Repository navigation
Conversation
Sensitive Change Detection (shadow mode)This PR modifies control-plane files:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Reply to a comment to ask cubic a question or push back. It learns from your replies.
View guided diff | Re-trigger cubic
There was a problem hiding this comment.
🔵 Needs a closer look
The production OIDC signing and release-upload path was not exercised and warrants human release-security review.
0 open findings
What changed in this PR
Adds optional signed Packslip manifests to releases without changing existing publication dependencies.
Changes:
- Signs metadata for archives, completions, and the version-matched agent skill.
- Separates signing and release-upload permissions.
- Adds workflow contract tests for ordering and failure isolation.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
| File | Description |
|---|---|
.github/workflows/release.yml |
Adds isolated Packslip signing and upload jobs. |
tests/e2e/release_workflow.bats |
Tests ordering, failure gating, and permission separation. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Add an optional signed Packslip manifest to HEY releases, describing the existing archives, their packaged completions, and the release-matched
heyagent skill.mise currently installs HEY through its GitHub backend, which already verifies build attestations. This adds explicit platform, archive, and executable mappings published with each release, so installers can use HEY-owned metadata rather than infer the layout from filenames. It preserves the existing archives and their signing.
The manifest exposes the packaged Bash, Zsh, and Fish completions and the complete skill from the release's source commit. Activated mise can use the completions;
mise skills synclinks the skill for the installed version. The mise tool page gives consumer context.The v1 format is intended to remain supported for years; release-workflow or security changes can still require maintenance. Please reshape the integration or omit resources that aren't useful. Reuse by other installers, including DotSlash, is a future goal.
Implementation and validation
make checkpassed in a non-root Go 1.27 container; six release-workflow Bats contracts passed. YAML parsing confirmed every existing job unchanged. ShellCheck passed and Zizmor 1.30.1 reported no findings.Local signing used a throwaway key; production vendor OIDC signing/upload and non-Linux binary execution were not exercised. No release or registry switch is included. A registry change would follow the first verified signed release and successful mise discovery, retaining the old backend for earlier versions.
AI assistance: OpenAI Codex.
Summary by cubic
Publishes an optional signed Packslip manifest with each HEY release, describing the existing archives, the packaged Bash/Zsh/Fish completions, and the skill from the release's source commit. mise already installs HEY through its GitHub backend with attestation verification; this adds explicit platform, archive, and executable mappings so installers can use HEY-owned metadata instead of inferring layout from filenames.
Implementation
Written for commit c35ffb4. Summary will update on new commits.