Reject projected provenance and inconsistent release archive claims

Validate raw producing context and proof shapes before projection. Verify ZIP bytes and payload as one snapshot against the tested tree before claims, Gallery writes, release creation and upload.

(cherry picked from commit e59ac33)

Author: MariusStorhaug

.github/actions/Publish-PSModule/README.md

@@ -8,6 +8,8 @@ An observed release tag must remain unchanged through shared coordinate creation
 
 An existing Gallery package is retained only when its raw nupkg payload matches that proof and the tested artifact. Package code is never imported to establish ownership. Unknown legacy proof, foreign tags/releases/assets, changed claims, authentication errors, and API failures stop publication explicitly.
 
+Provenance must contain one original JSON object with scalar proof fields; arrays are not projected into valid identities. The ZIP's exact bytes and canonical payload digest are verified together against the tested file tree before a claim or Gallery write. Original event PR context is validated before normalized fields are selected.
+
 ## Inputs
 
 | Name | Description | Required | Default |

.github/actions/Publish-PSModule/src/publish.ps1

@@ -72,10 +72,15 @@ LogGroup 'Load release context' {
         $pullRequest = ConvertFrom-Json -InputObject $pullRequestJson -NoEnumerate -ErrorAction Stop
     } else {
         $githubEventJson = Get-Content -Raw $env:GITHUB_EVENT_PATH
-        $githubEvent = $githubEventJson | ConvertFrom-Json
-        if ($githubEvent.pull_request) {
+        $githubEvent = ConvertFrom-Json -InputObject $githubEventJson -NoEnumerate -ErrorAction Stop
+        if ($githubEvent -is [array] -or $githubEvent -isnot [PSCustomObject]) {
+            throw 'The original GitHub event context requires one event object.'
+        }
+        $eventPullRequest = $githubEvent.pull_request
+        $null = Get-PSModuleProducingPullRequestNumber -PullRequest $eventPullRequest
+        if ($null -ne $eventPullRequest) {
             $pullRequest = [pscustomobject]@{
-                Number = $githubEvent.pull_request.number
+                Number = $eventPullRequest.number
             }
         }
     }
@@ -178,6 +183,11 @@ try {
                 AssetName      = $zipFileName
                 AssetSha256    = (Get-FileHash -LiteralPath $zipPath -Algorithm SHA256).Hash.ToLowerInvariant()
             }
+            $archiveProof = Get-PSModuleReleaseArchiveProof -Path $zipPath -ModuleName $name
+            if ($archiveProof.ArtifactSha256 -cne $claim.ArtifactSha256 -or
+                $archiveProof.AssetSha256 -cne $claim.AssetSha256) {
+                throw 'The release archive does not match the tested file-tree and asset claim. Refusing publication.'
+            }
             $publicationReader = Get-PSModulePublicationReader -Repository $env:GITHUB_REPOSITORY
             $publicationState = Get-PSModulePublicationState -ExpectedClaim $claim -Reader $publicationReader
         }
@@ -195,10 +205,19 @@ try {
             Write-Host "WhatIf: Create-only annotated claim for [$releaseTag]; retain any existing published bytes."
             Write-Host "Publish-PSResource -Path $modulePath -Repository PSGallery -ApiKey ***"
         } else {
+            $archiveProof = Get-PSModuleReleaseArchiveProof -Path $zipPath -ModuleName $name
+            if ($archiveProof.ArtifactSha256 -cne $claim.ArtifactSha256 -or
+                $archiveProof.AssetSha256 -cne $claim.AssetSha256 -or
+                (Get-PSModuleArtifactDigest -Path $modulePath) -cne $claim.ArtifactSha256) {
+                throw 'The tested artifact or release archive changed before the immutable claim. Refusing publication.'
+            }
             $publicationState = New-PSModulePublicationTag -Claim $claim -State $publicationState -Reader $publicationReader
             $currentState = Get-PSModulePublicationState -ExpectedClaim $claim -Reader $publicationReader
+            $archiveProof = Get-PSModuleReleaseArchiveProof -Path $zipPath -ModuleName $name
             if ($currentState.TagSha -cne $publicationState.TagSha -or
                 $currentState.VersionTagSha -cne $publicationState.VersionTagSha -or
+                $archiveProof.ArtifactSha256 -cne $claim.ArtifactSha256 -or
+                $archiveProof.AssetSha256 -cne $claim.AssetSha256 -or
                 (Get-PSModuleArtifactDigest -Path $modulePath) -cne $claim.ArtifactSha256) {
                 throw 'The publication claim or tested artifact changed before the Gallery write. Refusing publication.'
             }

.github/actions/Publish-PSModule/tests/Publish-PSModule.Preflight.Tests.ps1

@@ -18,8 +18,12 @@ BeforeAll {
     $script:publishScriptPath = [IO.Path]::GetFullPath(
         [IO.Path]::Combine($PSScriptRoot, '..', 'src', 'publish.ps1')
     )
+    $script:releaseScriptPath = [IO.Path]::GetFullPath(
+        [IO.Path]::Combine($PSScriptRoot, '..', '..', 'Release-PSModule', 'src', 'release.ps1')
+    )
     $script:environmentVariableNames = @(
         'GITHUB_EVENT_PATH'
+        'GITHUB_OUTPUT'
         'GITHUB_REPOSITORY'
         'GITHUB_REPOSITORY_NAME'
         'GITHUB_SHA'
@@ -32,6 +36,16 @@ BeforeAll {
         'PSMODULE_PUBLISH_PSMODULE_INPUT_VersionPrefix'
         'PSMODULE_PUBLISH_PSMODULE_INPUT_CommitSha'
         'PSMODULE_PUBLISH_PSMODULE_INPUT_WhatIf'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_Name'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_ModulePath'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_ReleaseTag'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_VersionPrefix'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_CommitSha'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_PullRequest'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_WhatIf'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_UsePRBodyAsReleaseNotes'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_UsePRTitleAsReleaseName'
+        'PSMODULE_RELEASE_PSMODULE_INPUT_UsePRTitleAsNotesHeading'
     )
     $script:originalEnvironment = @{}
     foreach ($name in $script:environmentVariableNames) {
@@ -97,6 +111,18 @@ Describe 'Publish-PSModule source-bound preflight' {
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_VersionPrefix = 'v'
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_CommitSha = $env:GITHUB_SHA
         $env:PSMODULE_PUBLISH_PSMODULE_INPUT_WhatIf = 'false'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_Name = 'TestModule'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_ModulePath = '.PSModule/module'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_ReleaseTag = 'v1.2.4'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_VersionPrefix = 'v'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_CommitSha = $env:GITHUB_SHA
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_PullRequest = ''
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_WhatIf = 'false'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_UsePRBodyAsReleaseNotes = 'false'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_UsePRTitleAsReleaseName = 'false'
+        $env:PSMODULE_RELEASE_PSMODULE_INPUT_UsePRTitleAsNotesHeading = 'false'
+        $env:GITHUB_OUTPUT = Join-Path -Path $env:GITHUB_WORKSPACE -ChildPath 'outputs'
+        $null = New-Item -Path $env:GITHUB_OUTPUT -ItemType File
 
         $script:state = New-PSModulePublicationFixture -Path $script:modulePath -Version '1.2.4' -Tag 'v1.2.4'
     }
@@ -335,7 +361,10 @@ Describe 'Publish-PSModule source-bound preflight' {
         $script:state.GitHubWrites | Should -Be 0
     }
 
-    It 'rejects a ZIP payload inconsistent with the tested file-tree claim before all writes' {
+    It 'rejects a <Controller> ZIP payload inconsistent with the tested file-tree claim before all writes' -ForEach @(
+        @{ Controller = 'publisher' }
+        @{ Controller = 'release' }
+    ) {
         Mock -CommandName Get-FileHash -ParameterFilter { $LiteralPath -like '*.zip' } -MockWith {
             $archive = [IO.Compression.ZipFile]::Open($LiteralPath, [IO.Compression.ZipArchiveMode]::Update)
             try {
@@ -357,15 +386,37 @@ Describe 'Publish-PSModule source-bound preflight' {
             }
         }
 
+        $controllerPath = $script:publishScriptPath
+        if ($Controller -ceq 'release') { $controllerPath = $script:releaseScriptPath }
         $failure = $null
-        try { & $script:publishScriptPath 1>$null 6>$null } catch { $failure = $_ }
+        try { & $controllerPath 1>$null 6>$null } catch { $failure = $_ }
 
         Should -Invoke -CommandName Get-FileHash -Times 1 -Exactly -ParameterFilter { $LiteralPath -like '*.zip' }
         $script:state.GalleryWrites | Should -Be 0
         $script:state.GitHubWrites | Should -Be 0
         $failure.Exception.Message | Should -Match 'archive'
     }
 
+    It 'rejects a changed <Controller> artifact before reserving any immutable claim' -ForEach @(
+        @{ Controller = 'publisher' }
+        @{ Controller = 'release' }
+    ) {
+        $script:state.PayloadPath = Join-Path -Path $script:modulePath -ChildPath 'TestModule.psm1'
+        $script:state.OnTagRead = {
+            param($State)
+            if ($State.TagReads -eq 1) {
+                [IO.File]::WriteAllText($State.PayloadPath, '# Changed candidate after the byte snapshot.')
+            }
+        }
+        $controllerPath = $script:publishScriptPath
+        if ($Controller -ceq 'release') { $controllerPath = $script:releaseScriptPath }
+
+        { & $controllerPath 1>$null 6>$null } | Should -Throw '*artifact*immutable claim*'
+
+        $script:state.GalleryWrites | Should -Be 0
+        $script:state.GitHubWrites | Should -Be 0
+    }
+
     It 'rejects changed Gallery package bytes despite matching numeric version and source claim' {
         Set-PSModuleFixtureClaim -State $script:state -Claim $script:state.ExpectedClaim
         $script:state.Package = [pscustomobject]@{ Name = 'TestModule'; Version = '1.2.4' }
@@ -566,6 +617,20 @@ Describe 'Publish-PSModule source-bound preflight' {
         $claim.PullRequest | Should -Be 42
     }
 
+    It 'rejects original release event PR context before projection' -ForEach @(
+        @{ EventJson = '{"pull_request":[{"number":42}]}' }
+        @{ EventJson = '{"pull_request":{"number":[42]}}' }
+        @{ EventJson = '[{"pull_request":{"number":42}}]' }
+        @{ EventJson = '{"pull_request":{}}' }
+    ) {
+        [IO.File]::WriteAllText($env:GITHUB_EVENT_PATH, $EventJson)
+
+        { & $script:releaseScriptPath 1>$null 6>$null } | Should -Throw '*context*'
+
+        $script:state.GalleryWrites | Should -Be 0
+        $script:state.GitHubWrites | Should -Be 0
+    }
+
     It 'rejects a draft release before Gallery publication rather than reporting completed publication' {
         Set-PSModuleFixtureClaim -State $script:state -Claim $script:state.ExpectedClaim
         $script:state.Release = [pscustomobject]@{

.github/actions/Release-PSModule/README.md

@@ -48,4 +48,6 @@ The action supports normalized pull-request context and direct stable releases.
 
 Release creation and upload recheck the release tag, shared module/version coordinate, provenance, and artifact identity. Both refs must bind the same immutable claim, regardless of tag prefix. A missing upload can resume. An existing asset is retained only when its published SHA-256 matches the exact local ZIP; differing, ambiguous, or unverifiable bytes stop the action. Uploads never use `--clobber`, and tags are never retargeted.
 
+The local ZIP's exact bytes and payload digest are verified together against the tested file tree before claiming, creating, or uploading. Original event PR context and versioned provenance must have valid object/scalar shapes before normalization; arrays cannot supply publication ownership.
+
 Complete authored or generated prerelease notes precede a final repository/producing-PR/source footer. A matching tag/source does not authorize another PR's release. Legacy records without proof require reviewed forward-only recovery; the action does not fabricate provenance or alter consumer metadata.

.github/actions/Release-PSModule/src/Release-PSModule.Helpers.psm1

@@ -105,9 +105,11 @@ function Get-PSModulePrereleaseOwnership {
         return
     }
     $bytes = [Convert]::FromBase64String($match.Groups[1].Value)
-    $ownership = [Text.Encoding]::UTF8.GetString($bytes) | ConvertFrom-Json -ErrorAction Stop
+    $ownership = ConvertFrom-Json -InputObject ([Text.Encoding]::UTF8.GetString($bytes)) -NoEnumerate -ErrorAction Stop
     $number = 0L
-    if ([string]::IsNullOrWhiteSpace($ownership.Repository) -or
+    if ($ownership -is [array] -or $ownership -isnot [PSCustomObject] -or
+        $ownership.Repository -isnot [string] -or $ownership.CommitSha -isnot [string] -or
+        $ownership.PullRequest -is [array] -or [string]::IsNullOrWhiteSpace($ownership.Repository) -or
         $ownership.Repository -notmatch '^[^/\s]+/[^/\s]+$' -or
         -not [long]::TryParse([string]$ownership.PullRequest, [ref]$number) -or
         $number -lt 1 -or [string]::IsNullOrWhiteSpace($ownership.CommitSha)) {
@@ -155,6 +157,7 @@ function Get-PSModuleProducingPullRequestNumber {
     $number = 0L
     if ($PullRequest -is [array] -or
         ($PullRequest -isnot [PSCustomObject] -and $PullRequest -isnot [Collections.IDictionary]) -or
+        $PullRequest.Number -is [array] -or
         -not [long]::TryParse([string]$PullRequest.Number, [ref]$number) -or $number -lt 1) {
         throw 'Supplied pull request context requires a positive producing pull request number.'
     }
@@ -265,9 +268,21 @@ function Get-PSModulePublicationClaim {
         return
     }
     $bytes = [Convert]::FromBase64String($match.Groups[1].Value)
-    $claim = [Text.Encoding]::UTF8.GetString($bytes) | ConvertFrom-Json -ErrorAction Stop
+    $claim = ConvertFrom-Json -InputObject ([Text.Encoding]::UTF8.GetString($bytes)) -NoEnumerate -ErrorAction Stop
+    if ($claim -is [array] -or $claim -isnot [PSCustomObject]) {
+        throw 'The publication claim requires one proof object, not a projected JSON value.'
+    }
+    foreach ($field in @(
+            'Repository', 'CommitSha', 'ModuleName', 'GalleryVersion', 'VersionPrefix',
+            'ReleaseTag', 'ReleaseType', 'ArtifactSha256', 'AssetName', 'AssetSha256'
+        )) {
+        if ($claim.$field -isnot [string]) {
+            throw "The publication claim requires a scalar string [$field]."
+        }
+    }
     $number = 0L
     if ($claim.Repository -notmatch '^[^/\s]+/[^/\s]+$' -or
+        $claim.PullRequest -is [array] -or
         -not [long]::TryParse([string]$claim.PullRequest, [ref]$number) -or $number -lt 0 -or
         $claim.CommitSha -notmatch '^[0-9a-f]{40}$' -or
         $claim.ModuleName -notmatch '^[A-Za-z0-9][A-Za-z0-9_.-]*$' -or
@@ -623,6 +638,89 @@ function New-PSModuleReleaseArchive {
     [IO.FileInfo]::new($DestinationPath)
 }
 
+function Get-PSModuleReleaseArchiveProof {
+    <#
+        .SYNOPSIS
+        Read the release ZIP and its module payload as one byte-proof snapshot.
+
+        .DESCRIPTION
+        Hashes the archive and exact payload records through the same open stream.
+        The payload uses the canonical file-tree digest without extracting or importing files.
+
+        .EXAMPLE
+        Get-PSModuleReleaseArchiveProof -Path $zipPath -ModuleName TestModule
+
+        Return the archive and payload digests to verify against the tested claim.
+
+        .INPUTS
+        None
+
+        You can't pipe objects to Get-PSModuleReleaseArchiveProof.
+
+        .OUTPUTS
+        System.Management.Automation.PSCustomObject
+
+        The paired archive SHA-256 and canonical payload SHA-256.
+    #>
+    [CmdletBinding()]
+    [OutputType([PSCustomObject])]
+    param(
+        # The exact local release ZIP.
+        [Parameter(Mandatory)]
+        [ValidateNotNullOrEmpty()]
+        [string] $Path,
+
+        # The expected single module root inside the ZIP.
+        [Parameter(Mandatory)]
+        [ValidateNotNullOrEmpty()]
+        [string] $ModuleName
+    )
+
+    $stream = [IO.File]::OpenRead($Path)
+    $sha256 = [Security.Cryptography.SHA256]::Create()
+    $archive = $null
+    try {
+        $assetDigest = [BitConverter]::ToString($sha256.ComputeHash($stream)).Replace('-', '').ToLowerInvariant()
+        $stream.Position = 0
+        $archive = [IO.Compression.ZipArchive]::new($stream, [IO.Compression.ZipArchiveMode]::Read, $true)
+        $prefix = "$ModuleName/"
+        $records = [Collections.Generic.List[object]]::new()
+        foreach ($entry in $archive.Entries) {
+            if (-not $entry.FullName.StartsWith($prefix, [StringComparison]::Ordinal)) {
+                throw 'The release archive contains a foreign or unverifiable module root.'
+            }
+            $relativePath = $entry.FullName.Substring($prefix.Length)
+            if ($entry.FullName.EndsWith('/')) {
+                continue
+            }
+            if (Test-PSModulePackageMetadataPath -Path $relativePath) {
+                throw 'The release archive contains a NuGet-reserved payload path.'
+            }
+            $entryStream = $entry.Open()
+            try {
+                $records.Add([pscustomobject]@{
+                        RelativePath = $relativePath
+                        Length       = $entry.Length
+                        Hash         = $sha256.ComputeHash($entryStream)
+                    })
+            } finally {
+                $entryStream.Dispose()
+            }
+        }
+        if ($records.Count -eq 0) {
+            throw 'The release archive contains no verifiable tested payload.'
+        }
+        [pscustomobject]@{
+            ArtifactSha256 = Get-PSModuleContentDigest -File $records.ToArray()
+            AssetSha256    = $assetDigest
+        }
+    } finally {
+        if ($null -ne $archive) { $archive.Dispose() }
+        $sha256.Dispose()
+        $stream.Dispose()
+    }
+}
+
 function Get-PSModulePackageArtifactDigest {
     <#
         .SYNOPSIS