mandrel-platform 0.24.0 → 0.26.0

package/scripts/semgrep-requirements.txt

@@ -0,0 +1,169 @@
+# Hash-pinned lockfile for the pr-quality SAST (semgrep) step.
+#
+# Target platform : Linux x86_64 / CPython 3.12 (GitHub Actions ubuntu-latest)
+# Tool            : semgrep 1.97.0 (+ complete transitive closure)
+# Consumed via    : pip install --require-hashes -r scripts/semgrep-requirements.txt
+#
+# Every requirement below is pinned with `==` and carries at least one
+# sha256 hash, as `--require-hashes` demands. The closure was resolved for
+# the linux/cp312 target specifically (via `pip download` with explicit
+# --platform manylinux/musllinux + --python-version 3.12 --abi cp312), NOT
+# from the local interpreter, so the native wheels (semgrep, protobuf,
+# rpds-py, wrapt, charset-normalizer, ruamel.yaml.clib) are the linux x86_64
+# cp312-compatible artifacts.
+#
+# setuptools is intentionally included: the workflow installs it alongside
+# semgrep so opentelemetry's transitive `pkg_resources` import works on
+# Python >=3.12 (which no longer ships setuptools by default).
+#
+# Regenerate with `pip download semgrep==<ver> setuptools --only-binary=:all:
+# --platform manylinux2014_x86_64 --platform manylinux_2_17_x86_64
+# --platform any --python-version 3.12 --implementation cp --abi cp312`.
+
+attrs==26.1.0 \
+    --hash=sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309
+
+boltons==21.0.0 \
+    --hash=sha256:b9bb7b58b2b420bbe11a6025fdef6d3e5edc9f76a42fb467afe7ca212ef9948b
+
+bracex==3.0 \
+    --hash=sha256:3833e61c2f092d5aa0468fa2e6c6e990a306185abf763b6d122f0158e59c58a5
+
+certifi==2026.6.17 \
+    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
+
+charset-normalizer==3.4.7 \
+    --hash=sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116
+
+click==8.4.2 \
+    --hash=sha256:e6f9f66136c816745b9d65817da91d61d957fb16e02e4dcd0552553c5a197b76
+
+click-option-group==0.5.9 \
+    --hash=sha256:ad2599248bd373e2e19bec5407967c3eec1d0d4fc4a5e77b08a0481e75991080
+
+colorama==0.4.6 \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+
+defusedxml==0.7.1 \
+    --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61
+
+deprecated==1.3.1 \
+    --hash=sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f
+
+exceptiongroup==1.2.2 \
+    --hash=sha256:3111b9d131c238bec2f8f516e123e14ba243563fb135d3fe885990585aa7795b
+
+face==26.0.1 \
+    --hash=sha256:ab0a83c37c9789dce658a67a9a80eafaa113c9ec37c5a9d950ff5480542a062d
+
+glom==22.1.0 \
+    --hash=sha256:5339da206bf3532e01a83a35aca202960ea885156986d190574b779598e9e772
+
+googleapis-common-protos==1.75.0 \
+    --hash=sha256:961ed60399c457ceb0ee8f285a84c870aabc9c6a832b9d37bb281b5bebde43ed
+
+idna==3.18 \
+    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2
+
+importlib-metadata==7.1.0 \
+    --hash=sha256:30962b96c0c223483ed6cc7280e7f0199feb01a0e40cfae4d4450fc6fab1f570
+
+jsonschema==4.26.0 \
+    --hash=sha256:d489f15263b8d200f8387e64b4c3a75f06629559fb73deb8fdfb525f2dab50ce
+
+jsonschema-specifications==2025.9.1 \
+    --hash=sha256:98802fee3a11ee76ecaca44429fda8a41bff98b00a0f2838151b113f210cc6fe
+
+markdown-it-py==4.2.0 \
+    --hash=sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a
+
+mdurl==0.1.2 \
+    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8
+
+opentelemetry-api==1.25.0 \
+    --hash=sha256:757fa1aa020a0f8fa139f8959e53dec2051cc26b832e76fa839a6d76ecefd737
+
+opentelemetry-exporter-otlp-proto-common==1.25.0 \
+    --hash=sha256:15637b7d580c2675f70246563363775b4e6de947871e01d0f4e3881d1848d693
+
+opentelemetry-exporter-otlp-proto-http==1.25.0 \
+    --hash=sha256:2eca686ee11b27acd28198b3ea5e5863a53d1266b91cda47c839d95d5e0541a6
+
+opentelemetry-instrumentation==0.46b0 \
+    --hash=sha256:89cd721b9c18c014ca848ccd11181e6b3fd3f6c7669e35d59c48dc527408c18b
+
+opentelemetry-instrumentation-requests==0.46b0 \
+    --hash=sha256:a8c2472800d8686f3f286cd524b8746b386154092e85a791ba14110d1acc9b81
+
+opentelemetry-proto==1.25.0 \
+    --hash=sha256:f07e3341c78d835d9b86665903b199893befa5e98866f63d22b00d0b7ca4972f
+
+opentelemetry-sdk==1.25.0 \
+    --hash=sha256:d97ff7ec4b351692e9d5a15af570c693b8715ad78b8aafbec5c7100fe966b4c9
+
+opentelemetry-semantic-conventions==0.46b0 \
+    --hash=sha256:6daef4ef9fa51d51855d9f8e0ccd3a1bd59e0e545abe99ac6203804e36ab3e07
+
+opentelemetry-util-http==0.46b0 \
+    --hash=sha256:8dc1949ce63caef08db84ae977fdc1848fe6dc38e6bbaad0ae3e6ecd0d451629
+
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
+
+peewee==3.19.0 \
+    --hash=sha256:de220b94766e6008c466e00ce4ba5299b9a832117d9eb36d45d0062f3cfd7417
+
+protobuf==4.25.9 \
+    --hash=sha256:438c636de8fb706a0de94a12a268ef1ae8f5ba5ae655a7671fcda5968ba3c9be
+
+pygments==2.20.0 \
+    --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
+
+referencing==0.37.0 \
+    --hash=sha256:381329a9f99628c9069361716891d34ad94af76e461dcb0335825aecc7692231
+
+requests==2.34.2 \
+    --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0
+
+rich==13.5.3 \
+    --hash=sha256:9257b468badc3d347e146a4faa268ff229039d4c2d176ab0cffb4c4fbc73d5d9
+
+rpds-py==2026.6.3 \
+    --hash=sha256:ecabd69db66de867690f9797f2f8fa27ba501bbc24540cbdbdc649cd15888ba6
+
+ruamel.yaml==0.17.40 \
+    --hash=sha256:b16b6c3816dff0a93dca12acf5e70afd089fa5acb80604afd1ffa8b465b7722c
+
+ruamel.yaml.clib==0.2.15 \
+    --hash=sha256:11e5499db1ccbc7f4b41f0565e4f799d863ea720e01d3e99fa0b7b5fcd7802c9
+
+semgrep==1.97.0 \
+    --hash=sha256:996fe0b2bfac3a4d4511e470fdf5f3bca96b1f794f398e0336c8388802c218de
+
+# PINNED to 80.9.0 (the last release that still SHIPS `pkg_resources`):
+# setuptools 81+ removed the vendored `pkg_resources` module, but
+# semgrep 1.97.0's transitive `opentelemetry-instrumentation==0.46b0` imports
+# it at load. A py3.12 venv seeds no setuptools, so the lockfile must supply a
+# pkg_resources-bearing one — 83.0.0 broke the SAST step at runtime with
+# `ModuleNotFoundError: No module named 'pkg_resources'`. Do NOT bump past 80.x
+# without confirming pkg_resources is present (or bumping opentelemetry off it).
+setuptools==80.9.0 \
+    --hash=sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922
+
+tomli==2.0.2 \
+    --hash=sha256:2ebe24485c53d303f690b0ec092806a085f07af5a5aa1464f3931eec36caaa38
+
+typing-extensions==4.16.0 \
+    --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8
+
+urllib3==2.7.0 \
+    --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897
+
+wcmatch==8.5.2 \
+    --hash=sha256:17d3ad3758f9d0b5b4dedc770b65420d4dac62e680229c287bf24c9db856a478
+
+wrapt==1.17.3 \
+    --hash=sha256:042ec3bb8f319c147b1301f2393bc19dba6e176b7da446853406d041c36c7828
+
+zipp==4.1.0 \
+    --hash=sha256:25ad4e16390cd314347dd8f1de67a2ac538ae658ed4ab9db16029c07c188e97f

package/templates/workflows/deploy-staging-run.yml

@@ -51,16 +51,56 @@ on:
 permissions:
   contents: read
 
-# Serialize staging deploys: only the freshest dispatch should reach the
-# staging surfaces. The shared deploy-cloudflare.yml additionally serializes
-# per-environment.
+# Serialize staging deploys: QUEUE, don't cancel (Story #284 / audit H2). An
+# in-flight `wrangler d1 migrations apply` must never be cancelled mid-apply by
+# the next dispatch — a half-applied forward-only migration has no automatic
+# restore. `cancel-in-progress: false` lets a second dispatch wait for the
+# first to finish. (The dispatcher half keeps `cancel-in-progress: true`:
+# cancelling a superseded PENDING dispatch is safe.) The shared
+# deploy-cloudflare.yml additionally serializes per-environment.
 concurrency:
   group: deploy-staging-run
-  cancel-in-progress: true
+  cancel-in-progress: false
 
 jobs:
+  # M4: sha-drift preflight (Story #284). The CI-green gate is TOCTOU-racy — a
+  # commit A goes green and dispatches, but commit B (CI pending, possibly
+  # later red) may already be on main, so the deploy would ship B under A's
+  # green credential. When `sha` is supplied (dispatcher path), assert the main
+  # tip still equals it and FAIL loudly on drift, naming both SHAs. A job with
+  # `uses:` cannot carry `steps:`, so this preflight is a SEPARATE preceding
+  # job that the `uses:` deploy job `needs:`. Manual dispatches without `sha`
+  # skip the assertion (the operator is deploying the current tip on purpose).
+  sha-drift-preflight:
+    name: Sha-drift preflight (deploy what CI verified)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout main tip
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: main
+          persist-credentials: false
+      - name: Assert HEAD matches the CI-verified sha
+        env:
+          INPUT_SHA: ${{ inputs.sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ -z "${INPUT_SHA}" ]; then
+            echo "No sha input — manual dispatch deploying the current main tip; skipping sha-drift preflight."
+            exit 0
+          fi
+          head="$(git rev-parse HEAD)"
+          if [ "${head}" != "${INPUT_SHA}" ]; then
+            echo "::error::sha drift: main tip is ${head} but the dispatched (CI-verified) sha is ${INPUT_SHA}. main advanced after CI went green; refusing to deploy an unverified tip." >&2
+            exit 1
+          fi
+          echo "sha-drift preflight OK: main tip ${head} matches the CI-verified sha ${INPUT_SHA}."
+
   deploy:
     name: Staging deploy (shared deploy-cloudflare.yml)
+    needs: [sha-drift-preflight]
     uses: dsj1984/mandrel-platform/.github/workflows/deploy-cloudflare.yml@<MANDREL_PLATFORM_SHA> # <MANDREL_PLATFORM_TAG>
     with:
       environment: staging

package/templates/workflows/deploy-staging.yml

@@ -71,10 +71,23 @@ jobs:
     name: Dispatch staging deploy on CI-green
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    # CI-green gate: dispatch the deploy ONLY when the upstream CI run
-    # concluded 'success'. `workflow_run` fires on both success and failure, so
-    # this guard is load-bearing — without it a red main would still deploy.
-    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    # CI-green gate — three load-bearing conditions, all required (Story #284):
+    #   1. `conclusion == 'success'` — `workflow_run` fires on both success and
+    #      failure; without this a red main would still deploy.
+    #   2. `event == 'push'` — the upstream CI run must itself have been a push
+    #      to the repo, not a `pull_request` run. `workflow_run.branches:
+    #      [main]` filters on the *head branch NAME*, so a fork PR whose head
+    #      branch is literally named `main` with green CI otherwise satisfies
+    #      the branch filter and the success guard (audit M3).
+    #   3. `head_repository.full_name == github.repository` — the CI run must
+    #      have originated from THIS repo, not a fork. Belt-and-suspenders with
+    #      condition 2: even a same-name fork branch cannot spoof same-repo
+    #      provenance, so an external contributor can no longer attacker-time a
+    #      staging deploy off their fork's green CI.
+    if: >-
+      ${{ github.event.workflow_run.conclusion == 'success'
+        && github.event.workflow_run.event == 'push'
+        && github.event.workflow_run.head_repository.full_name == github.repository }}
     steps:
       - name: Dispatch deploy-staging-run.yml (workflow_dispatch)
         env:
@@ -84,8 +97,54 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          gh workflow run deploy-staging-run.yml \
-            --repo "${REPO}" \
-            --ref main \
-            -f sha="${SHA}"
-          echo "Dispatched staging deploy for ${SHA} (deploy runs on workflow_dispatch so environment: jobs execute)."
+
+          # L3: the dispatch is otherwise fire-and-forget — a transient GitHub
+          # API 5xx fails `gh workflow run`, and the only signal is a red run in
+          # a low-visibility dispatcher while that green commit never reaches
+          # staging. Retry with backoff, then VERIFY a run was actually created
+          # (a 2xx from the dispatch API is not proof a run materialized).
+          dispatched=false
+          for attempt in 1 2 3; do
+            if gh workflow run deploy-staging-run.yml \
+              --repo "${REPO}" \
+              --ref main \
+              -f sha="${SHA}"; then
+              dispatched=true
+              break
+            fi
+            echo "::warning::gh workflow run attempt ${attempt} failed; retrying after backoff."
+            sleep $((attempt * 5))
+          done
+
+          if [ "${dispatched}" != "true" ]; then
+            echo "::error::Failed to dispatch deploy-staging-run.yml after 3 attempts for ${SHA}." >&2
+            exit 1
+          fi
+
+          # Verify a runner workflow run was actually created. The dispatch API
+          # returns before the run row is queryable, so poll `gh run list` for a
+          # recent workflow_dispatch run of the runner workflow. Fail loudly if
+          # none appears — a silent non-creation is exactly the failure mode
+          # this check exists to surface.
+          created=false
+          for attempt in 1 2 3 4 5; do
+            count="$(gh run list \
+              --repo "${REPO}" \
+              --workflow deploy-staging-run.yml \
+              --event workflow_dispatch \
+              --limit 5 \
+              --json databaseId --jq 'length' 2>/dev/null || echo 0)"
+            if [ "${count:-0}" -gt 0 ]; then
+              created=true
+              break
+            fi
+            echo "Run not visible yet (attempt ${attempt}); waiting for the run row to appear."
+            sleep $((attempt * 3))
+          done
+
+          if [ "${created}" != "true" ]; then
+            echo "::error::Dispatched deploy-staging-run.yml for ${SHA} but no runner workflow run appeared via 'gh run list'." >&2
+            exit 1
+          fi
+
+          echo "Dispatched and verified staging deploy for ${SHA} (deploy runs on workflow_dispatch so environment: jobs execute)."