modelaudit 0.2.51__tar.gz → 0.2.52__tar.gz

{modelaudit-0.2.51 → modelaudit-0.2.52}/.github/workflows/release-please.yml

@@ -22,6 +22,10 @@ on:
         description: "Publish an already-versioned modelaudit-picklescan release, for example 0.1.2"
         required: false
         type: string
+      root_provenance_run_id:
+        description: "Recover root provenance from the original verified publish run, for example 29787069929"
+        required: false
+        type: string
 
 jobs:
   release-please:
@@ -36,6 +40,8 @@ jobs:
       picklescan_release_created: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_release_created || steps.release.outputs['packages/modelaudit-picklescan--release_created'] }}
       picklescan_tag_name: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_tag_name || steps.release.outputs['packages/modelaudit-picklescan--tag_name'] }}
       picklescan_version: ${{ steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.picklescan_version || steps.release.outputs['packages/modelaudit-picklescan--version'] }}
+      root_provenance_recovery: ${{ steps.manual.outputs.root_provenance_recovery }}
+      root_provenance_run_id: ${{ steps.manual.outputs.root_provenance_run_id }}
       pr_number: ${{ steps.release.outputs.pr && fromJSON(steps.release.outputs.pr).number || '' }}
       pr_branch: ${{ steps.check-pr.outputs.pr_branch || '' }}
     steps:
@@ -44,7 +50,34 @@ jobs:
         env:
           ROOT_VERSION: ${{ github.event.inputs.root_version || '' }}
           PICKLESCAN_VERSION: ${{ github.event.inputs.picklescan_version || '' }}
+          ROOT_PROVENANCE_RUN_ID: ${{ github.event.inputs.root_provenance_run_id || '' }}
         run: |
+          if [[ -n "$ROOT_PROVENANCE_RUN_ID" ]]; then
+            if [[ ! "$ROOT_PROVENANCE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
+              echo "Root provenance recovery requires a numeric source run ID."
+              exit 1
+            fi
+            if [[ ! "$ROOT_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+              echo "Root provenance recovery requires root_version in X.Y.Z format."
+              exit 1
+            fi
+            if [[ -n "$PICKLESCAN_VERSION" ]]; then
+              echo "Root provenance recovery cannot publish modelaudit-picklescan."
+              exit 1
+            fi
+
+            {
+              echo "manual_release=true"
+              echo "release_created=false"
+              echo "picklescan_release_created=false"
+              echo "root_provenance_recovery=true"
+              echo "root_provenance_run_id=$ROOT_PROVENANCE_RUN_ID"
+              echo "version=$ROOT_VERSION"
+              echo "tag_name=v$ROOT_VERSION"
+            } >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           {
             if [[ -n "$ROOT_VERSION" ]]; then
               echo "release_created=true"
@@ -76,7 +109,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Ensure manual GitHub releases exist
-        if: steps.manual.outputs.manual_release == 'true'
+        if: steps.manual.outputs.manual_release == 'true' && steps.manual.outputs.root_provenance_recovery != 'true'
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ROOT_TAG: ${{ steps.manual.outputs.tag_name }}
@@ -1264,8 +1297,16 @@ jobs:
           PY
 
   provenance:
-    if: needs.release-please.outputs.release_created == 'true'
-    needs: [build, publish-pypi, release-please]
+    if: >-
+      ${{
+        always() &&
+        !cancelled() &&
+        needs.release-please.outputs.release_created == 'true' &&
+        needs.build.result == 'success' &&
+        needs.publish-pypi.result == 'success' &&
+        needs.verify-pypi.result == 'success'
+      }}
+    needs: [build, publish-pypi, verify-pypi, release-please]
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -1316,6 +1357,400 @@ jobs:
             --repo "${{ github.repository }}" \
             --clobber
 
+  root-provenance-recovery:
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.release-please.result == 'success' &&
+        needs.release-please.outputs.root_provenance_recovery == 'true'
+      }}
+    needs: release-please
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Checkout tagged root release
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          ref: refs/tags/${{ needs.release-please.outputs.tag_name }}
+          sparse-checkout: |
+            pyproject.toml
+            uv.lock
+          persist-credentials: false
+
+      - name: Verify original root publish run
+        id: verify-source
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SOURCE_RUN_ID: ${{ needs.release-please.outputs.root_provenance_run_id }}
+        run: |
+          if [[ ! "$SOURCE_RUN_ID" =~ ^[1-9][0-9]*$ ]]; then
+            echo "Root provenance recovery requires a numeric source run ID."
+            exit 1
+          fi
+
+          tag_commit_sha=$(git rev-parse --verify 'HEAD^{commit}')
+          if [[ ! "$tag_commit_sha" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "Root provenance recovery requires a valid tagged commit SHA."
+            exit 1
+          fi
+
+          run_metadata=$(mktemp)
+          jobs_metadata=$(mktemp)
+          repository_metadata=$(mktemp)
+          compare_metadata=$(mktemp)
+          tag_compare_metadata=$(mktemp)
+          source_relation_metadata=$(mktemp)
+          trap 'rm -f "$run_metadata" "$jobs_metadata" "$repository_metadata" "$compare_metadata" "$tag_compare_metadata" "$source_relation_metadata"' EXIT
+          gh api "repos/${GITHUB_REPOSITORY}/actions/runs/${SOURCE_RUN_ID}" > "$run_metadata"
+          gh api --paginate --slurp \
+            "repos/${GITHUB_REPOSITORY}/actions/runs/${SOURCE_RUN_ID}/jobs?per_page=100" > "$jobs_metadata"
+          gh api "repos/${GITHUB_REPOSITORY}" > "$repository_metadata"
+          export RUN_METADATA="$run_metadata"
+          export JOBS_METADATA="$jobs_metadata"
+          export REPOSITORY_METADATA="$repository_metadata"
+
+          source_head_sha=$(python - <<'PY'
+          import json
+          import os
+          import re
+          from pathlib import Path
+
+          repository = os.environ["GITHUB_REPOSITORY"]
+          source_run_id = os.environ["SOURCE_RUN_ID"]
+          run = json.loads(Path(os.environ["RUN_METADATA"]).read_text(encoding="utf-8"))
+          if not isinstance(run, dict):
+              raise SystemExit(f"Source run {source_run_id} returned invalid run metadata")
+          if run.get("path") != ".github/workflows/release-please.yml":
+              raise SystemExit(f"Source run {source_run_id} is not a release-please workflow run")
+          if run.get("event") not in {"push", "workflow_dispatch"}:
+              raise SystemExit(f"Source run {source_run_id} has an unsupported event: {run.get('event')!r}")
+          if run.get("status") != "completed" or run.get("conclusion") not in {"success", "failure"}:
+              raise SystemExit(f"Source run {source_run_id} did not complete with a supported conclusion")
+          source_repository = run.get("repository")
+          if not isinstance(source_repository, dict) or source_repository.get("full_name") != repository:
+              raise SystemExit(f"Source run {source_run_id} belongs to a different repository")
+          repository_metadata = json.loads(Path(os.environ["REPOSITORY_METADATA"]).read_text(encoding="utf-8"))
+          if not isinstance(repository_metadata, dict) or repository_metadata.get("full_name") != repository:
+              raise SystemExit(f"Source run {source_run_id} returned invalid repository metadata")
+          if repository_metadata.get("default_branch") != "main":
+              raise SystemExit(f"Source run {source_run_id} repository does not use main as its default branch")
+          head_repository = run.get("head_repository")
+          if not isinstance(head_repository, dict) or head_repository.get("full_name") != repository:
+              raise SystemExit(f"Source run {source_run_id} has an untrusted head repository")
+          head_sha = run.get("head_sha")
+          if not isinstance(head_sha, str) or not re.fullmatch(r"[0-9a-f]{40}", head_sha):
+              raise SystemExit(f"Source run {source_run_id} returned an invalid head SHA")
+
+          pages = json.loads(Path(os.environ["JOBS_METADATA"]).read_text(encoding="utf-8"))
+          if not isinstance(pages, list) or not pages:
+              raise SystemExit(f"Source run {source_run_id} returned no job pages")
+          jobs = []
+          for page in pages:
+              if not isinstance(page, dict) or not isinstance(page.get("jobs"), list):
+                  raise SystemExit(f"Source run {source_run_id} returned invalid job metadata")
+              if not all(isinstance(job, dict) for job in page["jobs"]):
+                  raise SystemExit(f"Source run {source_run_id} returned an invalid job")
+              jobs.extend(page["jobs"])
+          for job_name in ("build", "publish-pypi", "verify-pypi"):
+              matching = [job for job in jobs if job.get("name") == job_name]
+              if len(matching) != 1:
+                  raise SystemExit(f"Source run {source_run_id} must contain exactly one {job_name} job")
+              job = matching[0]
+              if job.get("status") != "completed" or job.get("conclusion") != "success":
+                  raise SystemExit(f"Source run {source_run_id} {job_name} job did not complete successfully")
+          print(head_sha)
+          PY
+          )
+
+          gh api "repos/${GITHUB_REPOSITORY}/compare/${source_head_sha}...main" > "$compare_metadata"
+          gh api "repos/${GITHUB_REPOSITORY}/compare/${tag_commit_sha}...main" > "$tag_compare_metadata"
+          gh api "repos/${GITHUB_REPOSITORY}/compare/${tag_commit_sha}...${source_head_sha}" > "$source_relation_metadata"
+          export COMPARE_METADATA="$compare_metadata"
+          export TAG_COMPARE_METADATA="$tag_compare_metadata"
+          export SOURCE_RELATION_METADATA="$source_relation_metadata"
+          export SOURCE_HEAD_SHA="$source_head_sha"
+          export TAG_COMMIT_SHA="$tag_commit_sha"
+          python - <<'PY'
+          import json
+          import os
+          from pathlib import Path
+
+          source_run_id = os.environ["SOURCE_RUN_ID"]
+          source_head_sha = os.environ["SOURCE_HEAD_SHA"]
+          tag_commit_sha = os.environ["TAG_COMMIT_SHA"]
+          for label, expected_sha, metadata_path in (
+              (f"Source run {source_run_id}", source_head_sha, os.environ["COMPARE_METADATA"]),
+              ("Tagged root release", tag_commit_sha, os.environ["TAG_COMPARE_METADATA"]),
+              ("Tagged root release relative to source run", tag_commit_sha, os.environ["SOURCE_RELATION_METADATA"]),
+          ):
+              comparison = json.loads(Path(metadata_path).read_text(encoding="utf-8"))
+              if not isinstance(comparison, dict):
+                  raise SystemExit(f"{label} returned invalid branch comparison metadata")
+              if comparison.get("status") not in {"ahead", "identical"}:
+                  raise SystemExit(f"{label} does not belong to protected main history")
+              behind_by = comparison.get("behind_by")
+              if not isinstance(behind_by, int) or isinstance(behind_by, bool) or behind_by != 0:
+                  raise SystemExit(f"{label} is not an ancestor of protected main")
+              merge_base = comparison.get("merge_base_commit")
+              if not isinstance(merge_base, dict) or merge_base.get("sha") != expected_sha:
+                  raise SystemExit(f"{label} has an untrusted merge base")
+
+          source_relation = json.loads(Path(os.environ["SOURCE_RELATION_METADATA"]).read_text(encoding="utf-8"))
+          changed_files = source_relation.get("files")
+          allowed_source_changes = {".github/workflows/release-please.yml", "tests/test_release_workflow.py"}
+          if not isinstance(changed_files, list) or len(changed_files) > len(allowed_source_changes):
+              raise SystemExit("Tagged root release and source run returned invalid changed-file metadata")
+          if not all(
+              isinstance(entry, dict)
+              and entry.get("filename") in allowed_source_changes
+              and entry.get("status") in {"added", "modified", "removed", "renamed"}
+              and (
+                  entry.get("previous_filename") in allowed_source_changes
+                  if entry.get("status") == "renamed"
+                  else entry.get("previous_filename") is None
+              )
+              for entry in changed_files
+          ):
+              raise SystemExit("Tagged root release and source run differ outside the trusted release-repair files")
+          print(
+              f"Verified original modelaudit publish run {source_run_id} at {source_head_sha} "
+              f"and tagged root release at {tag_commit_sha}"
+          )
+          PY
+          {
+            echo "source_head_sha=$source_head_sha"
+            echo "tag_commit_sha=$tag_commit_sha"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Download original root build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: dist
+          path: dist/
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          repository: ${{ github.repository }}
+          run-id: ${{ needs.release-please.outputs.root_provenance_run_id }}
+
+      - name: Verify recovered root artifacts match PyPI
+        env:
+          EXPECTED_VERSION: ${{ needs.release-please.outputs.version }}
+        run: |
+          python - <<'PY'
+          import hashlib
+          import json
+          import os
+          import posixpath
+          import re
+          import tarfile
+          import unicodedata
+          import urllib.request
+          from pathlib import Path
+
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import tomli as tomllib
+
+          version = os.environ["EXPECTED_VERSION"]
+          if not re.fullmatch(r"[0-9]+\.[0-9]+\.[0-9]+", version):
+              raise SystemExit(f"Invalid root release version: {version!r}")
+
+          max_metadata_bytes = 10 * 1024 * 1024
+          max_sdist_members = 10_000
+          max_sdist_member_bytes = 16 * 1024 * 1024
+          max_sdist_bytes = 256 * 1024 * 1024
+          tagged_metadata = {}
+          for filename in ("pyproject.toml", "uv.lock"):
+              tagged_path = Path(filename)
+              tagged_size = tagged_path.stat().st_size
+              if tagged_size > max_metadata_bytes:
+                  raise SystemExit(f"Tagged root {filename} exceeds {max_metadata_bytes} bytes")
+              tagged_content = tagged_path.read_bytes()
+              if len(tagged_content) != tagged_size:
+                  raise SystemExit(f"Tagged root {filename} changed while it was being read")
+              tagged_metadata[filename] = tagged_content
+
+          try:
+              tagged_project = tomllib.loads(tagged_metadata["pyproject.toml"].decode("utf-8"))
+          except (UnicodeError, ValueError) as error:
+              raise SystemExit(f"Could not parse tagged root pyproject.toml: {error}") from error
+          project = tagged_project.get("project")
+          if not isinstance(project, dict):
+              raise SystemExit("Tagged root pyproject.toml has no valid [project] table")
+          if project.get("name") != "modelaudit" or project.get("version") != version:
+              raise SystemExit(f"Tagged root project does not match modelaudit {version}: {project!r}")
+
+          expected = {f"modelaudit-{version}-py3-none-any.whl", f"modelaudit-{version}.tar.gz"}
+          try:
+              paths = list(Path("dist").iterdir())
+          except OSError as error:
+              raise SystemExit(f"Could not inspect recovered root artifacts: {error}") from error
+          if {path.name for path in paths} != expected or any(not path.is_file() or path.is_symlink() for path in paths):
+              raise SystemExit(f"Expected exactly the root wheel and sdist, found {[path.name for path in paths]!r}")
+
+          try:
+              with urllib.request.urlopen(f"https://pypi.org/pypi/modelaudit/{version}/json", timeout=20) as response:
+                  pypi_metadata = response.read(max_metadata_bytes + 1)
+              if len(pypi_metadata) > max_metadata_bytes:
+                  raise SystemExit(f"PyPI metadata for modelaudit {version} exceeds {max_metadata_bytes} bytes")
+              payload = json.loads(pypi_metadata)
+          except (OSError, ValueError) as error:
+              raise SystemExit(f"Could not verify PyPI metadata for modelaudit {version}: {error}") from error
+          if not isinstance(payload, dict) or not isinstance(payload.get("info"), dict):
+              raise SystemExit(f"PyPI returned invalid modelaudit metadata for {version}")
+          if payload["info"].get("version") != version:
+              raise SystemExit(f"PyPI returned an unexpected modelaudit version for {version}")
+
+          urls = payload.get("urls")
+          if not isinstance(urls, list) or any(
+              not isinstance(entry, dict) or not isinstance(entry.get("filename"), str) for entry in urls
+          ):
+              raise SystemExit(f"PyPI returned an invalid artifact list for modelaudit {version}")
+          published = {entry.get("filename"): entry for entry in urls}
+          if len(published) != len(urls) or set(published) != expected:
+              raise SystemExit(f"PyPI files for modelaudit {version} do not match {sorted(expected)!r}")
+
+          for path in paths:
+              entry = published[path.name]
+              if entry.get("yanked", False):
+                  raise SystemExit(f"Refusing to attest yanked PyPI artifact {path.name}")
+              digests = entry.get("digests")
+              if not isinstance(digests, dict):
+                  raise SystemExit(f"PyPI did not return valid digests for {path.name}")
+              expected_digest = digests.get("sha256")
+              digest = hashlib.sha256()
+              with path.open("rb") as artifact_file:
+                  for chunk in iter(lambda: artifact_file.read(1024 * 1024), b""):
+                      digest.update(chunk)
+              actual_digest = digest.hexdigest()
+              if not isinstance(expected_digest, str) or not re.fullmatch(r"[0-9a-f]{64}", expected_digest):
+                  raise SystemExit(f"PyPI did not return a valid SHA256 for {path.name}")
+              if actual_digest != expected_digest:
+                  raise SystemExit(
+                      f"Recovered artifact SHA256 mismatch for {path.name}: {actual_digest} != {expected_digest}"
+                  )
+              print(f"Verified {path.name}: {actual_digest}")
+
+          required_members = {
+              f"modelaudit-{version}/{filename}": content for filename, content in tagged_metadata.items()
+          }
+          normalized_required_members = {
+              unicodedata.normalize("NFC", unicodedata.normalize("NFC", name).casefold()): name
+              for name in required_members
+          }
+          seen_members = set()
+          seen_paths = set()
+          seen_files = set()
+          seen_parent_paths = set()
+          member_count = 0
+          declared_size = 0
+          try:
+              with tarfile.open(Path("dist", f"modelaudit-{version}.tar.gz"), "r|gz") as archive:
+                  for member in archive:
+                      member_count += 1
+                      if member_count > max_sdist_members:
+                          raise SystemExit(f"Root sdist exceeds {max_sdist_members} members")
+                      if member.size < 0 or member.size > max_sdist_member_bytes:
+                          raise SystemExit(f"Root sdist member has an unsafe size: {member.name}")
+                      declared_size += member.size
+                      if declared_size > max_sdist_bytes:
+                          raise SystemExit(f"Root sdist exceeds {max_sdist_bytes} declared bytes")
+                      if member.issym() or member.islnk():
+                          raise SystemExit(f"Root sdist contains a linked member: {member.name}")
+                      if not member.isreg() and not member.isdir():
+                          raise SystemExit(f"Root sdist contains a non-file member: {member.name}")
+                      member_name = member.name.removesuffix("/") if member.isdir() else member.name
+                      member_parts = member_name.split("/")
+                      if (
+                          member.name.startswith("/")
+                          or re.match(r"^[A-Za-z]:", member.name)
+                          or "\\" in member.name
+                          or any(part in {"", ".", ".."} for part in member_parts)
+                          or any(part.endswith((".", " ")) or ":" in part for part in member_parts)
+                      ):
+                          raise SystemExit(f"Root sdist contains an unsafe member path: {member.name}")
+                      normalized_name = unicodedata.normalize(
+                          "NFC", unicodedata.normalize("NFC", posixpath.normpath(member.name)).casefold()
+                      )
+                      canonical_name = normalized_required_members.get(normalized_name)
+                      if canonical_name is not None and member.name != canonical_name:
+                          raise SystemExit(f"Root sdist contains a metadata path alias: {member.name}")
+                      if normalized_name in seen_paths:
+                          raise SystemExit(f"Root sdist contains a duplicate or case-normalized path: {member.name}")
+                      normalized_parts = normalized_name.split("/")
+                      parent_paths = {
+                          "/".join(normalized_parts[:index]) for index in range(1, len(normalized_parts))
+                      }
+                      if parent_paths & seen_files or member.isreg() and normalized_name in seen_parent_paths:
+                          raise SystemExit(f"Root sdist contains a file/directory path conflict: {member.name}")
+                      seen_paths.add(normalized_name)
+                      seen_parent_paths.update(parent_paths)
+                      if member.isreg():
+                          seen_files.add(normalized_name)
+                      expected_content = required_members.get(member.name)
+                      if expected_content is None:
+                          continue
+                      if member.name in seen_members:
+                          raise SystemExit(f"Duplicate root metadata member in sdist: {member.name}")
+                      seen_members.add(member.name)
+                      if not member.isreg():
+                          raise SystemExit(f"Root metadata member is not a regular file: {member.name}")
+                      if member.size > max_metadata_bytes or member.size != len(expected_content):
+                          raise SystemExit(f"Root metadata member has an unexpected size: {member.name}")
+                      member_file = archive.extractfile(member)
+                      if member_file is None or member_file.read(member.size + 1) != expected_content:
+                          raise SystemExit(f"Root metadata member does not match the release tag: {member.name}")
+          except (OSError, tarfile.TarError) as error:
+              raise SystemExit(f"Could not verify root sdist metadata: {error}") from error
+
+          if seen_members != set(required_members):
+              missing = sorted(set(required_members) - seen_members)
+              raise SystemExit(f"Root sdist is missing tagged metadata: {missing!r}")
+          PY
+
+      - name: Generate recovery integrity attestation
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
+        with:
+          subject-path: |
+            dist/modelaudit-${{ needs.release-please.outputs.version }}-py3-none-any.whl
+            dist/modelaudit-${{ needs.release-please.outputs.version }}.tar.gz
+          predicate-type: https://promptfoo.dev/modelaudit/attestations/recovery/v1
+          predicate: >-
+            {"package":"modelaudit","version":"${{ needs.release-please.outputs.version }}","tag":"${{ needs.release-please.outputs.tag_name }}","source_run_id":"${{ needs.release-please.outputs.root_provenance_run_id }}","source_commit":"${{ steps.verify-source.outputs.source_head_sha }}","tag_commit":"${{ steps.verify-source.outputs.tag_commit_sha }}","pypi_json_url":"https://pypi.org/pypi/modelaudit/${{ needs.release-please.outputs.version }}/json"}
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
+        with:
+          enable-cache: true
+
+      - name: Generate SBOM from tagged root lockfile
+        env:
+          EXPECTED_VERSION: ${{ needs.release-please.outputs.version }}
+        run: |
+          uv export \
+            --frozen \
+            --no-dev \
+            --preview-features sbom-export \
+            --format cyclonedx1.5 \
+            --output-file "dist/modelaudit-${EXPECTED_VERSION}.cdx.json" \
+            > /dev/null
+          echo "SBOM generated:"
+          ls -la dist/*.cdx.json
+
+      - name: Upload recovered root artifacts to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ROOT_TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: |
+          gh release view "$ROOT_TAG" --repo "$GITHUB_REPOSITORY" >/dev/null
+          gh release upload "$ROOT_TAG" dist/* \
+            --repo "$GITHUB_REPOSITORY" \
+            --clobber
+
   picklescan-provenance:
     if: needs.release-please.outputs.picklescan_release_created == 'true'
     needs: [build-picklescan-package, publish-picklescan-pypi, release-please]

modelaudit-0.2.52/.release-please-manifest.json

@@ -0,0 +1,4 @@
+{
+  ".": "0.2.52",
+  "packages/modelaudit-picklescan": "0.1.10"
+}

{modelaudit-0.2.51 → modelaudit-0.2.52}/AGENTS.md

@@ -18,7 +18,7 @@ This repo publishes **two PyPI packages with independent versions**:
 | `modelaudit`            | `./` (root)                       | `pyproject.toml` + `uv.lock`    | `CHANGELOG.md`                                |
 | `modelaudit-picklescan` | `packages/modelaudit-picklescan/` | `pyproject.toml` + `Cargo.toml` | `packages/modelaudit-picklescan/CHANGELOG.md` |
 
-Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.9,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
+Root `modelaudit` hard-requires `modelaudit-picklescan>=0.1.10,<0.2.0` — when the sibling crosses `0.2.0`, bump the constraint in the same PR or the next `modelaudit` release is uninstallable. Both packages are driven by a single `release-please` workflow (`.github/workflows/release-please.yml`) with components defined in `release-please-config.json` and current versions in `.release-please-manifest.json`. Full publishing details — trusted publishing, manual `workflow_dispatch` recovery (`root_version` / `picklescan_version`), and yank procedure — are in [`docs/agents/release-process.md`](docs/agents/release-process.md). For work inside the picklescan package, start from [`packages/modelaudit-picklescan/AGENTS.md`](packages/modelaudit-picklescan/AGENTS.md).
 
 ## Mission & Principles
 

{modelaudit-0.2.51 → modelaudit-0.2.52}/CHANGELOG.md

@@ -5,14 +5,29 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.2.52](https://github.com/promptfoo/modelaudit/compare/v0.2.51...v0.2.52) (2026-07-22)
+
+### Bug Fixes
+
+- **cache:** retry transient identity barrier churn ([#1778](https://github.com/promptfoo/modelaudit/issues/1778)) ([72c8d22](https://github.com/promptfoo/modelaudit/commit/72c8d228876ef90f861ebdc58773dc3184d09548))
+- **deps:** update GitPython to 3.1.51 ([#1774](https://github.com/promptfoo/modelaudit/issues/1774)) ([e9b331b](https://github.com/promptfoo/modelaudit/commit/e9b331b06cf0b48faa561493fb1a695fd9d3dc5c))
+- **deps:** update pyasn1 to 0.6.4 ([#1772](https://github.com/promptfoo/modelaudit/issues/1772)) ([df81361](https://github.com/promptfoo/modelaudit/commit/df81361f6df8e10a22ac71f81ee2ca15f0fcc12a))
+- **deps:** update setuptools to 83.0.0 ([#1773](https://github.com/promptfoo/modelaudit/issues/1773)) ([8c805ff](https://github.com/promptfoo/modelaudit/commit/8c805fff4a6edf5f913f2cf23c5e04dde6567b9c))
+- harden GGUF/ZIP polyglot detection ([#1775](https://github.com/promptfoo/modelaudit/issues/1775)) ([665ed3a](https://github.com/promptfoo/modelaudit/commit/665ed3ab7c452f639c74e976c23ff0b92ea746d0))
+- harden LZ4-compressed Joblib inspection ([#1776](https://github.com/promptfoo/modelaudit/issues/1776)) ([fac0ede](https://github.com/promptfoo/modelaudit/commit/fac0edee89427e05cff7d8dffec343c1140c7755)); thanks to @PowerliftLog for the report
+- keep root-only release branches componentless ([#1766](https://github.com/promptfoo/modelaudit/issues/1766)) ([9b8c2ce](https://github.com/promptfoo/modelaudit/commit/9b8c2ce04388bc0b1d57d51d7cdad726ad27a9e6))
+- **picklescan:** recognize uv bytes-encoded package overlays ([#1777](https://github.com/promptfoo/modelaudit/issues/1777)) ([e9910fa](https://github.com/promptfoo/modelaudit/commit/e9910fac59db6fe0d286504cc6b85ac380617e0a))
+- recover root release provenance safely ([#1770](https://github.com/promptfoo/modelaudit/issues/1770)) ([1e0dcb6](https://github.com/promptfoo/modelaudit/commit/1e0dcb6e273a13aaa86f36a39b4586b0d2e3a97a))
+- resolve CodeQL quality and logging findings ([#1769](https://github.com/promptfoo/modelaudit/issues/1769)) ([573bbd8](https://github.com/promptfoo/modelaudit/commit/573bbd859501147413b2804df09299dc749e3e0c))
+
 ## [0.2.51](https://github.com/promptfoo/modelaudit/compare/v0.2.50...v0.2.51) (2026-07-20)
 
 ### Bug Fixes
 
 - recover root release build and PyPI smoke gates ([#1764](https://github.com/promptfoo/modelaudit/issues/1764)) ([fa350d9](https://github.com/promptfoo/modelaudit/commit/fa350d96d2e00e0d54c47f282b7f8e0f9660e077))
 
-## [Unreleased]
-
 ## [0.2.50](https://github.com/promptfoo/modelaudit/compare/v0.2.49...v0.2.50) (2026-07-20)
 
 ### Security
@@ -2530,7 +2545,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **style**: improve code formatting and documentation standards (#12, #23)
 - **fix**: improve core scanner functionality and comprehensive test coverage (#11)
 
-[unreleased]: https://github.com/promptfoo/modelaudit/compare/v0.2.37...HEAD
+[unreleased]: https://github.com/promptfoo/modelaudit/compare/v0.2.52...HEAD
 [0.2.25]: https://github.com/promptfoo/modelaudit/compare/v0.2.24...v0.2.25
 [0.2.24]: https://github.com/promptfoo/modelaudit/compare/v0.2.23...v0.2.24
 [0.2.23]: https://github.com/promptfoo/modelaudit/compare/v0.2.22...v0.2.23

{modelaudit-0.2.51 → modelaudit-0.2.52}/Dockerfile.full

@@ -61,7 +61,7 @@ RUN pip install --no-cache-dir \
 RUN pip install --no-cache-dir \
     "torch>=2.13.0,<3.0" --index-url https://download.pytorch.org/whl/cpu
 
-RUN pip install --no-cache-dir "setuptools>=78.1.1,<82"
+RUN pip install --no-cache-dir "setuptools>=83.0.0,<84"
 
 ARG UID=10001
 RUN adduser \

{modelaudit-0.2.51 → modelaudit-0.2.52}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: modelaudit
-Version: 0.2.51
+Version: 0.2.52
 Summary: Static scanning library for detecting malicious code, potential backdoor indicators, and other security risks in ML model files
 Project-URL: Repository, https://github.com/promptfoo/modelaudit
 Project-URL: Homepage, https://github.com/promptfoo/modelaudit
@@ -27,7 +27,7 @@ Requires-Dist: defusedxml>=0.7.1
 Requires-Dist: fsspec>=2025.5.1
 Requires-Dist: gcsfs>=2025.5.1
 Requires-Dist: huggingface-hub>=0.23.0
-Requires-Dist: modelaudit-picklescan<0.2.0,>=0.1.9
+Requires-Dist: modelaudit-picklescan<0.2.0,>=0.1.10
 Requires-Dist: msgpack<2.0,>=1.2.1
 Requires-Dist: numpy<2.0,>=1.19.0; python_version == '3.10'
 Requires-Dist: numpy<2.5,>=2.4.3; python_version == '3.11'

{modelaudit-0.2.51 → modelaudit-0.2.52}/docs/agents/release-process.md

@@ -9,14 +9,16 @@ This repo is a monorepo with **two independently versioned PyPI packages**:
 
 Both packages are driven by a single [release-please](https://github.com/googleapis/release-please) workflow (`.github/workflows/release-please.yml`) with two components declared in `release-please-config.json` and current versions pinned in `.release-please-manifest.json`.
 
-The root `modelaudit` wheel declares a **hard dependency** on `modelaudit-picklescan>=0.1.9,<0.2.0` in `pyproject.toml`. When the sibling version crosses `0.2.0`, the constraint must be bumped in the same PR.
+The root release intentionally omits `package-name` and `component`. Release-please reads `project.name` from `pyproject.toml` for Python updates, while the empty branch component lets a root-only grouped Release PR match `release-please--branches--main` and keeps the existing `v{X.Y.Z}` tags. Restoring a non-empty `package-name` or `component` makes root-only releases look like a different component and silently skips publication after merge.
+
+The root `modelaudit` wheel declares a **hard dependency** on `modelaudit-picklescan>=0.1.10,<0.2.0` in `pyproject.toml`. When the sibling version crosses `0.2.0`, the constraint must be bumped in the same PR.
 
 ## Normal flow
 
 1. **Write Conventional Commits** — `feat:`, `fix:`, `docs:`, etc. Release-please uses these to compute the next version and the changelog entry.
 2. **Merge to `main`** — release-please creates or updates a "Release PR" per changed component. Commits that only touch `packages/modelaudit-picklescan/` feed the picklescan component; everything else feeds the root component.
 3. **Review and merge the Release PR** — release-please tags the release and the workflow runs the matching publish jobs:
-   - **For `modelaudit`** — `build` produces sdist+wheel → `publish-pypi` uploads via OIDC → `provenance` attests and uploads SBOM.
+   - **For `modelaudit`** — `build` produces sdist+wheel → `publish-pypi` uploads via OIDC → `verify-pypi` confirms the published package → `provenance` attests and uploads SBOM.
    - **For `modelaudit-picklescan`** — `build-picklescan-package` matrix builds 5 native wheels (Linux x86_64, Linux aarch64, macOS arm64, macOS x86_64, Windows x64) + sdist → `publish-picklescan-pypi` uploads → `picklescan-provenance` attests.
    - **When both release together** — the sibling package is published and verified on PyPI before the dependent root package is uploaded.
 
@@ -57,6 +59,16 @@ gh workflow run release-please.yml -f picklescan_version=<X.Y.Z>
 
 The workflow's `Resolve manual release inputs` step flips `manual_release=true`, skips the release-please action, ensures the GitHub release exists (creating it if not), then feeds `release_created=true` / `picklescan_release_created=true` into the publish jobs. `uv build` always reads from `pyproject.toml` at the current `HEAD`, so the tagged commit must already contain the target version; dispatching a version that does not match what's in `HEAD` will fail the PyPI upload.
 
+If root publication and PyPI verification succeeded but `provenance` was skipped or failed, do **not** re-run the publish path: PyPI filenames are immutable and a rebuilt artifact may not match the published bytes. Recover provenance from the original verified publish run instead:
+
+```bash
+gh workflow run release-please.yml --ref main \
+  -f root_version=<X.Y.Z> \
+  -f root_provenance_run_id=<original-run-id>
+```
+
+This provenance-only path skips release creation, builds, and publication. It checks out the fully qualified `refs/tags/v<X.Y.Z>` ref, verifies that the source is a completed release-please push or manual run from this repository with successful `build`, `publish-pypi`, and `verify-pypi` jobs, and requires both the source run's immutable head commit and the checked-out tag commit to be ancestors of the protected `main` branch before downloading the original `dist` artifact. The tag must also be an ancestor of the source run; only `.github/workflows/release-please.yml` and `tests/test_release_workflow.py` may differ, including both sides of any rename, accommodating a release-build repair without allowing runtime source drift. This prevents a branch-dispatched workflow with fabricated release jobs or a moved tag from being signed as trusted. An overall `failure` conclusion is accepted so a failed `provenance` job can be recovered; cancelled, incomplete, or diverged source runs and tags are rejected. The wheel and sdist are hashed in bounded chunks and must exactly match the non-yanked PyPI SHA256 digests. The bounded sdist may contain only regular files and directories with safe paths; links, special files, duplicate paths, case or Unicode aliases, and file/directory conflicts are rejected, and it must contain exactly one `pyproject.toml` and `uv.lock` whose bytes match the tag. The workflow then generates a recovery-integrity attestation recording both immutable commits and an SBOM from the frozen lockfile, and uploads the files to the matching GitHub Release. The recovery attestation does **not** claim original SLSA build provenance; the original PyPI publish attestations remain the publisher record. The source run ID must be numeric, `root_version` must use `X.Y.Z`, and `picklescan_version` cannot be combined with this recovery mode.
+
 ## PyPI trusted publishing (first-time setup)
 
 Both packages publish via PyPI [Trusted Publishing](https://docs.pypi.org/trusted-publishers/). The `publish-pypi` and `publish-picklescan-pypi` jobs both use environment `pypi` and `id-token: write` permissions. PyPI is configured with an **active trusted publisher** on each project, scoped to owner `promptfoo`, repository `modelaudit`, workflow `release-please.yml`, environment `pypi`.

{modelaudit-0.2.51 → modelaudit-0.2.52}/docs/user/compatibility-matrix.md

@@ -13,6 +13,7 @@ This page shows which model formats work in base install and which require optio
 | Format family                   | Common extensions                                                                           | Base install                                              | Optional dependency / extra                                                                      |
 | ------------------------------- | ------------------------------------------------------------------------------------------- | --------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
 | Pickle family                   | `.pkl`, `.pickle`, `.dill`                                                                  | Yes                                                       | `modelaudit[dill]` for broader dill compatibility                                                |
+| Joblib                          | `.joblib`                                                                                   | Yes (bounded raw and compressed pickle analysis)          | `lz4` package optional only for LZ4-compressed `.joblib` payload decompression                   |
 | PyTorch archive/binary          | `.pt`, `.pth`, `.ckpt`, `.bin`                                                              | Yes (static archive/pickle checks)                        | `modelaudit[pytorch]` optional for broader Torch ecosystem tooling                               |
 | NumPy                           | `.npy`, `.npz`                                                                              | Yes                                                       | None                                                                                             |
 | R serialized                    | `.rds`, `.rda`, `.rdata`, signature-valid renamed workspace files                           | Yes (static analysis only)                                | None                                                                                             |

{modelaudit-0.2.51 → modelaudit-0.2.52}/modelaudit/cache/scan_results_cache.py

@@ -931,7 +931,9 @@ class ScanResultsCache:
                 preliminary_change_token = initial_change_token
                 preliminary_ancestor_identity = initial_ancestor_identity
             else:
-                raise ValueError(f"File kept changing while capturing cache identity: {file_path}")
+                last_change_error = ValueError(f"Cache identity barrier did not settle: {file_path}")
+                time.sleep(0.01)
+                continue
 
             monitored_ancestor_identity = self._monitor_ancestor_identity(file_path, initial_ancestor_identity)
             try: