Start every Server pip install from the patched, bundle-only pip (GHSA-6q48-6c7w-9gw2)

.github/workflows/helm-chart-checks.yml

@@ -1,12 +1,8 @@
 name: Reusable Helm Chart Checks
 
 on:
+  # Callers validate their own commit; checkout uses it by default.
   workflow_call:
-    inputs:
-      source_ref:
-        description: Exact Server source revision to validate
-        required: true
-        type: string
 
 permissions:
   contents: read
@@ -35,7 +31,6 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ inputs.source_ref }}
 
       - name: Enforce immutable chart versioning
         env:
@@ -61,10 +56,22 @@ jobs:
             echo "::endgroup::"
           done
 
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+
       - name: Check database CA mounts and bootstrap configuration
+        # pip also trusts the runner's own store (truststore). legacy-certs
+        # keeps it to the bundle the bootstrap action checked.
+        env:
+          PIP_USE_DEPRECATED: legacy-certs
         run: |
-          python3 -m pip install --only-binary :all: PyYAML==6.0.2
-          python3 scripts/ci/test_database_tls_chart.py
+          python -I -m pip install --only-binary :all: PyYAML==6.0.2
+          python scripts/ci/test_database_tls_chart.py
 
       - name: Render every CI fixture
         run: |
@@ -129,20 +136,27 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-          ref: ${{ inputs.source_ref }}
 
       - name: Set up Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
+
       - name: Set up Helm
         uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310  # v5
         with:
           version: ${{ env.HELM_VERSION }}
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f  # v2.8.0
+        # The action installs its tools with its own venv's pip. Point that pip
+        # at the bundle the bootstrap action checked, and only that bundle.
+        env:
+          PIP_CERT: ${{ env.pythonLocation }}/lib/python3.12/site-packages/pip/_vendor/certifi/cacert.pem
+          PIP_USE_DEPRECATED: legacy-certs
         with:
           version: ${{ env.CHART_TESTING_VERSION }}
           yamllint_version: ${{ env.YAMLLINT_VERSION }}

.github/workflows/helm-chart-release.yml

@@ -25,8 +25,6 @@ jobs:
     permissions:
       contents: read
     uses: ./.github/workflows/helm-chart-checks.yml  # local
-    with:
-      source_ref: ${{ github.sha }}
 
   publish:
     name: Publish protected chart source

.github/workflows/helm-chart-validation.yml

@@ -26,5 +26,3 @@ jobs:
     permissions:
       contents: read
     uses: ./.github/workflows/helm-chart-checks.yml  # local
-    with:
-      source_ref: ${{ github.sha }}

.github/workflows/phpunit-feature.yml

@@ -48,6 +48,8 @@ jobs:
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.13"
+      - name: Bootstrap patched pip trust
+        uses: durable-workflow/.github/.github/actions/bootstrap-patched-pip@75587fc33ff40c34f32ef777293dad56bb6f48c7  # clean-trust
       - name: Install policy dependencies
         run: python -m pip install PyYAML==6.0.2
       - name: Require centrally approved immutable action commits
@@ -93,21 +95,28 @@ jobs:
         run: php scripts/ci/test-workflow-package-authority.php
 
       - name: Install worker OpenAPI validation dependencies
+        # In the pinned Composer image, whose CA store is checked, not with the
+        # runner's own store (GHSA-6q48-6c7w-9gw2).
         run: >-
-          composer install
+          docker run --rm --user "$(id -u):$(id -g)" -e COMPOSER_HOME=/tmp/composer
+          -v "$PWD:/app" -w /app composer:2.10.3@sha256:da624c2c705d54e2f5a9bb77a5dc6c7d091711433ebefd7035672e84c2010fee
+          install
           --no-dev
           --no-scripts
           --no-interaction
           --no-progress
           --prefer-dist
+          --ignore-platform-reqs
 
       - name: Require versioned worker OpenAPI evolution
         env:
           OPENAPI_BASE_REF: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event_name == 'merge_group' && github.event.merge_group.base_sha || github.event_name == 'push' && github.event.before || inputs.corpus_base_ref }}
         run: php scripts/ci/check-worker-openapi-evolution.php "$OPENAPI_BASE_REF"
 
       - name: Audit locked PHP dependencies
-        run: composer audit --locked --no-interaction
+        # In the pinned Composer image, whose CA store is checked (GHSA-6q48-6c7w-9gw2).
+        run: >-
+          docker run --rm --user "$(id -u):$(id -g)" -e COMPOSER_HOME=/tmp/composer -v "$PWD:/app:ro" -w /app composer:2.10.3@sha256:da624c2c705d54e2f5a9bb77a5dc6c7d091711433ebefd7035672e84c2010fee audit --locked --no-interaction
 
       - name: Require durable codec evidence
         env:
@@ -124,6 +133,25 @@ jobs:
       - name: Prove corpus policy guards cannot be weakened
         run: python scripts/ci/test-regression-corpus-policy.py
 
+      - name: Prove pip starts from the patched, root-checked bootstrap
+        run: python3 -m unittest tests/Unit/Support/patched_pip_test.py
+
+      - name: Prove cargo trusts only a checked CA file and an empty directory
+        env:
+          DW_REQUIRE_CARGO_TRUST_TEST: '1'
+        run: python3 -m unittest tests/Unit/Support/cargo_trust_test.py
+
+      - name: Prove every active Cargo.lock resolves the fixed TLS trust crates
+        run: python3 -m unittest tests/Unit/Support/cargo_lock_trust_test.py
+
+      - name: Prove Composer runs pinned or confined to a checked CA file
+        env:
+          DW_REQUIRE_COMPOSER_TRUST_TEST: '1'
+        run: python3 -m unittest tests/Unit/Support/composer_trust_test.py tests/Unit/Support/release_composer_audit_test.py
+
+      - name: Prove the image installs and checks the fixed Brotli decoder
+        run: python3 -m unittest tests/Unit/Support/brotli_trust_test.py
+
   feature:
     name: PHPUnit feature suite
     needs: action-policy
@@ -146,8 +174,6 @@ jobs:
 
       - name: Cache public mirrored build inputs under their canonical image names
         run: |
-          docker pull mirror.gcr.io/library/composer:2
-          docker tag mirror.gcr.io/library/composer:2 composer:2
           docker pull mirror.gcr.io/library/php:8.3-apache
           docker tag mirror.gcr.io/library/php:8.3-apache php:8.3-apache
 
@@ -201,7 +227,8 @@ jobs:
           FROM durable-workflow-server-phpunit-base
           RUN apt-get update \
               && apt-get install -y --no-install-recommends git \
-              && rm -rf /var/lib/apt/lists/*
+              && rm -rf /var/lib/apt/lists/* \
+              && server-verify-trust final
           DOCKERFILE
           docker network create \
             "dw-server-feature-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.job }}"

.github/workflows/release.yml

@@ -98,7 +98,7 @@ jobs:
           printf 'version=%s\n' "$version" >> "$GITHUB_OUTPUT"
 
       - name: Audit immutable PHP release dependencies
-        run: composer audit --working-dir=release-source --locked --no-dev --no-interaction
+        run: sh scripts/ci/audit-immutable-release.sh release-source
 
       - name: Validate release publish context and credentials
         id: release_publish