[rmcdaniel]

Updating to the private pip bootstrap currently stops GitHub-hosted jobs before dependency access: the selected Python has writable ancestry, and the validator does not recognize the console script generated by the pinned pip 26.2.2 wheel. Sample App #333 exposes the first refusal; a real hosted probe and an offline stock-pip reproduction established both.

The action now protects the fixed selected Python ancestry and removes other-user write permissions from that runtime before its existing interpreter/loader checks. Root-owned shared parents receive sticky ownership. The descriptor-based walk refuses linked ancestry, unsupported owners, special files, hardlinked files and identity drift, and bounds depth/entry count. It does not traverse tree symlinks or other versions/languages. This preparation runs only on Linux GitHub-hosted runners.

The entrypoint validator additionally accepts the exact script generated by the authenticated pip 26.2.2 wheel (sys.argv[0].removesuffix('.exe')), retaining its exact interpreter header, complete-body comparison and installed RECORD checks. Foreign interpreters, changed bodies and appended code still refuse.

Validation:

• Fourteen focused offline controls pass in a bounded non-root container.
• The exact 1,819,850-byte wheel, SHA256 fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70, reproduces the predecessor refusal. With the correction, a real Python 3.11 manager seeds the private runtime, validates all three generated entrypoints and completes exact cleanup with no network in the test.
• Hosted probe 42697624852 on Python 3.13 passed permission/interpreter/loader/manager/wheel checks, then refused the old entrypoint whitelist. It remains NONPASS. Its changed live CI workflow was also correctly refused by the protected source gate. The live workflow is restored in this PR; no qualifier bypass or new context exception remains.
• Complete bootstrap validation on hosted Python remains required before consumer release/installed acceptance. A dedicated five-minute workflow with closed literal commands exercises the local action and effective private pip on hosted Python 3.13. It runs through the ordinary source gate, without changing existing reviewed workflow bytes or granting a context exception.

The two broader local private-pip tests lacking a manager in the original bare test image remain environment NONPASSs; the stock-wheel reproduction supplies that manager explicitly.

The catalog also admits the two other pending Sample App action updates after source comparison: Docker login v4.8.0 retains the existing supplied-password path and changes the OIDC default expiry from 300 to 3600 seconds, plus dependency refreshes; the consumer uses supplied credentials rather than OIDC. Sonar scan v8.4.1 updates bundled undici, its exact scanner version/checksums and upstream test tooling, with no action permission or credential-input change. These catalog entries enable ordinary consumer checks; they are not publication or production acceptance.

Refs #237, durable-workflow/sample-app#333.

[rmcdaniel]

The complete hosted Python 3.13 bootstrap now PASSes: 42700164458 / job129442445548. The selected runtime is protected, the private manager/wheel/install/entrypoint/RECORD checks return successfully, the exported CA hash is exactly 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785, and the final command reports pip26.2.2 from the private Python3.13 environment.

The later source gate refusal on that attempt was specifically the wildcard path-filter prefix, not the bootstrap. The successor uses four canonical explicit action-file paths. Its source gate and hosted bootstrap both PASS; other exact-head checks must still finish. No context exception or validator weakening was introduced.

The catalog now proposes exact bootstrap source 52283e2e8ea9a2cf7e3865ee30f2a72a38b098a2 as clean-trust. All files below .github/actions at that immutable source are byte-identical to the hosted-tested subject and current head; the later deltas are the standalone qualifier and its explicit path filters. Consumer adoption remains behind ordinary final source checks and merge. Prior refusals and failed attempts remain attributed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
94.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud