fix(#122): repair the two-scale relaxation window instead of disclosing it

.github/scripts/check_workflow_hardening.py

@@ -14,7 +14,14 @@
 ROOT = Path(__file__).resolve().parents[2]
 WORKFLOWS = ROOT / ".github" / "workflows"
 FULL_SHA_RE = re.compile(r"^[0-9a-f]{40}$", re.IGNORECASE)
-USES_RE = re.compile(r"^\s*uses:\s*([^\s#]+)")
+# Container images pin by digest, which is a different shape from a git SHA.
+DIGEST_RE = re.compile(r"^sha256:[0-9a-f]{64}$", re.IGNORECASE)
+# ``- uses:`` (list form) is the commonest way to write a step, and the
+# previous pattern did not match it: 7 of 27 refs in this tree were
+# invisible to the gate, including every ``actions/checkout``. They were
+# pinned by discipline, not by this check. Proven as a pair -- the same
+# unpinned ref passes in list form and is caught in block form.
+USES_RE = re.compile(r"^\s*(?:-\s*)?uses:\s*([^\s#]+)")
 
 
 def _iter_workflow_files() -> list[Path]:
@@ -28,11 +35,23 @@ def _iter_workflow_files() -> list[Path]:
 
 
 def _is_third_party_uses(ref: str) -> bool:
-    return not (
-        ref.startswith("./")
-        or ref.startswith("docker://")
-        or ref.startswith("github.com/")
-    )
+    """Which refs must carry a pin.
+
+    ``docker://`` was exempt outright, so ``docker://org/img:latest`` -- a
+    mutable tag from a third party -- passed the gate. It is exempt only
+    when it carries an immutable digest. The former ``github.com/``
+    exemption was dead code: ``uses:`` does not accept that prefix, and a
+    GitHub owner name cannot contain a dot, so no such org can exist. It
+    also tripped a CodeQL incomplete-substring alert, which is how it was
+    found.
+    """
+    if ref.startswith("./"):
+        return False
+    if ref.startswith("docker://"):
+        # Third party either way. Whether the pin is adequate is decided
+        # in _check_uses_pin, which alone sees the ref undivided.
+        return True
+    return True
 
 
 def _check_uses_pin(path: Path, line_number: int, line: str, errors: list[str]) -> None:
@@ -49,24 +68,57 @@ def _check_uses_pin(path: Path, line_number: int, line: str, errors: list[str])
     action, version = ref.rsplit("@", 1)
     if not _is_third_party_uses(action):
         return
+    if action.startswith("docker://"):
+        # A container pins by image digest, not by a git SHA. Requiring the
+        # git form here would reject the very thing the rule asks for.
+        if not DIGEST_RE.fullmatch(version):
+            errors.append(
+                f"{path}:{line_number}: container must be pinned to an "
+                f"immutable @sha256: digest, got {ref}"
+            )
+        return
     if not FULL_SHA_RE.fullmatch(version):
         errors.append(
             f"{path}:{line_number}: action must be pinned to a full 40-char SHA, got {ref}"
         )
 
 
 def _check_privileged_trigger(path: Path, text: str, errors: list[str]) -> None:
-    if "pull_request_target" in text and "ALLOW_PULL_REQUEST_TARGET:" not in text:
+    """The rationale must be a real key, not the words in a comment.
+
+    ``"ALLOW_PULL_REQUEST_TARGET:" in text`` was satisfied by any
+    occurrence -- including one inside a ``#`` comment, i.e. by writing the
+    name of the waiver rather than declaring it.
+    """
+    uncommented = chr(10).join(
+        line.split("#", 1)[0] for line in text.splitlines()
+    )
+    if "pull_request_target" in uncommented and (
+        "ALLOW_PULL_REQUEST_TARGET:" not in uncommented
+    ):
         errors.append(
             f"{path}: uses pull_request_target without ALLOW_PULL_REQUEST_TARGET rationale"
         )
 
 
 def _check_permissions_declared(path: Path, text: str, errors: list[str]) -> None:
-    # Minimal parser: require an explicit top-level permissions key before jobs.
+    """Require a top-level permissions block AND check what it grants.
+
+    Presence alone was the whole test, so ``permissions: write-all``
+    satisfied it -- a declaration of total access counted as evidence of
+    least privilege.
+    """
     before_jobs = text.split("\njobs:", 1)[0]
     if "\npermissions:" not in f"\n{before_jobs}":
         errors.append(f"{path}: missing explicit top-level permissions block")
+        return
+    for number, line in enumerate(text.splitlines(), start=1):
+        stripped = line.split("#", 1)[0].strip()
+        if stripped in {"permissions: write-all", "permissions: read-all"}:
+            errors.append(
+                f"{path}:{number}: blanket '{stripped}' -- grant the "
+                f"individual scopes the workflow needs instead"
+            )
 
 
 def main() -> int:

.github/workflows/pypi.yml

@@ -71,6 +71,7 @@ jobs:
       url: https://pypi.org/p/liouscope
     permissions:
       id-token: write
+      attestations: write
       contents: read
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
@@ -103,6 +104,18 @@ jobs:
           test "$SOURCE_VERSION" = "$EXPECTED_VERSION"
           test "$HEAD_SHA" = "$TAG_SHA"
           test "$EVENT_SHA" = "$TAG_SHA"
+      - name: Generate build provenance attestation
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
+        with:
+          subject-path: "dist/*"
+      - name: Verify build provenance attestation
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          for artifact in dist/*; do
+            gh attestation verify "$artifact" --repo "${{ github.repository }}"
+          done
       - name: Publish via Trusted Publishing
         uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b  # v1.14.0
         with:

.github/workflows/zizmor.yml

@@ -48,8 +48,18 @@ jobs:
           # coworkerz-ci — repo-scoped GITHUB_TOKEN, docs.zizmor.sh). Das ist
           # die praezisere Loesung gegenueber online-audits:false (Webrecherche
           # 06-06): known-vulnerable-actions + stale-action-refs bleiben aktiv.
-          # privates Repo ohne GHAS: kein Action-internes Code-Scanning-Upload (wirft sonst
-          # "Resource not accessible"). Stattdessen Findings als inline-Annotationen.
-          advanced-security: false
-          annotations: true
+          # [2026-08-29] Auf true gesetzt. Die alte Begruendung lautete
+          # "privates Repo ohne GHAS" -- das Repo ist oeffentlich (gemessen:
+          # gh api repos/... --jq .visibility -> "public"), also steht das
+          # Code Scanning offen. Solange dies false war, wurden zizmor-Befunde
+          # nie hochgeladen: sie fehlten im Code Scanning nicht mangels
+          # Befunden, sondern mangels Upload.
+          advanced-security: true
+          # Mutually exclusive with advanced-security: the action refuses to
+          # start if both are set. Findings now go to Code Scanning, which is
+          # the point of turning advanced-security on -- inline annotations
+          # vanish with the run, a Code Scanning alert persists and can be
+          # triaged. Not caught locally: running zizmor directly does not
+          # exercise the action's own option validation.
+          annotations: false
 

.github/zizmor.yml

@@ -5,6 +5,11 @@
 # fremden privaten Repos lesen kann. SHA-Echtheit des Pins wird bei jedem Bump
 # via gh api Pre/Post verifiziert. Alle uebrigen Online-Audits (known-
 # vulnerable-actions, stale-action-refs) bleiben AKTIV.
-rules:
-  impostor-commit:
-    disable: true
+rules: {}
+# [2026-08-29] impostor-commit WIEDER AKTIV. Die Abschaltung vom 06-06 war
+# mit einem Crash am privaten Cross-Repo-Pin coworkerz-ci begruendet. Dieser
+# Pin existiert nicht mehr -- die einzigen Treffer im Baum waren die
+# Begruendungs-Kommentare selbst. Gegenprobe vor der Reaktivierung gefahren:
+# zizmor mit aktiven Online-Audits meldet keine Befunde, alle 25 Pins sind
+# upstream echt. Es ist der einzige Audit, der prueft, ob ein SHA-Pin
+# ueberhaupt existiert; ohne ihn ist die gesamte Pin-Strategie ungeprueft.