  // The dispatcher fires on CI-green (workflow_run) and DISPATCHES the run
+  // workflow — it must NOT call the deploy directly, since a workflow_run
+  // deploy skips every environment: job (Story #272).
+  assert.ok(
+    dispatcherBody.includes("workflow_run") &&
+      dispatcherBody.includes("gh workflow run deploy-staging-run.yml"),
+    "dispatcher fires on workflow_run and dispatches deploy-staging-run.yml"
   );
-  const body = readFileSync(stub, "utf8");
   assert.ok(
-    body.includes("Canonical staging-deploy caller template"),
-    "materialized workflow carries the template marker"
+    !dispatcherBody.includes("dsj1984/mandrel-platform/.github/workflows/deploy-cloudflare.yml"),
+    "dispatcher does NOT uses: deploy-cloudflare.yml directly (that would skip environment: jobs on workflow_run)"
   );
+  // The deploy half runs on workflow_dispatch (where environment: jobs execute)
+  // and uses the shared reusable workflow.
   assert.ok(
-    body.includes("dsj1984/mandrel-platform/.github/workflows/deploy-cloudflare.yml"),
-    "template calls the shared deploy-cloudflare.yml reusable workflow"
+    runnerBody.includes("workflow_dispatch") &&
+      runnerBody.includes("dsj1984/mandrel-platform/.github/workflows/deploy-cloudflare.yml"),
+    "run template deploys on workflow_dispatch via the shared deploy-cloudflare.yml"
   );
 });

package/scripts/runner-fleet-consumers.json ADDED Viewed

@@ -0,0 +1,20 @@
+{
+  "$comment": "Data-driven expected roster for scripts/check-runner-health.mjs (Story #258). Each entry is one repo whose self-hosted runner fleet the scheduled runner-fleet-health.yml workflow monitors. Adding/removing a runner needs only an edit here — the checker reads GET /repos/{owner}/{repo}/actions/runners and compares live status against `expectedCount` + `labels`. All nine runners (including Beestera/swarm-os's three) are co-resident on one operator Mac (2026-07-03 runner audit, repo-ops matrix §1a); if that host sleeps, reboots, fills its disk, or a launchd service dies, every listed repo's CI silently queues with no alert until this monitor catches it.",
+  "$comment_swarm_os": "Beestera/swarm-os is deliberately NOT listed: no dsj1984-owned PAT can read another org's runner API (fine-grained PATs are bound to one resource owner; the Beestera org rejects classic PATs), so its row would permanently false-positive as 0/3 degraded. Host-level coverage is retained regardless — its runners share the Mac with the rows below, so a wedged host still trips domio/athportal. What is NOT covered: swarm-os's individual launchd services dying while the host stays healthy, and its stale-queue check. Re-add the entry if a Beestera-owned credential (fine-grained PAT or GitHub App) plus per-repo token support ever lands.",
+  "$comment_staleQueuedMinutes": "A queued/waiting workflow run older than this many minutes with no online runner matching its labels is flagged as a queue-staleness signal (optional per-repo override via `staleQueuedMinutes`).",
+  "defaultStaleQueuedMinutes": 20,
+  "repos": [
+    {
+      "name": "domio",
+      "repo": "dsj1984/domio",
+      "expectedCount": 3,
+      "labels": ["self-hosted", "macOS", "ARM64", "domio-runner"]
+    },
+    {
+      "name": "athportal",
+      "repo": "dsj1984/athportal",
+      "expectedCount": 3,
+      "labels": ["self-hosted", "macOS", "ARM64", "athportal-runner"]
+    }
+  ]
+}

package/scripts/semgrep-requirements.txt ADDED Viewed

@@ -0,0 +1,169 @@
+# Hash-pinned lockfile for the pr-quality SAST (semgrep) step.
+#
+# Target platform : Linux x86_64 / CPython 3.12 (GitHub Actions ubuntu-latest)
+# Tool            : semgrep 1.97.0 (+ complete transitive closure)
+# Consumed via    : pip install --require-hashes -r scripts/semgrep-requirements.txt
+#
+# Every requirement below is pinned with `==` and carries at least one
+# sha256 hash, as `--require-hashes` demands. The closure was resolved for
+# the linux/cp312 target specifically (via `pip download` with explicit
+# --platform manylinux/musllinux + --python-version 3.12 --abi cp312), NOT
+# from the local interpreter, so the native wheels (semgrep, protobuf,
+# rpds-py, wrapt, charset-normalizer, ruamel.yaml.clib) are the linux x86_64
+# cp312-compatible artifacts.
+#
+# setuptools is intentionally included: the workflow installs it alongside
+# semgrep so opentelemetry's transitive `pkg_resources` import works on
+# Python >=3.12 (which no longer ships setuptools by default).
+#
+# Regenerate with `pip download semgrep==<ver> setuptools --only-binary=:all:
+# --platform manylinux2014_x86_64 --platform manylinux_2_17_x86_64
+# --platform any --python-version 3.12 --implementation cp --abi cp312`.
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309
+boltons==21.0.0 \
+    --hash=sha256:b9bb7b58b2b420bbe11a6025fdef6d3e5edc9f76a42fb467afe7ca212ef9948b
+bracex==3.0 \
+    --hash=sha256:3833e61c2f092d5aa0468fa2e6c6e990a306185abf763b6d122f0158e59c58a5
+certifi==2026.6.17 \
+    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
+charset-normalizer==3.4.7 \
+    --hash=sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116
+click==8.4.2 \
+    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
+click-option-group==0.5.9 \
+    --hash=sha256:ad2599248bd373e2e19bec5407967c3eec1d0d4fc4a5e77b08a0481e75991080
+colorama==0.4.6 \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+defusedxml==0.7.1 \
+    --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
+deprecated==1.3.1 \
+    --hash=sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f
+exceptiongroup==1.2.2 \
+    --hash=sha256:3111b9d131c238bec2f8f516e123e14ba243563fb135d3fe885990585aa7795b
+face==26.0.1 \
+    --hash=sha256:ab0a83c37c9789dce658a67a9a80eafaa113c9ec37c5a9d950ff5480542a062d
+glom==22.1.0 \
+    --hash=sha256:5339da206bf3532e01a83a35aca202960ea885156986d190574b779598e9e772
+googleapis-common-protos==1.75.0 \
+    --hash=sha256:961ed60399c457ceb0ee8f285a84c870aabc9c6a832b9d37bb281b5bebde43ed
+idna==3.18 \
+    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
+importlib-metadata==7.1.0 \
+    --hash=sha256:30962b96c0c223483ed6cc7280e7f0199feb01a0e40cfae4d4450fc6fab1f570
+jsonschema==4.26.0 \
+    --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe
+markdown-it-py==4.2.0 \
+    --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a
+mdurl==0.1.2 \
+    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8
+opentelemetry-api==1.25.0 \
+    --hash=sha256:757fa1aa020a0f8fa139f8959e53dec2051cc26b832e76fa839a6d76ecefd737
+opentelemetry-exporter-otlp-proto-common==1.25.0 \
+    --hash=sha256:15637b7d580c2675f70246563363775b4e6de947871e01d0f4e3881d1848d693
+opentelemetry-exporter-otlp-proto-http==1.25.0 \
+    --hash=sha256:2eca686ee11b27acd28198b3ea5e5863a53d1266b91cda47c839d95d5e0541a6
+opentelemetry-instrumentation==0.46b0 \
+    --hash=sha256:89cd721b9c18c014ca848ccd11181e6b3fd3f6c7669e35d59c48dc527408c18b
+opentelemetry-instrumentation-requests==0.46b0 \
+    --hash=sha256:a8c2472800d8686f3f286cd524b8746b386154092e85a791ba14110d1acc9b81
+opentelemetry-proto==1.25.0 \
+    --hash=sha256:f07e3341c78d835d9b86665903b199893befa5e98866f63d22b00d0b7ca4972f
+opentelemetry-sdk==1.25.0 \
+    --hash=sha256:d97ff7ec4b351692e9d5a15af570c693b8715ad78b8aafbec5c7100fe966b4c9
+opentelemetry-semantic-conventions==0.46b0 \
+    --hash=sha256:6daef4ef9fa51d51855d9f8e0ccd3a1bd59e0e545abe99ac6203804e36ab3e07
+opentelemetry-util-http==0.46b0 \
+    --hash=sha256:8dc1949ce63caef08db84ae977fdc1848fe6dc38e6bbaad0ae3e6ecd0d451629
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+peewee==3.19.0 \
+    --hash=sha256:de220b94766e6008c466e00ce4ba5299b9a832117d9eb36d45d0062f3cfd7417
+protobuf==4.25.9 \
+    --hash=sha256:438c636de8fb706a0de94a12a268ef1ae8f5ba5ae655a7671fcda5968ba3c9be
+pygments==2.20.0 \
+    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231
+requests==2.34.2 \
+    --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
+rich==13.5.3 \
+    --hash=sha256:9257b468badc3d347e146a4faa268ff229039d4c2d176ab0cffb4c4fbc73d5d9
+rpds-py==2026.6.3 \
+    --hash=sha256:ecabd69db66de867690f9797f2f8fa27ba501bbc24540cbdbdc649cd15888ba6
+ruamel.yaml==0.17.40 \
+    --hash=sha256:b16b6c3816dff0a93dca12acf5e70afd089fa5acb80604afd1ffa8b465b7722c
+ruamel.yaml.clib==0.2.15 \
+    --hash=sha256:11e5499db1ccbc7f4b41f0565e4f799d863ea720e01d3e99fa0b7b5fcd7802c9
+semgrep==1.97.0 \
+    --hash=sha256:996fe0b2bfac3a4d4511e470fdf5f3bca96b1f794f398e0336c8388802c218de
+# PINNED to 80.9.0 (the last release that still SHIPS `pkg_resources`):
+# setuptools 81+ removed the vendored `pkg_resources` module, but
+# semgrep 1.97.0's transitive `opentelemetry-instrumentation==0.46b0` imports
+# it at load. A py3.12 venv seeds no setuptools, so the lockfile must supply a
+# pkg_resources-bearing one — 83.0.0 broke the SAST step at runtime with
+# `ModuleNotFoundError: No module named 'pkg_resources'`. Do NOT bump past 80.x
+# without confirming pkg_resources is present (or bumping opentelemetry off it).
+setuptools==80.9.0 \
+    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922
+tomli==2.0.2 \
+    --hash=sha256:2ebe24485c53d303f690b0ec092806a085f07af5a5aa1464f3931eec36caaa38
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8
+urllib3==2.7.0 \
+    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+wcmatch==8.5.2 \
+    --hash=sha256:17d3ad3758f9d0b5b4dedc770b65420d4dac62e680229c287bf24c9db856a478
+wrapt==1.17.3 \
+    --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828
+zipp==4.1.0 \
+    --hash=sha256:25ad4e16390cd314347dd8f1de67a2ac538ae658ed4ab9db16029c07c188e97f