trustcheck 2.1.2__tar.gz → 2.2.0__tar.gz

trustcheck-2.2.0/.github/workflows/acceptance-matrix.yml

@@ -0,0 +1,56 @@
+name: Acceptance Matrix
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "47 4 * * *"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: acceptance-matrix-main
+  cancel-in-progress: false
+
+jobs:
+  acceptance:
+    name: ${{ matrix.case }} / ${{ matrix.os }} / Python ${{ matrix.python-version }}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
+        case: [pip-tools, uv-lock, poetry-lock, pdm-lock, pep751-pylock, extras-markers, private-index-fixture, native-wheel, sdist]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+
+      - name: Install acceptance environment
+        run: |
+          python -m pip install --disable-pip-version-check --require-hashes --requirement requirements/runtime.lock
+          python -m pip install --disable-pip-version-check --no-build-isolation --no-deps -e .
+          python -m pip check
+
+      - name: Run acceptance case
+        env:
+          TRUSTCHECK_RUN_ACCEPTANCE: "1"
+        run: python scripts/acceptance_matrix.py --case "${{ matrix.case }}" --report-dir acceptance-reports
+
+      - name: Upload acceptance report
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: acceptance-${{ matrix.case }}-${{ matrix.os }}-py${{ matrix.python-version }}
+          path: acceptance-reports/
+          if-no-files-found: warn

{trustcheck-2.1.2 → trustcheck-2.2.0}/.github/workflows/benchmarks.yml

@@ -2,6 +2,11 @@ name: Benchmarks
 
 on:
   workflow_dispatch:
+  schedule:
+    - cron: "23 4 * * 1"
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
 
 permissions:
   contents: read
@@ -12,6 +17,7 @@ concurrency:
 
 jobs:
   pip-audit-comparison:
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:

{trustcheck-2.1.2 → trustcheck-2.2.0}/.github/workflows/ci.yml

@@ -248,11 +248,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -279,7 +279,7 @@ jobs:
 
       - name: Build and publish CI Docker image
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile

{trustcheck-2.1.2 → trustcheck-2.2.0}/.github/workflows/codeql.yml

@@ -25,7 +25,7 @@ jobs:
           fetch-depth: 0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           languages: python
 
@@ -35,7 +35,7 @@ jobs:
           python-version: "3.12"
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/autobuild@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4

trustcheck-2.2.0/.github/workflows/plagiarism-scan.yml

@@ -0,0 +1,128 @@
+name: GitHub Code Copy Scan
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "37 3 * * *"
+
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
+
+concurrency:
+  group: github-code-copy-scan
+  cancel-in-progress: false
+
+jobs:
+  scan:
+    name: Search GitHub for copied code
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Search public GitHub code
+        env:
+          GITHUB_TOKEN: ${{ secrets.TRUSTCHECK_GITHUB_SEARCH_TOKEN || github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          python scripts/github_plagiarism_scan.py \
+            --source src/trustcheck \
+            --output reports/github-code-copy-findings.md \
+            --max-fingerprints 20 \
+            --per-page 10
+
+      - name: Open or update findings pull request or issue
+        env:
+          BRANCH: automation/github-code-copy-findings
+          GH_TOKEN: ${{ secrets.TRUSTCHECK_PR_TOKEN || github.token }}
+          ISSUE_TITLE: GitHub code copy scan findings
+          REPORT_PATH: reports/github-code-copy-findings.md
+        run: |
+          if [ -z "$(git status --porcelain -- "$REPORT_PATH")" ]; then
+            echo "No code-copy finding changes to publish."
+            exit 0
+          fi
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git checkout -B "$BRANCH"
+          git add "$REPORT_PATH"
+          git commit -m "Update GitHub code copy scan findings"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git push --force-with-lease origin "$BRANCH"
+
+          existing_pr="$(gh pr list --head "$BRANCH" --state open --json number --jq '.[0].number // empty')"
+          if [ -n "$existing_pr" ]; then
+            gh pr edit "$existing_pr" \
+              --title "Update GitHub code copy scan findings" \
+              --body-file "$REPORT_PATH"
+          else
+            pr_url="https://github.com/${GITHUB_REPOSITORY}/pull/new/${BRANCH}"
+            create_error="$(mktemp)"
+            if gh pr create \
+              --base main \
+              --head "$BRANCH" \
+              --title "Update GitHub code copy scan findings" \
+              --body-file "$REPORT_PATH" \
+              2>"$create_error"; then
+              exit 0
+            fi
+
+            cat "$create_error"
+            if grep -q "not permitted to create" "$create_error"; then
+              issue_body="$(mktemp)"
+              {
+                echo "GitHub Actions pushed the code-copy findings branch, but this repository does not permit Actions to create pull requests."
+                echo
+                echo "Findings branch: https://github.com/${GITHUB_REPOSITORY}/tree/${BRANCH}"
+                echo
+                echo "Manual pull request URL: ${pr_url}"
+                echo
+                cat "$REPORT_PATH"
+              } > "$issue_body"
+
+              existing_issue="$(
+                gh issue list \
+                  --state open \
+                  --search "${ISSUE_TITLE} in:title" \
+                  --json number,title \
+                  --jq ".[] | select(.title == \"${ISSUE_TITLE}\") | .number" \
+                | head -n 1
+              )"
+              if [ -n "$existing_issue" ]; then
+                gh issue edit "$existing_issue" \
+                  --title "$ISSUE_TITLE" \
+                  --body-file "$issue_body"
+                issue_url="https://github.com/${GITHUB_REPOSITORY}/issues/${existing_issue}"
+              else
+                issue_url="$(
+                  gh issue create \
+                    --title "$ISSUE_TITLE" \
+                    --body-file "$issue_body"
+                )"
+              fi
+
+              {
+                echo "### GitHub code copy scan findings"
+                echo
+                echo "The findings branch was pushed, but GitHub Actions is not permitted to create pull requests in this repository."
+                echo
+                echo "Issue: ${issue_url}"
+                echo
+                echo "Manual pull request URL: ${pr_url}"
+              } >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+            fi
+            exit 1
+          fi

trustcheck-2.2.0/.github/workflows/post-release-parity.yml

@@ -0,0 +1,90 @@
+name: Post-release Channel Parity
+
+on:
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Release tag to verify, such as v2.1.1.
+        required: true
+      observed-json:
+        description: URL or repository path for normalized channel observations.
+        required: true
+
+permissions:
+  contents: read
+
+jobs:
+  verify-release-channels:
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Resolve release parity inputs
+        id: release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          INPUT_TAG: ${{ github.event.inputs.tag }}
+          INPUT_OBSERVED_JSON: ${{ github.event.inputs.observed-json }}
+          RELEASE_CHANNEL_OBSERVATIONS_URL: ${{ vars.RELEASE_CHANNEL_OBSERVATIONS_URL }}
+        run: |
+          tag="${INPUT_TAG:-}"
+          if [ -z "$tag" ]; then
+            tag="$(gh release list --limit 1 --json tagName --jq '.[0].tagName')"
+          fi
+          if [ -z "$tag" ]; then
+            echo "Unable to determine the release tag to verify." >&2
+            exit 1
+          fi
+          observed_json="${INPUT_OBSERVED_JSON:-$RELEASE_CHANNEL_OBSERVATIONS_URL}"
+          if [ -z "$observed_json" ]; then
+            echo "Set workflow input observed-json or repository variable RELEASE_CHANNEL_OBSERVATIONS_URL." >&2
+            exit 1
+          fi
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
+          echo "observed_json=$observed_json" >> "$GITHUB_OUTPUT"
+
+      - name: Download release checksums
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+        run: gh release download "$RELEASE_TAG" --pattern SHA256SUMS.txt --repo "$GITHUB_REPOSITORY"
+
+      - name: Verify channel parity
+        env:
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
+          RELEASE_VERSION: ${{ steps.release.outputs.version }}
+          OBSERVED_JSON: ${{ steps.release.outputs.observed_json }}
+        run: |
+          python scripts/verify_release_channels.py \
+            --expected-version "$RELEASE_VERSION" \
+            --tag "$RELEASE_TAG" \
+            --expected-checksums SHA256SUMS.txt \
+            --required-channel pypi \
+            --required-channel github \
+            --required-channel snap \
+            --required-channel docker \
+            --required-channel homebrew \
+            --required-channel winget \
+            --expected-architecture docker=linux/amd64 \
+            --expected-architecture docker=linux/arm64 \
+            --expected-architecture docker=linux/arm/v7 \
+            --expected-architecture snap=amd64 \
+            --expected-architecture snap=arm64 \
+            --expected-architecture snap=armhf \
+            --expected-architecture github=windows-x86_64 \
+            --release-notes-fragment "Published from immutable commit" \
+            --observed-json "$OBSERVED_JSON"

{trustcheck-2.1.2 → trustcheck-2.2.0}/.github/workflows/publish.yml

@@ -852,13 +852,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU for multi-platform builds
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -891,7 +891,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Build and publish multi-platform Docker images
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile

{trustcheck-2.1.2 → trustcheck-2.2.0}/.github/workflows/sarif-integration.yml

@@ -58,7 +58,7 @@ jobs:
           --compare trustcheck-second.sarif
 
       - name: Upload SARIF to GitHub code scanning
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+        uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4
         with:
           sarif_file: trustcheck-first.sarif
           category: trustcheck-sarif-integration

{trustcheck-2.1.2 → trustcheck-2.2.0}/CHANGELOG.md

@@ -6,14 +6,33 @@ The project follows Semantic Versioning for the supported public API described i
 
 ## Unreleased
 
+## [2.2.0] - 2026-07-05
+
+Package release `2.2.0` emits machine-readable report schema `1.11.0`.
+
 ### Added
 
-- Added calibrated malicious-package heuristic metadata, policy-configurable
+- Added malicious-package heuristic rule metadata, policy-configurable
   aggregate and per-rule thresholds, and advanced the schema to `1.11.0`.
 - Added opt-in `--dynamic-analysis` execution in a disposable, no-network,
   non-root Docker sandbox with CPU, memory, process, and wall-clock limits.
+- Added `trustcheck manifest init|verify|update` for dependency trust
+  baselines that block repository, Trusted Publisher, SLSA, provenance,
+  index-origin, native-binary, dynamic-execution, and malicious-score
+  regressions.
+- Added `trustcheck diff` for lockfile and pull-request trust review across
+  changed direct and transitive packages, with text, JSON, Markdown, SARIF,
+  Git ref discovery, GitHub PR commenting, and optional trust-manifest
+  enforcement.
+- Added `trustcheck doctor`, concise `--summary`/`--decision` report output,
+  source/release provenance parity checks, starter policy bundles, and a
+  post-release channel parity verifier workflow.
 - Added a pinned GitHub Dependency Review pull-request gate for vulnerable
   dependency.
+- Strengthened `scan --fix` to target policy-failing packages, validate the
+  generated graph in a clean virtual environment, run
+  `[tool.trustcheck.fix].test_commands`, support `requirements.lock`, and write
+  a review patch artifact; advanced the remediation schema to `1.3.0`.
 
 ### Changed
 
@@ -24,6 +43,15 @@ The project follows Semantic Versioning for the supported public API described i
   Sigstore requirements `PyJWT`, `idna`, and `tuf`; the action lockfile still
   constrains the resolved transitive set.
 
+## [2.1.2] - 2026-07-01
+
+Package release `2.1.2` emits machine-readable report schema `1.11.0`.
+
+### Changed
+
+- Corrected the changelog description for the pinned GitHub Dependency Review
+  pull-request gate.
+
 ## [2.1.1] - 2026-06-28
 
 Package release `2.1.1` emits machine-readable report schema `1.11.0`.
@@ -244,7 +272,9 @@ Package release `1.9.0` emits machine-readable report schema `1.4.0`.
 - Aligned the README, documentation site, CLI help, changelog, and JSON contract documentation around the same supported feature set.
 - Replaced temporary Discord issue and security links with stable GitHub project pages and private vulnerability reporting.
 
-[Unreleased]: https://github.com/Halfblood-Prince/trustcheck/compare/v2.1.1...HEAD
+[Unreleased]: https://github.com/Halfblood-Prince/trustcheck/compare/v2.2.0...HEAD
+[2.2.0]: https://github.com/Halfblood-Prince/trustcheck/compare/v2.1.2...v2.2.0
+[2.1.2]: https://github.com/Halfblood-Prince/trustcheck/compare/v2.1.1...v2.1.2
 [2.1.1]: https://github.com/Halfblood-Prince/trustcheck/compare/v2.1.0...v2.1.1
 [2.1.0]: https://github.com/Halfblood-Prince/trustcheck/compare/v2.0.5...v2.1.0
 [1.9.0]: https://github.com/Halfblood-Prince/trustcheck/compare/v1.8.0...v1.9.0

trustcheck-2.2.0/MANIFEST.in

@@ -0,0 +1,2 @@
+include scripts/verify_release_version.py
+include scripts/verify_release_channels.py