diff-sentry 0.4.0__tar.gz → 0.4.2__tar.gz

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/.github/workflows/ci.yml

@@ -29,13 +29,13 @@ jobs:
       matrix:
         python-version: ["3.11", "3.13"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
         # Third-party action pinned to a commit SHA for supply-chain integrity (a moving major tag
         # could be repointed at malicious code that runs with this workflow's token). GitHub-owned
         # actions (checkout) stay on a major tag. Bump the SHA and the trailing version comment together.
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
@@ -75,7 +75,7 @@ jobs:
     name: self-scan (dogfood)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0        # the action needs the base commit to diff against
 
@@ -102,13 +102,41 @@ jobs:
             eval/diff_sentry_eval/taskset.py
             *.md
 
+  # The self-scan job above runs with `version: local` on purpose, so it scans a PR with the rules IN
+  # that PR. That leaves the path a CONSUMER actually takes -- `uvx diff-sentry==<released>` from PyPI --
+  # covered by nothing: a quoting or resolution bug there would break every install while our own CI
+  # stayed green. This job exercises exactly that line against a known-malicious fixture.
+  consumer-install:
+    name: consumer install path (PyPI)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          enable-cache: true
+      - name: The released package installs from PyPI and flags a malicious diff
+        run: |
+          set -euo pipefail
+          ver=$(uv run --no-project --with pyyaml python -c \
+                "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
+          echo "action.yml default version: $ver"
+          # The fixture lives under tests/ (a report-only path) rather than inline here. This file is in
+          # the GATED half, so a payload written into it fails our own scan -- which is exactly what
+          # happened to the first version of this job. Payload samples belong where payloads are allowed.
+          # Must exit non-zero: a package that installs but scans nothing would otherwise pass silently.
+          if uvx "diff-sentry==${ver}" scan tests/fixtures/known-malicious.diff; then
+            echo "::error::the published package did not flag a known-malicious diff"
+            exit 1
+          fi
+
   lint:
     name: ruff
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
       - name: Lint

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/.github/workflows/release.yml

@@ -26,10 +26,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Build sdist + wheel
         run: uv build
@@ -57,9 +57,14 @@ jobs:
           tag="${TAG#v}"
           wheel=$(basename dist/*.whl | cut -d- -f2)
           installed=$(/tmp/smoke/bin/python -c "import diff_sentry; print(diff_sentry.__version__)")
-          echo "tag=$tag wheel=$wheel installed=$installed"
-          if [ "$tag" != "$wheel" ] || [ "$wheel" != "$installed" ]; then
-            echo "::error::version mismatch — tag=$tag wheel=$wheel installed=$installed"
+          # action.yml's `version` default decides which release a consumer's `uses: …@vX.Y.Z` actually
+          # runs. Left stale it is silent and nasty: the new action tag would install an OLD scanner, so
+          # a user who upgraded to get a new rule would not get it and nothing would say so.
+          action=$(/tmp/smoke/bin/python -c "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])" 2>/dev/null \
+                   || uv run --no-project --with pyyaml python -c "import yaml;print(yaml.safe_load(open('action.yml'))['inputs']['version']['default'])")
+          echo "tag=$tag wheel=$wheel installed=$installed action.yml=$action"
+          if [ "$tag" != "$wheel" ] || [ "$wheel" != "$installed" ] || [ "$installed" != "$action" ]; then
+            echo "::error::version mismatch — tag=$tag wheel=$wheel installed=$installed action.yml=$action"
             exit 1
           fi
 
@@ -95,4 +100,4 @@ jobs:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/CHANGELOG.md

@@ -5,6 +5,92 @@ malicious intent — the diff held as **untrusted data** in a sandboxed REPL, a
 and deterministic indicator evidence unioned on read into a SIEM signal — as a traced, improvable RLM
 framework on [`rlm-harness`](https://github.com/qazbnm456/rlm-harness) (a BewAIre-style detector).
 
+## 0.4.2
+
+Scoping. Every fix here comes from the same root: the scan read a whole change as one
+string, so rules that need two signals could take them from two unrelated files.
+
+### Fixed
+- **The scan is scoped per file.** `scan_indicators` reads whatever it is handed as one string, and the
+  action hands it the whole `git diff`. Most rules fire on a single match, so that was harmless — but
+  two need a PAIR of signals (`pwn-request`: privileged trigger + PR-HEAD checkout;
+  `detached-process-spawn`: detached spawn + `child_process`), and a whole-blob read let those pair
+  ACROSS FILES. A `workflow_run:` added to one workflow plus a `ref: ${{ ... head.sha }}` sitting in a
+  doc example, a test fixture, or the very workflow a change is *deleting*, composed into a `critical`
+  that no single file contained. The new `scan_diff` splits a unified diff on its file headers and
+  scans each segment on its own; non-diff input (a region the planner pulled out of the REPL, a plain
+  file) falls through to the previous whole-text scan. Used by `scan` and by the in-loop
+  `scan_indicators` tool.
+- **The host-side baseline is scoped per file too, via `scan_content`.** An event is not a unified diff:
+  `raw_content` concatenates the title, every `(filename, patch)` and the body with no `diff --git`
+  headers, so pointing the baseline at `scan_diff` would have scoped nothing at all. `scan_content`
+  splits on the structure the event already carries — and gives hits from a file that file's name. The
+  case is not hypothetical: a PR that adds a `workflow_run` workflow AND documents the trap in the same
+  commit is what a careful repo writes, and read as one blob it came out `critical`. `content_segments`
+  is now the single definition `raw_content` is built on, so the two cannot drift, and the
+  detection-quality corpus was moved onto the production path so it guards what actually ships.
+
+### Changed
+- **`astral-sh/setup-uv` bumped to v10.0.1** (from v5.4.2) and **`actions/checkout` to v7**, both for
+  the Node 24 runtime — between them they clear GitHub's Node 20 deprecation warning. The setup-uv bump
+  covers `action.yml` too, so it reaches every repo running this action, not just this one's CI. Five
+  majors in one
+  jump, so what actually applies here was checked: v8 stopped publishing major tags (this repo already
+  SHA-pins), v9 flipped the `prune-cache` default, and v10 disables caching for `release` /
+  `workflow_run` / `pull_request_target` events under `enable-cache: auto` — CI passes `enable-cache:
+  true` explicitly and keeps its cache, and the release job never wanted one.
+
+  checkout v7 also **blocks checking out a fork PR head under `pull_request_target` / `workflow_run`** —
+  the `pwn-request` shape this project exists to detect, now refused by the action itself. Nothing here
+  checks out a PR head, so the bump is behaviour-neutral for these workflows and strictly better posture
+  for a detector to be running.
+
+### Added
+- **`pwn-request` covers `allow-unsafe-pr-checkout: true`.** actions/checkout v5.1/v6.1/v7 refuse to
+  check out a fork PR head under `pull_request_target` / `workflow_run` unless a workflow opts back in
+  with that input. The opt-in is the same attack stated in words — no ref to trace, no dataflow to
+  infer — so it joins the `ref:` value and the hand-rolled `git fetch` as the rule's third form, with
+  its own title so a reader is not sent hunting for a `ref:` that is not there. It only counts under a
+  privileged trigger (beneath `pull_request` the input carries none of that meaning), a removed opt-in
+  does not fire, and neither does an explicit `false`.
+- **Hits name the file they came from.** `location` was the name of the whole diff — `gated.diff` for
+  every hit, which meant reading the raw log to find out where a finding actually was. Per-file
+  scanning gives each hit its real path.
+- **A hit id is now stable between a whole-diff scan and a single-file scan.** The segment the planner
+  pulls out is byte-identical to the one the baseline scanned, so the evidence snippets — and therefore
+  the ids — match, and the two de-duplicate to one union member on read. Whole-blob scanning could not
+  promise that: the snippet window moved with the byte offset.
+
+## 0.4.1
+
+A correctness release for one rule: `pwn-request` was failing the very pattern this
+project's README tells people to use.
+
+### Changed
+- **`pypa/gh-action-pypi-publish` bumped to v1.14.2** (from v1.14.0). `uv build` now emits core
+  metadata 2.5, and the twine bundled in v1.14.0 rejects it — `InvalidDistribution: '2.5' is not a
+  valid metadata version` — so the first attempt at this release built cleanly and then failed at
+  the upload step. v1.14.2 carries Twine 7, which accepts metadata 2.5.
+
+### Fixed
+- **`pwn-request` no longer fires on a workflow that merely READS the PR head.** The rule paired a
+  privileged trigger with a PR-HEAD *mention* anywhere in the text and called that a checkout, so the
+  validating-publisher shape — `workflow_run`, head SHA in an env var, checkout pinned to the default
+  branch — was graded `critical`, identically to the attack. That is the shape README.md tells people to
+  use, next to the sentence "diff-sentry's own rules make the same distinction, so the safe shape does
+  not trip them"; it did trip them. Escalation now requires the expression to actually reach a checkout:
+  an `actions/checkout` `ref:` value, or a `git checkout`/`git fetch`/`gh pr checkout` command. A bare
+  mention keeps the sub-floor `medium` `privileged-fork-trigger`, cited at the reference rather than the
+  trigger line so a reviewer still lands on the spot worth reading. Found by running the action against
+  a real publisher workflow.
+- **`pwn-request` now follows one binding hop.** `HEAD: ${{ github.event.pull_request.head.sha }}`
+  followed by `ref: ${{ env.HEAD }}` is the same attack split across two lines. Requiring the expression
+  to sit on the `ref:` line would have turned the fix above into a free bypass, so a name bound to the
+  head expression is tracked and a `ref:` that reads it counts as the checkout.
+- **`refs/pull/…` matching tolerates interpolation.** `refs/pull/${{ github.event.number }}/head` — the
+  form that actually appears in the wild — was missed, because the character class stopped at the space
+  inside the expression. A hand-rolled `git fetch` of the PR head is caught now.
+
 ## 0.4.0
 
 The first release, and a repositioning: the front door is now a GitHub Action anyone installs in fifteen

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/CLAUDE.md

@@ -100,6 +100,22 @@ One companion rule ships under `.claude/rules/`:
   network-fetch + file-write — are `high`. A rule that needs BOTH halves is how a common primitive
   becomes evidence without becoming noise. The corpus pins this hit/miss behavior, and every rule ships
   with its NEGATIVE case. Hit evidence is a BOUNDED snippet (`_MAX_EVIDENCE`), never the whole diff.
+- **`pwn-request` has THREE checkout forms**, and all three need the privileged trigger to count: the
+  expression on a `ref:` (directly or one binding hop away), a hand-rolled `git fetch`/`gh pr checkout`,
+  and `allow-unsafe-pr-checkout: true` — the input actions/checkout v5.1+ added for opting back into
+  the fork-PR checkout it now blocks. The last one needs no dataflow: the line states the intent. Each
+  form carries its own title, because reporting an opt-in as "checks out the PR HEAD" sends a reader
+  hunting for a `ref:` that is not there.
+- **A paired rule only pairs WITHIN one file.** `scan_diff` splits a unified diff on its file headers;
+  `scan_content` does the same for an EVENT, whose files `raw_content` would otherwise concatenate into
+  one header-less blob that `scan_diff` cannot scope at all. `scan` and the in-loop tool take the first,
+  the host-side baseline takes the second, and `content_segments` is the single definition both
+  `raw_content` and the baseline are built on, so they cannot drift.
+  Scanning the diff as one blob let the two halves come from different files — a `workflow_run:` in one
+  workflow and a `ref: ${{ … head.sha }}` in a doc example composed into a `critical` no file contained.
+  It also makes a hit id stable between a whole-diff scan and a single-file one, because the segment is
+  byte-identical either way, which is what lets the baseline and an in-loop scan de-duplicate (MF3).
+  Non-diff input falls through to a plain whole-text scan; keep that fallback.
 - **The indicator tool registers as exactly `scan_indicators`.** dspy registers a tool under its
   `__name__` and the prompt says `scan_indicators(region)` — a rename makes every sandbox call a
   NameError (a shipped regression; see the `fix(detect)` commit). The inner callable is renamed on

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: diff-sentry
-Version: 0.4.0
+Version: 0.4.2
 Summary: Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress.
 Author: Boik Su
 License-Expression: MIT
@@ -44,17 +44,16 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@main
+      - uses: qazbnm456/diff-sentry@v0.4.2
 ```
 
-That is the whole setup. The job fails when an indicator at or above `high` fires. Pin to a released
-tag rather than `main` once you depend on it.
+That is the whole setup. The job fails when an indicator at or above `high` fires.
 
 ## What it catches
 
 | Family | Examples |
 |---|---|
-| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI), `permissions: write-all`, CODEOWNERS reassignment |
+| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) — by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true` — plus `permissions: write-all` and CODEOWNERS reassignment |
 | Obfuscation | base64 that decodes to a shell payload, `_0x…` machine-mangled JavaScript, high-entropy blobs |
 | Execution | pipe-to-shell installs, `${IFS}` space-evasion, detached child processes, inline `node -e`, fetch-to-disk droppers |
 | Exfiltration | secrets reaching a network sink, cross-process `/proc/<pid>/mem` reads, OAST callback services, IPFS and permaweb gateways |
@@ -79,7 +78,7 @@ payload does not flag the change that removes it.
 | `fail-on` | `high` | Severity that fails the build (`info`/`low`/`medium`/`high`/`critical`). |
 | `report-only-paths` | none | Newline-separated globs scanned but never gated. For files whose job is to carry attack patterns: rule bodies, security fixtures, prompt templates, docs that tabulate payloads. |
 | `base-sha` | derived | Override the commit to diff against. |
-| `version` | `main` | The diff-sentry ref to run. Pin it for reproducible CI. `local` installs from the current checkout, which is how this repo scans its own PRs with the rules in that PR. |
+| `version` | matches the action tag | The diff-sentry release to install from PyPI. `local` installs from the current checkout instead, which is how this repo scans its own PRs with the rules in that PR. |
 
 Outputs: `failed`, `hit-count`, `max-severity`, and `report` (a JSON path).
 

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/README.md

@@ -23,17 +23,16 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0          # the scan diffs against the PR base
-      - uses: qazbnm456/diff-sentry@main
+      - uses: qazbnm456/diff-sentry@v0.4.2
 ```
 
-That is the whole setup. The job fails when an indicator at or above `high` fires. Pin to a released
-tag rather than `main` once you depend on it.
+That is the whole setup. The job fails when an indicator at or above `high` fires.
 
 ## What it catches
 
 | Family | Examples |
 |---|---|
-| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI), `permissions: write-all`, CODEOWNERS reassignment |
+| Workflow configuration | `pull_request_target` that checks out the PR head (the pwn-request that broke AsyncAPI) — by `ref:`, by a hand-rolled `git fetch`, or by opting back in with `allow-unsafe-pr-checkout: true` — plus `permissions: write-all` and CODEOWNERS reassignment |
 | Obfuscation | base64 that decodes to a shell payload, `_0x…` machine-mangled JavaScript, high-entropy blobs |
 | Execution | pipe-to-shell installs, `${IFS}` space-evasion, detached child processes, inline `node -e`, fetch-to-disk droppers |
 | Exfiltration | secrets reaching a network sink, cross-process `/proc/<pid>/mem` reads, OAST callback services, IPFS and permaweb gateways |
@@ -58,7 +57,7 @@ payload does not flag the change that removes it.
 | `fail-on` | `high` | Severity that fails the build (`info`/`low`/`medium`/`high`/`critical`). |
 | `report-only-paths` | none | Newline-separated globs scanned but never gated. For files whose job is to carry attack patterns: rule bodies, security fixtures, prompt templates, docs that tabulate payloads. |
 | `base-sha` | derived | Override the commit to diff against. |
-| `version` | `main` | The diff-sentry ref to run. Pin it for reproducible CI. `local` installs from the current checkout, which is how this repo scans its own PRs with the rules in that PR. |
+| `version` | matches the action tag | The diff-sentry release to install from PyPI. `local` installs from the current checkout instead, which is how this repo scans its own PRs with the rules in that PR. |
 
 Outputs: `failed`, `hit-count`, `max-severity`, and `report` (a JSON path).
 

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/action.yml

@@ -35,12 +35,16 @@ inputs:
     default: ''
   version:
     description: >-
-      The diff-sentry version to run: a git ref while the package is pre-PyPI, so
-      pin it for reproducible CI. The special value `local` installs from the
-      current checkout instead, which is what this repo's own CI uses so that a PR
-      is scanned by the rules IN that PR rather than by the ones already on main.
+      The diff-sentry release to install from PyPI. Defaults to the version that
+      ships with this action tag, so `uses: …@vX.Y.Z` and the package it runs stay
+      in step. The special value `local` installs from the current checkout instead,
+      which is what this repo's own CI uses so that a PR is scanned by the rules IN
+      that PR rather than by the ones already on main.
     required: false
-    default: 'main'
+    # KEEP IN STEP WITH [project].version. release.yml fails the build if this drifts
+    # from the tag being released, because a stale default here would silently run an
+    # old scanner under a new action tag.
+    default: '0.4.2'
 
 outputs:
   failed:
@@ -65,7 +69,7 @@ runs:
     - name: Install uv
       # SHA-pinned: a moving major tag on a third-party action could be repointed at code that runs
       # with the calling workflow's token. Bump the SHA and the trailing version comment together.
-      uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
       with:
         enable-cache: true
 
@@ -120,7 +124,7 @@ runs:
         if [ "$IN_VERSION" = "local" ]; then
           SENTRY=(uvx --from "$GITHUB_WORKSPACE" diff-sentry)
         else
-          SENTRY=(uvx --from "git+https://github.com/qazbnm456/diff-sentry@${IN_VERSION}" diff-sentry)
+          SENTRY=(uvx "diff-sentry==${IN_VERSION}")
         fi
 
         set +e

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/diff_sentry/__init__.py

@@ -22,7 +22,7 @@ from __future__ import annotations
 from .assemble import assemble_verdict, verdict_from_events
 from .config import DetectConfig
 from .emit import EmitResult, emit_signal, signal_payload
-from .indicators import hits_from_events, scan_indicators
+from .indicators import hits_from_events, scan_content, scan_diff, scan_indicators
 from .ingest import event_from_payload, issue_event, pr_event
 from .normalize import event_metadata, normalize_event
 from .response import build_failed_response, build_response
@@ -44,6 +44,8 @@ __all__ = [
     "DetectionResponse",
     "RefusalInfo",
     "ProcessInfo",
+    "scan_content",
+    "scan_diff",
     "scan_indicators",
     "hits_from_events",
     "normalize_event",
@@ -68,7 +70,7 @@ __all__ = [
     "detect_from_event",
 ]
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"
 
 
 def __getattr__(name: str):  # PEP 562 — defer the dspy import to first use

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/diff_sentry/cli.py

@@ -91,10 +91,9 @@ def _baseline_indicators(event: dict) -> list[dict]:
     """The host-side deterministic evidence recorded in run_start meta BEFORE the planner runs: the text
     detectors over the raw content ∪ the provenance detectors over the ingest facts. Both re-source into the
     evidence union on read (MF3), so a false-benign SUBMIT can skew the verdict but never suppress these."""
-    from .indicators import scan_indicators, scan_provenance
-    from .normalize import raw_content
+    from .indicators import scan_content, scan_provenance
 
-    return ([h.model_dump() for h in scan_indicators(raw_content(event))]
+    return ([h.model_dump() for h in scan_content(event)]
             + [h.model_dump() for h in scan_provenance(event.get("provenance") or {})])
 
 
@@ -245,7 +244,7 @@ def _cmd_scan(args) -> int:
     `DS_*` creds, and the only way to hand creds to a fork PR's run is `pull_request_target` — the exact
     misconfiguration that opened the AsyncAPI "Miasma" supply-chain compromise. `scan` needs nothing, so
     it runs under the same read-only `contents: read` token an untrusted fork PR already gets."""
-    from .indicators import scan_indicators
+    from .indicators import scan_diff
     from .schema import severity_rank
 
     threshold = severity_rank(args.fail_on)
@@ -259,7 +258,7 @@ def _cmd_scan(args) -> int:
             label = path
         if not args.include_deletions:
             text = drop_deleted_lines(text)
-        hits.extend(scan_indicators(text, location=label))
+        hits.extend(scan_diff(text, location=label))
 
     worst = max((severity_rank(h.severity) for h in hits), default=-1)
     failed = worst >= threshold

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/diff_sentry/indicators.py

@@ -127,9 +127,47 @@ _WRITE_ALL_RE = re.compile(r"^[+ ]?\s*permissions\s*:\s*write-all\b", re.IGNOREC
 # AsyncAPI "Miasma" supply-chain compromise (a fork PR harvested the org-admin token out of the runner),
 # and it has no safe reading → `critical`.
 _PRIV_TRIGGER_RE = re.compile(r"^[+ ]?\s*(?:pull_request_target|workflow_run)\s*:", re.MULTILINE)
-_PR_HEAD_REF_RE = re.compile(
-    r"github\.event\.pull_request\.head\.(?:sha|ref)|github\.event\.workflow_run\.head_(?:sha|branch)|"
-    r"refs/pull/[^\s\"']*/(?:head|merge)", re.IGNORECASE)
+
+# The PR-HEAD expressions themselves, shared by the two patterns below — which differ only in what they
+# require the expression to DO. A bare MENTION is not a checkout: the recommended `workflow_run`
+# publisher (the safe way to comment on a fork PR, since `pull_request` hands forks a read-only token)
+# reads `workflow_run.head_sha` precisely to VALIDATE the artifact it was given, and gating on the
+# mention alone failed that pattern exactly as hard as the attack it is meant to catch.
+_PR_HEAD_EXPR = (r"github\.event\.pull_request\.head\.(?:sha|ref)"
+                 r"|github\.event\.workflow_run\.head_(?:sha|branch)"
+                 # The interpolated form `refs/pull/${{ github.event.number }}/head` is the one that
+                 # actually appears in the wild; a bare `[^\s"']*` stops at the space inside the
+                 # expression, so the interpolation blob is spelled out as its own alternative.
+                 r"|refs/pull/(?:\$\{\{[^{}]*\}\}|[^\s\"'])*/(?:head|merge)")
+_PR_HEAD_REF_RE = re.compile(_PR_HEAD_EXPR, re.IGNORECASE)
+
+# The expression BECOMING a checkout: an `actions/checkout` `ref:` value, or a git/gh command that
+# fetches or checks it out.
+_PR_HEAD_CHECKOUT_RE = re.compile(
+    rf"^[+ ]?\s*ref\s*:[^\n]*(?:{_PR_HEAD_EXPR})"
+    rf"|(?:git\s+(?:checkout|fetch|pull)|gh\s+pr\s+checkout)[^\n]*(?:{_PR_HEAD_EXPR})",
+    re.IGNORECASE | re.MULTILINE)
+
+# One hop of indirection — the same lethal shape written as two lines:
+#     HEAD: ${{ github.event.pull_request.head.sha }}   …   ref: ${{ env.HEAD }}
+# Matching only the direct form would leave that as a trivial bypass, so a name bound to the head
+# expression is tracked and a `ref:` that reads it counts as the checkout.
+_HEAD_BINDING_RE = re.compile(
+    rf"^[+ ]?\s*([A-Za-z_][A-Za-z0-9_-]*)\s*[:=]\s*[^\n]*(?:{_PR_HEAD_EXPR})",
+    re.IGNORECASE | re.MULTILINE)
+_REF_VALUE_RE = re.compile(r"^[+ ]?\s*ref\s*:\s*([^\n]*)", re.IGNORECASE | re.MULTILINE)
+
+# The third way to check out a fork PR head, and the only one that says so in words. actions/checkout
+# v5.1/v6.1/v7 REFUSE to check out a fork PR under `pull_request_target`/`workflow_run` unless the
+# workflow opts back in with `allow-unsafe-pr-checkout: true`. There is no ref to trace and no dataflow
+# to infer — the line is the intent, written out. Under `pull_request` it means nothing (no privileged
+# context to protect), which is why it only counts inside `_scan_workflow_config`'s trigger guard.
+# Literal `true` only: an expression value is a parameterisation question, not evidence, and the
+# `^[+ ]?` anchor keeps a REMOVED opt-in (the hardening you want) from firing.
+_UNSAFE_PR_CHECKOUT_RE = re.compile(
+    r"^[+ ]?\s*allow-unsafe-pr-checkout\s*:\s*[\"']?true[\"']?\s*$",
+    re.IGNORECASE | re.MULTILINE)
+_IDENT_RE = re.compile(r"[A-Za-z_][A-Za-z0-9_-]*")
 
 # Diff-PRESENTATION evasion — attacks aimed at the human reading the diff, not at the runtime. Miasma
 # prepended ~700 spaces to shove its payload off the right edge of a standard diff viewer. No source
@@ -281,16 +319,52 @@ def _scan_workflow_perms(text: str) -> list[IndicatorHit]:
             for m in _WRITE_ALL_RE.finditer(text)]
 
 
+_PWN_TITLE = ("privileged fork trigger checks out the PR HEAD — untrusted code with the base "
+              "repo's token/secrets")
+_PWN_OPTIN_TITLE = ("privileged fork trigger re-enables the fork-PR checkout actions/checkout now "
+                    "blocks by default — untrusted code with the base repo's token/secrets")
+
+
+def _pr_head_checkout(text: str) -> tuple[re.Match[str], str] | None:
+    """Where a PR-HEAD checkout actually happens, and which of the three forms it took.
+
+    Returns the match to cite plus the title for it — the opt-in reads differently enough from a ref
+    that reporting it as "checks out the PR HEAD" would send a reader looking for a `ref:` that is not
+    there."""
+    optin = _UNSAFE_PR_CHECKOUT_RE.search(text)
+    if optin:
+        return optin, _PWN_OPTIN_TITLE
+    direct = _PR_HEAD_CHECKOUT_RE.search(text)
+    if direct:
+        return direct, _PWN_TITLE
+    # `ref:` is not a binding — a `ref:` holding the expression IS the direct case above.
+    bound = {m.group(1).lower() for m in _HEAD_BINDING_RE.finditer(text)} - {"ref"}
+    if not bound:
+        return None
+    for m in _REF_VALUE_RE.finditer(text):
+        if any(name.lower() in bound for name in _IDENT_RE.findall(m.group(1))):
+            return m, _PWN_TITLE
+    return None
+
+
 def _scan_workflow_config(text: str) -> list[IndicatorHit]:
     """What a workflow BECOMES, not merely that one was touched (`workflow-tamper`'s job)."""
     trigger = _PRIV_TRIGGER_RE.search(text)
     if not trigger:
         return []
+    checkout = _pr_head_checkout(text)
+    if checkout:
+        match, title = checkout
+        return [_hit("pwn-request", "critical", title,
+                     _snip(text, match.start(), match.end()))]
     head = _PR_HEAD_REF_RE.search(text)
     if head:
-        return [_hit("pwn-request", "critical",
-                     "privileged fork trigger checks out the PR HEAD — untrusted code with the base "
-                     "repo's token/secrets",
+        # Reads the head ref without checking it out. That is the validating-publisher shape, which is
+        # the RECOMMENDED way to comment on a fork PR — so it stays sub-floor, but it is cited rather
+        # than the trigger line, because this is the spot a reviewer should look at.
+        return [_hit("privileged-fork-trigger", "medium",
+                     "`pull_request_target`/`workflow_run` reads the PR HEAD without checking it out — "
+                     "confirm the ref never reaches a checkout",
                      _snip(text, head.start(), head.end()))]
     return [_hit("privileged-fork-trigger", "medium",
                  "`pull_request_target`/`workflow_run` — a fork PR runs in a privileged context",
@@ -391,6 +465,72 @@ def _sev_rank(sev: str) -> int:
     return severity_rank(sev)
 
 
+# ── diff SCOPING ──────────────────────────────────────────────────────────────────────────────────────
+# A change is many files, and `scan_indicators` reads whatever it is handed as ONE string. That is right
+# for the rules that fire on a single match, but two of them require a PAIR of signals — `pwn-request`
+# (privileged trigger + PR-HEAD checkout) and `detached-process-spawn` (detached spawn + child_process).
+# Read as one blob, those pair ACROSS FILES: a `workflow_run:` added to one workflow and a
+# `ref: ${{ github.event.pull_request.head.sha }}` sitting in an unrelated file — a doc example, a test
+# fixture, or the very workflow the change is DELETING — compose into a `critical` that no single file
+# contains. Scoping the scan per file removes that class outright, and names the file in `location`
+# while it is there: evidence that used to read `gated.diff` for every hit now points at what to open.
+#
+# The trade is explicit: a payload deliberately split across two files no longer pairs. That is the
+# right way round — a detector that invents a critical out of two unrelated files trains people to
+# disable it, and the single-signal rules (which are most of them) are unaffected either way.
+_DIFF_FILE_RE = re.compile(r"^diff --git a/(?P<a>.+?) b/(?P<b>.+?)$", re.MULTILINE)
+
+
+def split_diff_by_file(text: str) -> list[tuple[str, str]]:
+    """Split a unified diff into `(path, segment)` pairs; `[]` when `text` is not a diff.
+
+    Anything BEFORE the first file header comes back first with an empty path. That chunk is not
+    padding — for `raw_content` it is the PR title and body, which is exactly where prompt injection
+    lives, so it has to keep being scanned rather than skipped as preamble."""
+    marks = list(_DIFF_FILE_RE.finditer(text or ""))
+    if not marks:
+        return []
+    out: list[tuple[str, str]] = []
+    head = text[:marks[0].start()]
+    if head.strip():
+        out.append(("", head))
+    for i, m in enumerate(marks):
+        end = marks[i + 1].start() if i + 1 < len(marks) else len(text)
+        out.append((m.group("b") or m.group("a"), text[m.start():end]))
+    return out
+
+
+def scan_content(event: dict) -> list[IndicatorHit]:
+    """Scan ONE event's untrusted content with the same per-file scoping `scan_diff` gives a raw diff.
+
+    An event is not a unified diff — `raw_content` concatenates the title, the author, every
+    (filename, patch) and the body into one string, with no `diff --git` headers for `scan_diff` to
+    split on. Handing that blob to `scan_diff` therefore scopes NOTHING: a paired rule could still take
+    one half from a workflow and the other from an unrelated file. The event already carries the
+    structure a raw diff has to be parsed for, so scan it piece by piece and let hits from a file name
+    that file."""
+    from .normalize import content_segments
+    deduped: dict[str, IndicatorHit] = {}
+    for label, text in content_segments(event):
+        for h in scan_indicators(text, location=label):
+            deduped.setdefault(h.id, h)
+    return list(deduped.values())
+
+
+def scan_diff(text: str, *, location: str = "") -> list[IndicatorHit]:
+    """`scan_indicators` with per-file scoping — a paired rule can only fire when ONE file carries both
+    halves. Non-diff input (a region the planner pulled out, a plain file) falls through to a single
+    whole-text scan, so this is safe as the entry point for either shape."""
+    segments = split_diff_by_file(text)
+    if not segments:
+        return scan_indicators(text, location=location)
+    deduped: dict[str, IndicatorHit] = {}
+    for path, segment in segments:
+        for h in scan_indicators(segment, location=path or location):
+            deduped.setdefault(h.id, h)
+    return list(deduped.values())
+
+
 def scan_indicators(text: str, *, location: str = "") -> list[IndicatorHit]:
     """Run every detector over `text` and return the DEDUPED union of hits (by deterministic id).
 
@@ -538,7 +678,11 @@ def make_indicator_tool() -> Callable[[str], str]:
         injection, obfuscated payloads, secret exfiltration, known exfil/OAST callback services,
         CI/CODEOWNERS tampering, workflow permission escalation, CI-skip bypass, prompt injection. Returns
         the hits found (id, rule, severity, title). Cite an id in your final `indicator_ids`."""
-        hits = scan_indicators(region or "")
+        # scan_diff, not scan_indicators: when the planner hands back a whole diff this scopes it per
+        # file exactly as the host-side baseline did, so the two scans of the same content still mint
+        # the same ids and de-duplicate to one union member (MF3). A sub-region is not a diff and falls
+        # through to the plain whole-text scan.
+        hits = scan_diff(region or "")
         record_tool_call("scan_indicators", args={"region": (region or "")[:200]}, ok=True,
                          hits=[h.model_dump() for h in hits], n=len(hits))
         if not hits:

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/diff_sentry/normalize.py

@@ -159,13 +159,25 @@ def has_groundable_content(event_str: str) -> bool:
     return bool(body) and body != NO_CONTENT_SENTINEL
 
 
+def content_segments(event: dict) -> list[tuple[str, str]]:
+    """The untrusted content split the way the event already carries it: `(label, text)` per piece —
+    the title+author, then one segment per file, then the body.
+
+    `raw_content` is the concatenation of exactly these, in this order, so the two cannot drift and the
+    content digest built on it stays byte-stable. The split exists because the baseline scan needs the
+    same per-file scoping `scan_diff` gives a raw diff: read as one blob, a rule that needs two signals
+    could take one from a workflow and the other from an unrelated file. A file's segment keeps its
+    filename INSIDE the text as well as in the label — `workflow-tamper` reads the path itself."""
+    files = _files(event)
+    segments = [("", f"{event.get('title', '') or ''}\n{event.get('author', '') or ''}")]
+    segments += [(f["filename"], f"{f['filename']}\n{f['patch']}") for f in files]
+    segments.append(("", str(event.get("body", "") or "")))
+    return segments
+
+
 def raw_content(event: dict) -> str:
     """The concatenated untrusted content the host-side BASELINE scan runs on — TITLE + author +
     (filename + patch) per file + body. The title is included so a title-borne prompt injection is caught
     by the deterministic baseline even when the planner is skewed by the same payload (MF3): an issue/PR
     title is a canonical injection channel, and its hits must reach the signal regardless of the verdict."""
-    files = _files(event)
-    parts = [str(event.get("title", "") or ""), str(event.get("author", "") or "")]
-    parts += [f"{f['filename']}\n{f['patch']}" for f in files]
-    parts.append(str(event.get("body", "") or ""))
-    return "\n".join(parts)
+    return "\n".join(text for _, text in content_segments(event))

{diff_sentry-0.4.0 → diff_sentry-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "diff-sentry"
-version = "0.4.0"
+version = "0.4.2"
 description = "Catch malicious pull requests before they merge: scan a diff for supply-chain attack patterns with deterministic evidence a model cannot suppress."
 readme = "README.md"
 requires-python = ">=3.11"