Harden opt-in preview publishing

Author: lelia

.github/actions/setup-docker/action.yml

@@ -5,6 +5,10 @@ description: >-
   preview, and stable workflows.
 
 inputs:
+  enable-qemu:
+    description: "Set up QEMU for multi-platform builds"
+    required: false
+    default: "true"
   dockerhub-username:
     description: "Docker Hub username (pass from secrets)"
     required: true
@@ -16,6 +20,7 @@ runs:
   using: "composite"
   steps:
     - uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+      if: inputs.enable-qemu == 'true'
     - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
     - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
       with:

.github/workflows/pr-preview.yml

@@ -25,27 +25,85 @@ on:
         type: string
 
 concurrency:
-  group: publish-pr-preview-${{ github.event.pull_request.number || inputs.pr_number }}
+  group: publish-pr-preview-${{ github.event.pull_request.number || github.run_id }}
   cancel-in-progress: false
 
 jobs:
-  build:
+  context:
     if: >-
       github.event_name == 'workflow_dispatch' ||
-      ((github.event.label.name == 'publish-preview' ||
+      (github.event.label.name == 'publish-preview' ||
       github.event.label.name == 'publish-docker-preview') &&
-      github.event.pull_request.head.repo.full_name == github.repository)
+      github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      pr_number: ${{ steps.context.outputs.pr_number }}
+      head_sha: ${{ steps.context.outputs.head_sha }}
+    steps:
+      - name: Validate pull request context
+        id: context
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+          INPUT_PR_NUMBER: ${{ inputs.pr_number }}
+          WORKFLOW_REF: ${{ github.ref }}
+        with:
+          script: |
+            const rawPrNumber = context.eventName === 'workflow_dispatch'
+              ? process.env.INPUT_PR_NUMBER
+              : process.env.EVENT_PR_NUMBER;
+            if (!/^[1-9][0-9]*$/.test(rawPrNumber || '')) {
+              core.setFailed('Pull request number must contain ASCII digits only.');
+              return;
+            }
+
+            if (context.eventName === 'workflow_dispatch') {
+              const defaultRef = `refs/heads/${process.env.DEFAULT_BRANCH}`;
+              if (process.env.WORKFLOW_REF !== defaultRef) {
+                core.setFailed(`Run manual previews from ${defaultRef}.`);
+                return;
+              }
+            }
+
+            const prNumber = Number(rawPrNumber);
+            if (!Number.isSafeInteger(prNumber)) {
+              core.setFailed('Pull request number is outside the supported range.');
+              return;
+            }
+            const {data: pullRequest} = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            if (pullRequest.state !== 'open') {
+              core.setFailed(`Pull request #${prNumber} is not open.`);
+              return;
+            }
+            if (pullRequest.head.repo?.full_name !== `${context.repo.owner}/${context.repo.repo}`) {
+              core.setFailed('Preview publication is limited to branches in this repository.');
+              return;
+            }
+
+            core.setOutput('pr_number', String(prNumber));
+            core.setOutput('head_sha', pullRequest.head.sha);
+
+  build:
+    needs: context
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
     outputs:
       preview_version: ${{ steps.version.outputs.preview_version }}
-      pr_number: ${{ steps.context.outputs.pr_number }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.head.sha || format('refs/pull/{0}/head', inputs.pr_number) }}
+          ref: ${{ needs.context.outputs.head_sha }}
           fetch-depth: 0
           persist-credentials: false
 
@@ -59,13 +117,6 @@ jobs:
       - name: Install distribution validator
         run: python -m pip install "twine>=4.0.0"
 
-      - name: Record preview context
-        id: context
-        env:
-          EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
-          INPUT_PR_NUMBER: ${{ inputs.pr_number }}
-        run: echo "pr_number=${EVENT_PR_NUMBER:-$INPUT_PR_NUMBER}" >> "$GITHUB_OUTPUT"
-
       - name: Inject deterministic preview version
         env:
           PREVIEW_ID: ${{ github.run_id }}
@@ -110,7 +161,7 @@ jobs:
           retention-days: 14
 
   publish-package:
-    needs: build
+    needs: [context, build]
     if: >-
       github.event.label.name == 'publish-preview' ||
       (github.event_name == 'workflow_dispatch' && inputs.publish_test_pypi)
@@ -128,7 +179,7 @@ jobs:
           path: dist
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           repository-url: https://test.pypi.org/legacy/
           verbose: true
@@ -137,7 +188,7 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PREVIEW_VERSION: ${{ needs.build.outputs.preview_version }}
-          PR_NUMBER: ${{ needs.build.outputs.pr_number }}
+          PR_NUMBER: ${{ needs.context.outputs.pr_number }}
         with:
           script: |
             const marker = '<!-- socketsecurity-pr-preview -->';
@@ -176,7 +227,7 @@ jobs:
             }
 
   publish-docker:
-    needs: build
+    needs: [context, build]
     if: >-
       github.event.label.name == 'publish-docker-preview' ||
       (github.event_name == 'workflow_dispatch' && inputs.publish_docker)
@@ -188,7 +239,9 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.event.pull_request.head.sha || format('refs/pull/{0}/head', inputs.pr_number) }}
+          # Keep the Dockerfile and credential-handling action on trusted code.
+          # The pull request enters this job only through the built wheel.
+          ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 1
           persist-credentials: false
 
@@ -198,29 +251,28 @@ jobs:
           name: socketsecurity-preview-${{ github.run_id }}-${{ github.run_attempt }}
           path: dist
 
-      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
-
-      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      - name: Set up Docker publishing
+        uses: ./.github/actions/setup-docker
         with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          enable-qemu: "false"
+          dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push Docker preview
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           file: Dockerfile.preview
           push: true
+          pull: true
           platforms: linux/amd64
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-          tags: socketdev/cli:pr-${{ needs.build.outputs.pr_number }}
+          tags: socketdev/cli:pr-${{ needs.context.outputs.pr_number }}
           build-args: |
             SDK_PREVIEW_VERSION=${{ inputs.sdk_preview_version }}
 
       - name: Comment on pull request
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          PR_NUMBER: ${{ needs.build.outputs.pr_number }}
+          PR_NUMBER: ${{ needs.context.outputs.pr_number }}
         with:
           script: |
             const marker = '<!-- socketsecurity-docker-preview -->';

.hooks/sync_version.py

@@ -137,8 +137,8 @@ def read_preview_id():
         print("❌ `--preview-id` requires a numeric value.")
         sys.exit(1)
 
-    if not preview_id.isdigit():
-        print("❌ `--preview-id` must contain digits only.")
+    if not preview_id.isascii() or not preview_id.isdigit():
+        print("❌ `--preview-id` must contain ASCII digits only.")
         sys.exit(1)
     return preview_id
 

CONTRIBUTING.md

@@ -15,7 +15,6 @@ Before opening a pull request, run:
 
 ```bash
 make test
-make lint
 uv run hatch build
 uv run python -m twine check dist/*
 ```
@@ -45,18 +44,19 @@ needs testing:
   `socketdev/cli:pr-<pull-request-number>` image to Docker Hub and adds or
   updates a pull request comment with the image tag.
 
-Label-triggered publication is skipped for pull requests from forks. Each label
-is handled as a separate event, so applying both labels starts two workflow
-runs. Use manual dispatch instead when both artifacts should be published in a
-single run.
+Both label-triggered and manually dispatched previews are limited to open pull
+requests whose branches belong to this repository. Each label is handled as a
+separate event, so applying both labels starts two workflow runs. Use manual
+dispatch instead when both artifacts should be published in a single run.
 
 The workflow reacts when a label is added; pushing another commit while the
 label remains on the pull request does not publish a new preview. To publish the
 new pull request head or retry a failed publication, remove the relevant label
 and apply it again.
 
-Maintainers can also open **Actions > Publish PR Preview > Run workflow**, enter
-the pull request number, and choose whether to publish to TestPyPI, Docker Hub,
-or both. When testing the CLI against an SDK preview, enter the exact TestPyPI
-`socketdev` prerelease in `sdk_preview_version`; publish the SDK preview first
-and allow time for TestPyPI to expose it before starting the CLI Docker preview.
+Maintainers can also open **Actions > Publish PR Preview > Run workflow**, run
+it from the repository's default branch, enter the pull request number, and
+choose whether to publish to TestPyPI, Docker Hub, or both. When testing the CLI
+against an SDK preview, enter the exact TestPyPI `socketdev` prerelease in
+`sdk_preview_version`; publish the SDK preview first and allow time for
+TestPyPI to expose it before starting the CLI Docker preview.

Dockerfile

@@ -141,7 +141,6 @@ COPY . /app
 WORKDIR /app
 RUN if [ "$USE_LOCAL_INSTALL" = "true" ]; then \
         pip install --upgrade -e .; \
-        pip install --upgrade socketdev; \
     fi
 
 # Create workspace directory with proper permissions

Dockerfile.preview

@@ -1,23 +1,68 @@
+# syntax=docker/dockerfile:1
+
 FROM socketdev/cli:latest
 
 ARG SDK_PREVIEW_VERSION=""
-ARG PIP_INDEX_URL=https://test.pypi.org/simple/
-ARG PIP_EXTRA_INDEX_URL=https://pypi.org/simple/
+ARG PYPI_INDEX_URL=https://pypi.org/simple/
+ARG TEST_PYPI_INDEX_URL=https://test.pypi.org/simple/
 
 COPY dist/socketsecurity-*.whl /tmp/socket-preview/
 
-RUN set -eux; \
-    if [ -n "$SDK_PREVIEW_VERSION" ]; then \
-        pip install \
-            --no-cache-dir \
-            --index-url "$PIP_INDEX_URL" \
-            --extra-index-url "$PIP_EXTRA_INDEX_URL" \
-            "socketdev==$SDK_PREVIEW_VERSION"; \
-    fi; \
-    pip install \
+RUN <<'SH'
+set -eux
+
+wheel=$(find /tmp/socket-preview -maxdepth 1 -name 'socketsecurity-*.whl' -print -quit)
+
+# Resolve every wheel dependency from production PyPI. When an exact SDK
+# preview is requested, leave socketdev out so the prerelease can intentionally
+# override a final-version floor such as socketdev>=3.4.0.
+python - "$wheel" > /tmp/socket-preview/requirements.txt <<'PY'
+import email
+import os
+import sys
+import zipfile
+
+from packaging.requirements import Requirement
+from packaging.utils import canonicalize_name
+
+wheel_path = sys.argv[1]
+with zipfile.ZipFile(wheel_path) as archive:
+    metadata_path = next(
+        name for name in archive.namelist() if name.endswith(".dist-info/METADATA")
+    )
+    metadata = email.message_from_bytes(archive.read(metadata_path))
+
+sdk_preview = os.environ.get("SDK_PREVIEW_VERSION")
+for value in metadata.get_all("Requires-Dist", []):
+    if sdk_preview and canonicalize_name(Requirement(value).name) == "socketdev":
+        continue
+    print(value)
+PY
+
+python -m pip install \
+    --no-cache-dir \
+    --index-url "$PYPI_INDEX_URL" \
+    --requirement /tmp/socket-preview/requirements.txt
+
+if [ -n "$SDK_PREVIEW_VERSION" ]; then
+    mkdir /tmp/socket-preview/sdk
+    python -m pip download \
         --no-cache-dir \
         --no-deps \
-        --force-reinstall \
-        /tmp/socket-preview/socketsecurity-*.whl; \
-    socketcli --help >/dev/null; \
-    rm -rf /tmp/socket-preview
+        --dest /tmp/socket-preview/sdk \
+        --index-url "$TEST_PYPI_INDEX_URL" \
+        "socketdev==$SDK_PREVIEW_VERSION"
+    python -m pip install \
+        --no-cache-dir \
+        --index-url "$PYPI_INDEX_URL" \
+        /tmp/socket-preview/sdk/socketdev-*.whl
+fi
+
+python -m pip install \
+    --no-cache-dir \
+    --no-deps \
+    --force-reinstall \
+    "$wheel"
+socketcli --help >/dev/null
+rm -rf /tmp/socket-preview
+SH