fix: address release workflow review findings

Author: elkaix

.github/workflows/_native-build.yml

@@ -66,6 +66,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # pinned from v6

.github/workflows/nightly.yml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # pinned from v6
@@ -70,6 +71,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned from v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # pinned from v7.0.0

.github/workflows/release.yml

@@ -311,6 +311,7 @@ jobs:
         with:
           app-id: ${{ vars.RELEASE_BOT_APP_ID }}
           private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
+          permission-contents: write
 
       - name: Cut required desktop tag
         env:

scripts/release/release-status.test.mjs

@@ -35,30 +35,30 @@ function json(body, status = 200) {
 
 function fixtureFetch({ cliAssets = expectedCliAssets } = {}) {
   return async (input) => {
-    const url = String(input);
-    if (url.includes('registry.npmjs.org')) return json({ latest: '1.3.0' });
-    if (url.includes('code.pythinker.com')) {
+    const url = new URL(String(input));
+    if (url.hostname === 'registry.npmjs.org') return json({ latest: '1.3.0' });
+    if (url.hostname === 'code.pythinker.com') {
       return json({
         version: '1.3.0',
         platforms: Object.fromEntries(nativeTargets.map((target) => [target, {}])),
       });
     }
-    if (url.includes('/pythinker-code/releases/tags/')) {
+    if (url.hostname === 'api.github.com' && url.pathname.startsWith('/repos/PyModel/pythinker-code/releases/tags/')) {
       return json({
         tag_name: '@pymodel/pythinker-code@1.3.0',
         assets: cliAssets.map((name) => ({ name })),
       });
     }
-    if (url.endsWith('/pythinker-desktop-releases/releases/latest')) {
+    if (url.hostname === 'api.github.com' && url.pathname === '/repos/PyModel/pythinker-desktop-releases/releases/latest') {
       return json({ tag_name: 'v0.2.1', assets: [{ name: 'latest.yml' }] });
     }
-    if (url.includes('open-vsx.org')) {
+    if (url.hostname === 'open-vsx.org') {
       return json({
         version: '0.9.5',
         downloads: Object.fromEntries(nativeTargets.map((target) => [target, `https://${target}`])),
       });
     }
-    if (url.includes('marketplace.visualstudio.com')) {
+    if (url.hostname === 'marketplace.visualstudio.com') {
       return json({
         results: [{
           extensions: [{
@@ -71,6 +71,14 @@ function fixtureFetch({ cliAssets = expectedCliAssets } = {}) {
   };
 }
 
+void test('fixture routing rejects trusted hostnames outside the URL host', async () => {
+  const response = await fixtureFetch()(
+    'https://example.test/registry.npmjs.org/code.pythinker.com/open-vsx.org/marketplace.visualstudio.com',
+  );
+
+  assert.equal(response.status, 404);
+});
+
 void test('reports all live release lanes aligned', async (t) => {
   const rootDir = await fixtureRoot(t);
   const result = await collectReleaseStatus({ rootDir, fetchImpl: fixtureFetch() });

scripts/release/release-workflows.test.mjs

@@ -8,12 +8,17 @@ const read = (path) => readFileSync(resolve(root, path), 'utf8');
 
 void test('release workflow uses full push-boundary lane signals and isolated jobs', () => {
   const workflow = read('.github/workflows/release.yml');
+  const desktopJob = workflow.slice(
+    workflow.indexOf('  cut-desktop-tag:'),
+    workflow.indexOf('  publish-vscode-extension:'),
+  );
   assert.match(workflow, /github\.event\.before/u);
   assert.match(workflow, /pythinker_native_release:.*cli_version_bumped/u);
   assert.match(workflow, /^  cut-desktop-tag:/mu);
   assert.match(workflow, /uses: \.\/\.github\/workflows\/vscode-release\.yml/u);
   assert.match(workflow, /^  release-summary:/mu);
   assert.doesNotMatch(workflow, /HEAD\^:apps\/vscode\/package\.json/u);
+  assert.match(desktopJob, /permission-contents: write/u);
   assert.match(workflow, /pythinker_release_tag: \$\{\{ steps\.pythinker-release\.outputs\.tag \|\|/u);
   assert.match(workflow, /APPLE_CERTIFICATE_P12: \$\{\{ secrets\.MAC_CSC_LINK \}\}/u);
   assert.match(workflow, /APPLE_NOTARIZATION_KEY_P8: \$\{\{ secrets\.APPLE_API_KEY_P8 \}\}/u);
@@ -35,6 +40,7 @@ void test('native releases fail without requested signing and attest each zip',
   assert.match(workflow, /actions\/attest@[0-9a-f]{40}/u);
   assert.match(workflow, /if-no-files-found: error/u);
   assert.doesNotMatch(workflow, /uses: actions\/(checkout|setup-node|upload-artifact)@v\d+/u);
+  assert.equal(workflow.match(/persist-credentials: false/gu)?.length, 1);
   assert.match(manualWorkflow, /id-token: write/u);
   assert.match(manualWorkflow, /attestations: write/u);
   assert.match(manualWorkflow, /artifact-metadata: write/u);
@@ -46,4 +52,5 @@ void test('nightly reconciliation maintains one release drift issue', () => {
   assert.match(workflow, /Release lane drift detected/u);
   assert.match(workflow, /issues: write/u);
   assert.doesNotMatch(workflow, /uses: actions\/(checkout|setup-node)@v\d+/u);
+  assert.equal(workflow.match(/persist-credentials: false/gu)?.length, 2);
 });