messagefoundry 0.2.4__tar.gz → 0.2.5__tar.gz

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/.github/workflows/ci.yml

@@ -10,6 +10,11 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+# Least privilege: every job here only reads the repo and runs tests/builds (no gh writes, no git push,
+# no secrets), so a read-only default token is sufficient. A job needing more declares its own block.
+permissions:
+  contents: read
+
 jobs:
   # Lint + type-check + unit tests. The project supports a single Python — 3.14 — so every leg runs it.
   # Linux carries the cheap breadth (1x minutes); Windows Server 2022 + 2025 is the primary deployment
@@ -809,9 +814,13 @@ jobs:
         if: >-
           contains(needs.*.result, 'failure') ||
           contains(needs.*.result, 'cancelled')
+        env:
+          # Pass the needs context via env, not inline ${{ }} in the run block (defense-in-depth against
+          # template injection — a job output could in theory carry a quote that breaks out of echo).
+          NEEDS_JSON: ${{ toJSON(needs) }}
         run: |
           echo "::error::A gated CI leg failed or was cancelled."
-          echo '${{ toJSON(needs) }}'
+          echo "$NEEDS_JSON"
           exit 1
 
       - name: Gated legs OK

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/.github/workflows/codeql.yml

@@ -56,12 +56,12 @@ jobs:
         with:
           persist-credentials: false # CodeQL uploads via the job token, not a persisted git credential
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3 # TODO: SHA-pin (repo convention)
+        uses: github/codeql-action/init@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
         with:
           languages: ${{ matrix.language }}
           # security-extended adds higher-recall security queries on top of the default suite.
           queries: security-extended
       - name: Analyze
-        uses: github/codeql-action/analyze@v3 # TODO: SHA-pin (repo convention)
+        uses: github/codeql-action/analyze@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
         with:
           category: "/language:${{ matrix.language }}"

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/.github/workflows/dependabot-lock-resync.yml

@@ -75,6 +75,10 @@ jobs:
           uv export --no-emit-project --no-dev --extra sqlserver --format requirements.txt -o docker/locks/requirements-sqlserver.lock
 
       - name: Commit and push the resynced locks
+        env:
+          # Pass the PR head ref through the environment, NOT inline ${{ }} in the run block, so a branch
+          # name containing shell metacharacters can never be evaluated as code (template injection).
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
         run: |
           set -euo pipefail
           git config user.name 'dependabot[bot]'
@@ -88,4 +92,4 @@ jobs:
           # Push with the persisted App-token credential (NOT GITHUB_TOKEN). An App-token push emits a
           # synchronize event so the required checks (DEP-1, ci.yml) re-run on the new commit; a
           # GITHUB_TOKEN push would leave them pending and the PR unmergeable.
-          git push origin "HEAD:${{ github.event.pull_request.head.ref }}"
+          git push origin "HEAD:${HEAD_REF}"

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/.github/workflows/release.yml

@@ -34,16 +34,20 @@ on:
       - "v[0-9]+.[0-9]+.[0-9]+-*"  # pre-releases: v0.1.0-rc1, …
   workflow_dispatch:
 
-permissions:
-  contents: write       # create the release + upload its assets
-  id-token: write       # Sigstore signing, PyPI Trusted Publishing, + provenance — all via the GitHub OIDC identity
-  attestations: write   # write the SLSA build-provenance attestation (actions/attest-build-provenance)
+# Deny-all at the workflow level; each job below requests only the scopes it uses (least privilege).
+permissions: {}
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write       # create the release + upload its assets
+      id-token: write       # Sigstore signing, PyPI Trusted Publishing, + provenance — all via the GitHub OIDC identity
+      attestations: write   # write the SLSA build-provenance attestation (actions/attest-build-provenance)
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false  # release uses GH_TOKEN env / OIDC, never the persisted git credential
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
@@ -171,8 +175,13 @@ jobs:
     # publish — so a missing harness PyPI project can never red a release.
     needs: release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write   # gh release upload (attach the harness wheel)
+      id-token: write   # PyPI Trusted Publishing (OIDC) for the harness wheel
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false  # gh upload uses GH_TOKEN env / OIDC, never the persisted git credential
 
       - name: Set up Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/.github/workflows/scorecard.yml

@@ -42,7 +42,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run Scorecard
-        uses: ossf/scorecard-action@v2 # TODO: SHA-pin (repo convention)
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -54,6 +54,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@v3 # TODO: SHA-pin (repo convention)
+        uses: github/codeql-action/upload-sarif@dd903d2e4f5405488e5ef1422510ee31c8b32357 # v3.36.2
         with:
           sarif_file: results.sarif

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/.github/workflows/security.yml

@@ -214,12 +214,12 @@ jobs:
   zizmor:
     name: zizmor (GitHub Actions static analysis)
     runs-on: ubuntu-latest
-    # ADVISORY for its first cycle (continue-on-error): static analysis of the workflow files THEMSELVES
-    # (Trail of Bits) — template injection, over-broad GITHUB_TOKEN permissions, unpinned `uses:`,
-    # artifact poisoning. Complements (and enforces) the by-hand SHA-pinning across these workflows.
-    # Once a baseline run is reviewed/clean, DELETE `continue-on-error` to make it blocking. (It will
-    # flag the `@v3` codeql-action tags in codeql.yml — that's the intended forcing function to pin them.)
-    continue-on-error: true
+    # BLOCKING: static analysis of the workflow files THEMSELVES (Trail of Bits) — template injection,
+    # over-broad GITHUB_TOKEN permissions, dangerous triggers, artifact-credential persistence. The
+    # baseline is clean — high-confidence findings are fixed in-tree (least-privilege per-job permissions,
+    # env-passed refs, persist-credentials: false) and the few safe-by-design ones are recorded with a
+    # justification in .github/zizmor.yml — so a NEW workflow-security regression now fails the build.
+    # Tune suppressions in .github/zizmor.yml (with a reason), not by relaxing this gate.
     permissions:
       contents: read
     steps:

messagefoundry-0.2.5/.github/zizmor.yml

@@ -0,0 +1,31 @@
+# zizmor configuration — https://docs.zizmor.sh/configuration/
+#
+# Each entry below is a REVIEWED, justified non-finding for this repo. Real fixes live in the workflow
+# files themselves (least-privilege permissions, env-passed refs, persist-credentials: false); this file
+# is only for findings that are safe-by-design here. Keep it small and commented — a suppression without
+# a reason is a latent vulnerability.
+rules:
+  dangerous-triggers:
+    ignore:
+      # A CLA assistant REQUIRES pull_request_target to record signatures + comment on fork PRs. This
+      # workflow never checks out untrusted PR code, pins the third-party action by SHA, and gates on the
+      # immutable comment body / event name — so the usual pull_request_target risk (running attacker
+      # code with a write token) does not apply. See the SECURITY note in cla.yml.
+      - cla.yml
+
+  artipacked:
+    ignore:
+      # artipacked flags a checkout that persists the token's git credential — a risk only if that
+      # credential can leak into an uploaded artifact. The jobs below do not push and never upload the
+      # repo/.git tree, so the persisted credential is inert noise here.
+      #
+      # NOT suppressed (fixed at the source instead): release.yml sets persist-credentials: false on both
+      # checkouts because it DOES upload build artifacts. dependabot-lock-resync.yml persists a
+      # narrowly-scoped App token ON PURPOSE to push the resynced locks (documented inline) and is listed
+      # here for that reason.
+      - benchmark.yml
+      - ci.yml
+      - dependabot-lock-resync.yml
+      - release-sync-check.yml
+      - security.yml
+      - vuln-metrics.yml

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/CHANGELOG.md

@@ -6,6 +6,23 @@ All notable changes to MessageFoundry are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.2.5] — 2026-06-26 — Early Access
+
+A bug-fix release hardening SQL Server cluster cold-start.
+
+### Fixed
+- **SQL Server: concurrent schema-init race on a virgin DB (HA cold start).** Two cluster nodes starting
+  simultaneously against an empty database both ran the `IF OBJECT_ID(...) IS NULL CREATE TABLE` guards
+  with no cross-node lock, so both issued `CREATE` and the loser died at startup on a `2714` ("There is
+  already an object named ..."). `_ensure_schema` now takes an exclusive `sp_getapplock`
+  (`mefor:schema_init`) around the DDL — the T-SQL analog of the PostgreSQL store's existing schema
+  advisory lock — so the second node serializes and runs the now-no-op guarded CREATEs cleanly. Single-node
+  and pre-created schema are unaffected; SQLite and PostgreSQL were already race-safe. (#553)
+
+### Changed
+- Docs: the `[cluster]` settings docstring and the pool-size validation error now name both `postgres` and
+  `sqlserver` (the cross-section validator already admitted both). (#553)
+
 ## [0.2.4] — 2026-06-26 — Early Access
 
 A bug-fix release that completes the EF-6 SQL Server fix shipped in 0.2.3.
@@ -186,7 +203,8 @@ tests, but the external code review + penetration test (the bar for a security-c
 - Releases are built, SBOM'd (CycloneDX), and signed with [Sigstore](https://www.sigstore.dev/) — see the
   `release` workflow.
 
-[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.4...HEAD
+[Unreleased]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.5...HEAD
+[0.2.5]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.4...v0.2.5
 [0.2.4]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/wshallwshall/MessageFoundry/compare/v0.2.1...v0.2.2

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: messagefoundry
-Version: 0.2.4
+Version: 0.2.5
 Summary: Open-source healthcare integration engine — route, transform, and validate messages across many formats and connection types
 License-Expression: AGPL-3.0-or-later
 License-File: LICENSE

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/messagefoundry/__init__.py

@@ -60,7 +60,7 @@ from messagefoundry.parsing.message import Message, RawMessage
 from messagefoundry.parsing.split import split_by_obr
 from messagefoundry.timezone import convert_hl7_timestamp, to_zone
 
-__version__ = "0.2.4"
+__version__ = "0.2.5"
 
 __all__ = [
     "Message",

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/messagefoundry/config/settings.py

@@ -1116,8 +1116,8 @@ class ClusterSettings(_Section):
     ``heartbeat_seconds`` to ``DB_now + leader_lease_ttl_seconds``, a standby acquires only once that
     lease has expired, and a leader that cannot renew within ``leader_fence_timeout_seconds`` self-fences
     before the lease can expire (the split-brain guard). The cross-section validator below requires
-    ``[store].backend = postgres`` and ``[store].pool_size >= 2`` when this is enabled (a clustered node
-    drives concurrent background work against the pool)."""
+    ``[store].backend`` in ``{postgres, sqlserver}`` and ``[store].pool_size >= 2`` when this is enabled
+    (a clustered node drives concurrent background work against the pool)."""
 
     enabled: bool = False
     # Override the auto-generated node id (host:pid:hex). Pin it for a stable identity across restarts
@@ -1306,7 +1306,7 @@ class ServiceSettings(BaseModel):
                     f"(got {self.store.pool_size}); a clustered node drives concurrent background work "
                     "(the membership/lease maintenance loop + the leader reclaim sweep + the per-stage "
                     "workers) against the pool, so a pool of 1 would serialize everything — prefer "
-                    "pool_size >= 3 for clustered Postgres"
+                    "pool_size >= 3 for a clustered node (Postgres or SQL Server)"
                 )
         return self
 

{messagefoundry-0.2.4 → messagefoundry-0.2.5}/messagefoundry/store/sqlserver.py

@@ -70,6 +70,12 @@ log = logging.getLogger(__name__)
 
 # Schema (T-SQL). Idempotent: guarded by OBJECT_ID / IndexProperty so re-open is a no-op. Epoch
 # timestamps are FLOAT; ids are NVARCHAR(64) (uuid4 hex); bodies NVARCHAR(MAX).
+#
+# Schema-init is serialized across concurrent opens by this named applock (the T-SQL analog of the
+# Postgres store's ``pg_advisory_xact_lock("mefor_schema_init")`` — store/postgres.py). The OBJECT_ID
+# guards below are check-then-create and do NOT serialize concurrent creators on a virgin DB — see
+# _ensure_schema.
+_SCHEMA_LOCK = "mefor:schema_init"
 _SCHEMA: list[str] = [
     """IF OBJECT_ID('messages','U') IS NULL CREATE TABLE messages (
         id NVARCHAR(64) NOT NULL PRIMARY KEY, channel_id NVARCHAR(256) NOT NULL,
@@ -578,6 +584,14 @@ class SqlServerStore:
     async def _ensure_schema(self) -> None:
         async with self._acquire() as conn, self._cursor(conn) as cur:
             try:
+                # Serialize schema-init across concurrent opens (e.g. a 2-node HA cold start against a
+                # virgin DB) — the T-SQL analog of the Postgres store's schema advisory lock. Without it
+                # the `IF OBJECT_ID(...) IS NULL CREATE` guards below are check-then-create: two nodes
+                # both see NULL and both CREATE, and the loser dies on a 2714 "There is already an object
+                # named ...". The applock is transaction-scoped (the autocommit=False pool means this
+                # first statement opens the txn), so it auto-releases on the commit/rollback below; the
+                # second node then runs the now-no-op guarded CREATEs cleanly.
+                await self._applock(cur, _SCHEMA_LOCK)
                 for statement in _SCHEMA:
                     await cur.execute(statement)
                 await conn.commit()

messagefoundry-0.2.5/tests/test_sqlserver_schema_init.py

@@ -0,0 +1,96 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2026 MessageFoundry Organization and contributors
+"""Finding A: SQL Server schema-init takes the cross-node schema applock BEFORE any CREATE, so two
+nodes doing an HA cold start against a virgin DB serialize the DDL instead of both running the
+check-then-create `IF OBJECT_ID(...) IS NULL CREATE` guards and racing the loser into a 2714 ("There
+is already an object named ..."). The real race needs a real SQL Server + two concurrent opens (the
+gated service-container suite / the dogfood box), but the *contract* — applock first, then DDL, under
+one transaction — is verifiable here with a fake aioodbc conn/cursor and NO ODBC driver.
+"""
+
+from __future__ import annotations
+
+import types
+from contextlib import asynccontextmanager
+
+from messagefoundry.store.sqlserver import _SCHEMA_LOCK, SqlServerStore
+
+
+class _FakeCursor:
+    def __init__(self, executed: list[tuple[str, object]]):
+        self._executed = executed
+        self.description = None
+
+    async def execute(self, sql: str, params: object = None) -> None:
+        self._executed.append((sql, params))
+
+    async def fetchone(self) -> object:
+        return (0,)  # sp_getapplock return code >= 0 (lock granted)
+
+    async def fetchall(self) -> list[object]:
+        return []
+
+    async def close(self) -> None:
+        pass
+
+
+class _FakeConn:
+    def __init__(self, executed: list[tuple[str, object]]):
+        self.cursor_obj = _FakeCursor(executed)
+        self.committed = 0
+        self.rolledback = 0
+
+    async def cursor(self) -> _FakeCursor:
+        return self.cursor_obj
+
+    async def commit(self) -> None:
+        self.committed += 1
+
+    async def rollback(self) -> None:
+        self.rolledback += 1
+
+
+class _FakePool:
+    def __init__(self, conn: _FakeConn):
+        self._conn = conn
+
+    def acquire(self) -> object:
+        conn = self._conn
+
+        @asynccontextmanager
+        async def _cm():  # type: ignore[no-untyped-def]
+            yield conn
+
+        return _cm()
+
+
+def _make_store(conn: _FakeConn) -> SqlServerStore:
+    store = SqlServerStore.__new__(SqlServerStore)
+    store._pool = _FakePool(conn)  # type: ignore[assignment]
+    store._settings = types.SimpleNamespace(command_timeout=0)  # type: ignore[assignment]
+    return store
+
+
+async def test_ensure_schema_takes_applock_before_any_create() -> None:
+    executed: list[tuple[str, object]] = []
+    conn = _FakeConn(executed)
+    store = _make_store(conn)
+
+    await store._ensure_schema()
+
+    # The very first statement is an exclusive schema applock naming the cross-node resource...
+    sql0, params0 = executed[0]
+    assert "sp_getapplock" in sql0
+    assert params0 is not None and _SCHEMA_LOCK in params0
+    # ...and it precedes every CREATE TABLE (so two virgin-DB nodes serialize rather than race to 2714).
+    first_create = next(i for i, (sql, _) in enumerate(executed) if "CREATE TABLE" in sql)
+    assert first_create > 0
+    # Single committed DDL batch; the txn-scoped applock auto-releases on that commit.
+    assert conn.committed == 1
+    assert conn.rolledback == 0
+
+
+async def test_schema_lock_resource_matches_postgres_name() -> None:
+    # Both backends must take the SAME logical schema lock name family ("mefor...schema_init") so the
+    # intent is obvious; the SQL Server resource is colon-namespaced like its sibling applocks.
+    assert _SCHEMA_LOCK == "mefor:schema_init"