fix(security): fail closed formal PyPI dependency evidence

.github/workflows/agent-review-runtime-quality-ci.yml

@@ -36,6 +36,7 @@ on:
       - "tests/test_docs_only_pr_runner_admission.py"
       - "tests/test_strix_changed_path_policy.py"
       - "tests/test_strix_evidence_binding.py"
+      - "tests/test_strix_mandatory_evidence_contract.py"
       - "tests/test_strix_model_behavior_error.py"
       - "tests/test_strix_nvidia_nim_not_found_fallback.py"
       - "tests/test_strix_workflow_dependency_hashes.py"
@@ -220,6 +221,7 @@ jobs:
               tests/test_docs_only_pr_runner_admission.py|\
               tests/test_strix_changed_path_policy.py|\
               tests/test_strix_evidence_binding.py|\
+              tests/test_strix_mandatory_evidence_contract.py|\
               tests/test_strix_model_behavior_error.py|\
               tests/test_strix_nvidia_nim_not_found_fallback.py|\
               tests/test_strix_workflow_dependency_hashes.py|\
@@ -401,6 +403,7 @@ jobs:
             tests/test_docs_only_pr_runner_admission.py \
             tests/test_strix_changed_path_policy.py \
             tests/test_strix_evidence_binding.py \
+            tests/test_strix_mandatory_evidence_contract.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \
@@ -410,6 +413,7 @@ jobs:
             scripts/ci/strix_evidence_binding.py \
             tests/test_strix_changed_path_policy.py \
             tests/test_strix_evidence_binding.py \
+            tests/test_strix_mandatory_evidence_contract.py \
             tests/test_strix_model_behavior_error.py \
             tests/test_strix_nvidia_nim_not_found_fallback.py \
             tests/test_strix_workflow_dependency_hashes.py \

.github/workflows/dependency-review.yml

@@ -61,10 +61,8 @@ on:
         default: ""
       continue_on_error:
         description: >-
-          Whether the dependency-review step itself is allowed to fail
-          without failing the job (argos's original behavior, which relies
-          on a separate blocking OSV-Scanner gate instead of this one).
-          Default false makes the dependency-review step itself blocking.
+          Deprecated compatibility input. It is intentionally ignored: a
+          caller cannot weaken the formal release dependency hard gate.
         required: false
         type: boolean
         default: false
@@ -104,6 +102,16 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Materialize exact trusted release-policy verifier
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: ContextualWisdomLab/.github
+          ref: ${{ github.workflow_sha }}
+          path: trusted-release-policy
+          persist-credentials: false
+          sparse-checkout: scripts/ci/release_dependency_evidence.py
+          sparse-checkout-cone-mode: false
+
       - name: Check dependency graph availability
         id: dependency_graph
         env:
@@ -133,31 +141,65 @@ jobs:
           )"
 
           if [ "$status" = "200" ]; then
+            evidence_file="${RUNNER_TEMP}/dependency-graph-compare.json"
+            install -m 0444 "$response_file" "$evidence_file"
+            echo "evidence_file=$evidence_file" >>"$GITHUB_OUTPUT"
             echo "available=true" >>"$GITHUB_OUTPUT"
             exit 0
           fi
 
           if [ "$status" = "403" ] || [ "$status" = "404" ]; then
-            echo "::warning::Dependency graph compare returned HTTP ${status} for ${REPOSITORY}; skipping the dependency-review hard gate (GitHub Dependency Graph, or GitHub Advanced Security on a private repository, is unavailable)."
-            echo "available=false" >>"$GITHUB_OUTPUT"
-            exit 0
+            echo "::error::Dependency graph compare returned HTTP ${status} for ${REPOSITORY}; release dependency evidence is unavailable, so the gate cannot pass."
+            exit 1
           fi
 
           echo "::error::Dependency graph availability check failed with HTTP ${status}. This is not a 'graph unavailable' response (403/404) -- treating it as a genuine failure instead of silently skipping the security gate."
           cat "$response_file"
           exit 1
 
       - name: Dependency review
+        id: dependency_review
         if: steps.dependency_graph.outputs.available == 'true'
-        continue-on-error: ${{ inputs.continue_on_error }}
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           fail-on-severity: ${{ inputs.fail_on_severity }}
           allow-ghsas: ${{ inputs.allow_ghsas }}
           comment-summary-in-pr: ${{ inputs.comment_summary_in_pr }}
+          deny-licenses: GPL-1.0-only, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-3.0-only, GPL-3.0-or-later, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, AGPL-1.0-only, AGPL-1.0-or-later, AGPL-3.0-only, AGPL-3.0-or-later
 
-      - name: Dependency graph unavailable note
-        if: steps.dependency_graph.outputs.available != 'true' && github.event_name == 'pull_request'
+      - name: Bind dependency-by-dependency security evidence to exact head
+        if: always() && steps.dependency_graph.outputs.available == 'true'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          REPOSITORY: ${{ github.repository }}
+          EVIDENCE_FILE: ${{ steps.dependency_graph.outputs.evidence_file }}
+          DEPENDENCY_REVIEW_OUTCOME: ${{ steps.dependency_review.outcome }}
+        shell: bash
         run: |
-          echo "Dependency Review requires GitHub Dependency Graph to be enabled for this repository (and, on private repositories, GitHub Advanced Security)."
-          echo "Other required dependency-vulnerability gates (OSV-Scanner, Scorecard) remain the blocking coverage until Dependency Graph is available here."
+          set -euo pipefail
+          verifier="trusted-release-policy/scripts/ci/release_dependency_evidence.py"
+          if [ ! -f "$verifier" ] || [ -L "$verifier" ]; then
+            echo "::error::Trusted release dependency evidence verifier is missing or unsafe."
+            exit 2
+          fi
+          if [ -z "$EVIDENCE_FILE" ] || [ ! -f "$EVIDENCE_FILE" ] || [ -L "$EVIDENCE_FILE" ]; then
+            echo "::error::Dependency-by-dependency evidence is missing or unsafe."
+            exit 2
+          fi
+          python3 -I "$verifier" \
+            --input "$EVIDENCE_FILE" \
+            --output release-dependency-evidence.json \
+            --repository "$REPOSITORY" \
+            --base-sha "$BASE_SHA" \
+            --head-sha "$HEAD_SHA" \
+            --dependency-review-outcome "$DEPENDENCY_REVIEW_OUTCOME"
+
+      - name: Upload exact-head release dependency evidence
+        if: always() && steps.dependency_graph.outputs.available == 'true'
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
+        with:
+          name: release-dependency-evidence-${{ github.event.pull_request.head.sha }}
+          path: release-dependency-evidence.json
+          if-no-files-found: error
+          retention-days: 30

scripts/ci/release_dependency_evidence.py

@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+"""Bind release dependency-review evidence to an exact pull-request revision.
+
+The GitHub dependency-graph compare response contains one row per changed
+dependency, including direct/transitive relationship, manifest, license, and
+known vulnerabilities.  This verifier rejects incomplete rows and forbidden
+GNU-family licenses before emitting a deterministic machine-readable receipt.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import sys
+from pathlib import Path
+from typing import Any, Sequence
+
+from packaging.licenses import InvalidLicenseExpression, canonicalize_license_expression
+
+
+FULL_SHA_RE = re.compile(r"^[0-9a-f]{40}$")
+FORBIDDEN_LICENSE_RE = re.compile(
+    r"(?:^|[^A-Z])(?:A?GPL|LGPL)(?:[-+.0-9]|$)", re.IGNORECASE
+)
+UNVERIFIABLE_LICENSE_RE = re.compile(r"(?:^|[^A-Za-z])LicenseRef-", re.IGNORECASE)
+
+
+class EvidenceError(ValueError):
+    """Raised when release dependency evidence is absent or incomplete."""
+
+
+def _required_text(row: dict[str, Any], key: str, index: int) -> str:
+    """Return a non-empty string field or fail with its row location."""
+    value = row.get(key)
+    if not isinstance(value, str) or not value.strip():
+        raise EvidenceError(f"dependency[{index}].{key} is required")
+    return value.strip()
+
+
+def dependency_rows(payload: Any) -> list[dict[str, Any]]:
+    """Extract the compare API's dependency rows without accepting ambiguity."""
+    rows = payload.get("dependencies") if isinstance(payload, dict) else payload
+    if not isinstance(rows, list):
+        raise EvidenceError("dependency evidence must be a JSON array or dependencies array")
+    if any(not isinstance(row, dict) for row in rows):
+        raise EvidenceError("every dependency evidence row must be an object")
+    return rows
+
+
+def validate_license_expression(value: str, *, dependency_name: str) -> str:
+    """Return canonical SPDX or fail closed on unknown/custom license evidence."""
+    if UNVERIFIABLE_LICENSE_RE.search(value):
+        raise EvidenceError(
+            f"unverifiable release dependency license: {dependency_name}: {value}"
+        )
+    try:
+        canonical = canonicalize_license_expression(value)
+    except InvalidLicenseExpression as error:
+        raise EvidenceError(
+            f"invalid or unknown release dependency license: {dependency_name}: {value}"
+        ) from error
+    if UNVERIFIABLE_LICENSE_RE.search(canonical):
+        raise EvidenceError(
+            f"unverifiable release dependency license: {dependency_name}: {value}"
+        )
+    return canonical
+
+
+def build_receipt(
+    payload: Any, *, repository: str, base_sha: str, head_sha: str
+) -> dict[str, Any]:
+    """Validate every dependency and build an exact-head evidence receipt."""
+    if repository.count("/") != 1:
+        raise EvidenceError("repository must be owner/name")
+    if not FULL_SHA_RE.fullmatch(base_sha) or not FULL_SHA_RE.fullmatch(head_sha):
+        raise EvidenceError("base_sha and head_sha must be full lowercase commit SHAs")
+    if base_sha == head_sha:
+        raise EvidenceError("base_sha and head_sha must differ")
+
+    dependencies: list[dict[str, Any]] = []
+    for index, row in enumerate(dependency_rows(payload)):
+        name = _required_text(row, "name", index)
+        manifest = _required_text(row, "manifest", index)
+        license_expression = validate_license_expression(
+            _required_text(row, "license", index), dependency_name=name
+        )
+        if FORBIDDEN_LICENSE_RE.search(license_expression):
+            raise EvidenceError(
+                f"forbidden release dependency license: {name}: {license_expression}"
+            )
+        vulnerabilities = row.get("vulnerabilities")
+        if not isinstance(vulnerabilities, list):
+            raise EvidenceError(f"dependency[{index}].vulnerabilities must be an array")
+        dependencies.append(
+            {
+                "name": name,
+                "version": str(row.get("version") or ""),
+                "manifest": manifest,
+                # GitHub's compare API returns direct and transitive changes but
+                # does not expose that relationship in its response schema.
+                "relationship": str(row.get("relationship") or "not_reported_by_compare_api"),
+                "license": license_expression,
+                "change_type": str(row.get("change_type") or "unknown"),
+                "vulnerabilities": vulnerabilities,
+            }
+        )
+
+    dependencies.sort(
+        key=lambda item: (item["manifest"], item["name"].lower(), item["version"])
+    )
+    return {
+        "schema": "cwl-release-dependency-evidence/v1",
+        "binding": {
+            "repository": repository,
+            "base_sha": base_sha,
+            "head_sha": head_sha,
+        },
+        "policy": {
+            "coverage": "all direct and transitive changes returned by GitHub dependency review",
+            "denied_license_families": ["GPL", "LGPL", "AGPL"],
+        },
+        "dependency_count": len(dependencies),
+        "dependencies": dependencies,
+    }
+
+
+def build_rejection_receipt(
+    payload: Any,
+    *,
+    repository: str,
+    base_sha: str,
+    head_sha: str,
+    reason: str,
+) -> dict[str, Any]:
+    """Preserve deterministic per-dependency evidence for a rejected review."""
+    rows = dependency_rows(payload)
+    dependencies = [
+        {
+            "name": str(row.get("name") or ""),
+            "version": str(row.get("version") or ""),
+            "manifest": str(row.get("manifest") or ""),
+            "relationship": str(
+                row.get("relationship") or "not_reported_by_compare_api"
+            ),
+            "license": str(row.get("license") or ""),
+            "change_type": str(row.get("change_type") or "unknown"),
+            "vulnerabilities": (
+                row.get("vulnerabilities")
+                if isinstance(row.get("vulnerabilities"), list)
+                else []
+            ),
+        }
+        for row in rows
+    ]
+    dependencies.sort(
+        key=lambda item: (item["manifest"], item["name"].lower(), item["version"])
+    )
+    return {
+        "schema": "cwl-release-dependency-evidence/v1",
+        "binding": {
+            "repository": repository,
+            "base_sha": base_sha,
+            "head_sha": head_sha,
+        },
+        "result": "rejected",
+        "rejection_reason": reason,
+        "dependency_count": len(dependencies),
+        "dependencies": dependencies,
+    }
+
+
+def write_receipt(output: Path, receipt: dict[str, Any]) -> None:
+    """Atomically publish one accepted or rejected exact-head receipt."""
+    output.parent.mkdir(parents=True, exist_ok=True)
+    temporary = output.with_suffix(output.suffix + ".tmp")
+    temporary.write_text(json.dumps(receipt, indent=2) + "\n", encoding="utf-8")
+    temporary.replace(output)
+
+
+def parse_args(argv: Sequence[str] | None = None) -> argparse.Namespace:
+    """Parse the exact-head evidence verifier CLI."""
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--input", required=True, type=Path)
+    parser.add_argument("--output", required=True, type=Path)
+    parser.add_argument("--repository", required=True)
+    parser.add_argument("--base-sha", required=True)
+    parser.add_argument("--head-sha", required=True)
+    parser.add_argument(
+        "--dependency-review-outcome",
+        choices=("success", "failure", "cancelled", "skipped"),
+        default="success",
+    )
+    return parser.parse_args(argv)
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    """Validate compare evidence and atomically publish its structured receipt."""
+    args = parse_args(argv)
+    payload: Any = None
+    try:
+        if not args.input.is_file() or args.input.is_symlink():
+            raise EvidenceError("dependency evidence input is missing or unsafe")
+        payload = json.loads(args.input.read_text(encoding="utf-8"))
+        receipt = build_receipt(
+            payload,
+            repository=args.repository,
+            base_sha=args.base_sha,
+            head_sha=args.head_sha,
+        )
+        if args.dependency_review_outcome != "success":
+            receipt["result"] = "rejected"
+            receipt["rejection_reason"] = (
+                "dependency-review action outcome: " + args.dependency_review_outcome
+            )
+            write_receipt(args.output, receipt)
+            return 2
+        receipt["result"] = "accepted"
+        write_receipt(args.output, receipt)
+    except (EvidenceError, OSError, json.JSONDecodeError) as error:
+        print(f"ERROR: {error}", file=sys.stderr)
+        if payload is not None:
+            try:
+                write_receipt(
+                    args.output,
+                    build_rejection_receipt(
+                        payload,
+                        repository=args.repository,
+                        base_sha=args.base_sha,
+                        head_sha=args.head_sha,
+                        reason=str(error),
+                    ),
+                )
+            except (EvidenceError, OSError):
+                pass
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())