From 8ad8c3dbd5c9b1ee9c988995d9e5628b258ea9ae Mon Sep 17 00:00:00 2001 From: shaurya2k06 Date: Wed, 19 Aug 2026 00:38:10 +0530 Subject: [PATCH 1/4] fix: require tag-pinned catalog download URLs (#4185) Reject floating releases/latest URLs in the community catalog agent workflows and require the URL tag to match the submitted version. Refs #4185 Assisted-by: Cursor Grok 4.6 (supervised) Signed-off-by: shaurya2k06 --- .github/workflows/add-community-bundle.md | 13 +++++++++---- .github/workflows/add-community-extension.md | 10 ++++++++-- .github/workflows/add-community-preset.md | 10 ++++++++-- tests/test_github_workflows.py | 16 ++++++++++++++++ 4 files changed, 41 insertions(+), 8 deletions(-) diff --git a/.github/workflows/add-community-bundle.md b/.github/workflows/add-community-bundle.md index a54a35f890..677cf5ec60 100644 --- a/.github/workflows/add-community-bundle.md +++ b/.github/workflows/add-community-bundle.md @@ -118,11 +118,16 @@ Run every check and collect all failures before deciding the outcome. ### 2c. Release artifact -- The download URL must be an HTTPS GitHub release asset URL under the submitted - repository: +- The download URL MUST follow the accepted tag-pinned pattern under the + submitted repository: `https://github.com///releases/download//.zip`. -- Confirm the release exists, its tag corresponds to the submitted version - (`vX.Y.Z` or `X.Y.Z`), and the exact ZIP asset is attached to that release. +- If the download URL path contains `releases/latest/`, reject with an + explanation — this URL is floating and not acceptable. Fail immediately, + before any HTTP check. +- The version segment embedded in the URL (`/download//`) MUST match the + submitted version (`vX.Y.Z` or `X.Y.Z`). +- Only after the pinning checks pass: confirm the release exists, the exact ZIP + asset is attached to that release, and the download URL returns HTTP 200. - Confirm the asset name is versioned and consistent with the submitted bundle ID and version. diff --git a/.github/workflows/add-community-extension.md b/.github/workflows/add-community-extension.md index 0521e52100..4c75736227 100644 --- a/.github/workflows/add-community-extension.md +++ b/.github/workflows/add-community-extension.md @@ -110,11 +110,17 @@ deciding pass/fail: - Confirm the repository contains a `LICENSE` file ### 2d. Release and download URL validation -- The download URL should follow the pattern +- The download URL MUST follow one of the accepted tag-pinned patterns: `https://github.com///archive/refs/tags/v.zip` or `https://github.com///releases/download//.zip` -- Verify a GitHub release exists matching the submitted version +- If the download URL path contains `releases/latest/`, reject with an + explanation — this URL is floating and not acceptable. Fail immediately, + before any HTTP check. +- The version segment embedded in the URL (`/tags/v.zip` or + `/download//`) MUST match the submitted version (`vX.Y.Z` or `X.Y.Z`). +- Only after the pinning checks pass: verify a GitHub release exists matching + the submitted version, and that the download URL returns HTTP 200. ### 2e. Submission checklists - Confirm that all required checkboxes in the Testing Checklist and Submission diff --git a/.github/workflows/add-community-preset.md b/.github/workflows/add-community-preset.md index 038fbbe1a1..0e1bb87e05 100644 --- a/.github/workflows/add-community-preset.md +++ b/.github/workflows/add-community-preset.md @@ -161,11 +161,17 @@ preset** — not just any file named `README.md`, and not a product/framework pi `specify preset add ...` command for this preset; otherwise it fails check 2d above. ### 2e. Release and download URL validation -- The download URL should follow the pattern +- The download URL MUST follow one of the accepted tag-pinned patterns: `https://github.com///archive/refs/tags/v.zip` or `https://github.com///releases/download//.zip` -- Verify a GitHub release exists matching the submitted version +- If the download URL path contains `releases/latest/`, reject with an + explanation — this URL is floating and not acceptable. Fail immediately, + before any HTTP check. +- The version segment embedded in the URL (`/tags/v.zip` or + `/download//`) MUST match the submitted version (`vX.Y.Z` or `X.Y.Z`). +- Only after the pinning checks pass: verify a GitHub release exists matching + the submitted version, and that the download URL returns HTTP 200. ### 2f. Submission checklists - Confirm that all required checkboxes in the Testing Checklist and Submission diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py index aeb8ad7e21..cd7f210782 100644 --- a/tests/test_github_workflows.py +++ b/tests/test_github_workflows.py @@ -111,6 +111,22 @@ def test_community_submission_automation_is_wired_to_allowed_files(): assert label in assignment_text +def test_community_submission_workflows_require_tag_pinned_download_urls(): + """Catalog agents must reject floating releases/latest URLs (issue #4185).""" + for workflow, *_ in COMMUNITY_SUBMISSION_WORKFLOWS: + source_text = (WORKFLOWS_DIR / f"add-community-{workflow}.md").read_text( + encoding="utf-8" + ) + lowered = source_text.lower() + + assert "should follow the pattern" not in lowered + assert "releases/latest/" in source_text + assert "reject" in lowered + assert "vX.Y.Z" in source_text + assert "X.Y.Z" in source_text + assert "MUST" in source_text or "must" in lowered + + def test_community_submission_allowed_files_do_not_include_other_catalogs_or_docs(): allowed_by_workflow = { workflow: set( From efed88dd25433506510d7b81867b557b627847b8 Mon Sep 17 00:00:00 2001 From: shaurya2k06 Date: Wed, 19 Aug 2026 21:23:25 +0530 Subject: [PATCH 2/4] test: assert both catalog tag forms together Separate substring checks for vX.Y.Z and X.Y.Z were not independent. Refs #4185 Assisted-by: Cursor Grok 4.6 (supervised) Signed-off-by: shaurya2k06 --- tests/test_github_workflows.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py index cd7f210782..63cb737f5a 100644 --- a/tests/test_github_workflows.py +++ b/tests/test_github_workflows.py @@ -122,8 +122,7 @@ def test_community_submission_workflows_require_tag_pinned_download_urls(): assert "should follow the pattern" not in lowered assert "releases/latest/" in source_text assert "reject" in lowered - assert "vX.Y.Z" in source_text - assert "X.Y.Z" in source_text + assert "`vX.Y.Z` or `X.Y.Z`" in source_text assert "MUST" in source_text or "must" in lowered From 1c92d29ed3bfc28fb7a66e9782f31b21781f598b Mon Sep 17 00:00:00 2001 From: shaurya2k06 Date: Thu, 20 Aug 2026 18:44:57 +0530 Subject: [PATCH 3/4] fix: allow scoped catalog tags and same-repo download URLs Keep tag-pinned URLs but accept suffixes like aide-v1.0.0, require download_url to match the submitted repository, and treat sha256 as optional follow-up rather than a hard catalog gate. Refs #4185 Assisted-by: Cursor Grok 4.6 (supervised) Signed-off-by: shaurya2k06 --- .github/workflows/add-community-bundle.md | 15 ++++-- .github/workflows/add-community-extension.md | 18 +++++-- .github/workflows/add-community-preset.md | 18 +++++-- tests/test_github_workflows.py | 52 +++++++++++++++++--- 4 files changed, 83 insertions(+), 20 deletions(-) diff --git a/.github/workflows/add-community-bundle.md b/.github/workflows/add-community-bundle.md index 677cf5ec60..6be3b1f26e 100644 --- a/.github/workflows/add-community-bundle.md +++ b/.github/workflows/add-community-bundle.md @@ -118,14 +118,21 @@ Run every check and collect all failures before deciding the outcome. ### 2c. Release artifact -- The download URL MUST follow the accepted tag-pinned pattern under the - submitted repository: +- The download URL MUST belong to the submitted repository + (`https://github.com///...` with the same `/` as + the Repository URL). Reject URLs for any other GitHub repository. +- The download URL MUST follow the accepted tag-pinned pattern: `https://github.com///releases/download//.zip`. - If the download URL path contains `releases/latest/`, reject with an explanation — this URL is floating and not acceptable. Fail immediately, before any HTTP check. -- The version segment embedded in the URL (`/download//`) MUST match the - submitted version (`vX.Y.Z` or `X.Y.Z`). +- The `` segment in the URL MUST correspond to the submitted version. + Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches + (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose + embedded semver does not equal the submitted version. +- `sha256` is optional. If the submission includes it, verify it matches the + downloaded archive. Requiring `sha256` on every catalog entry is follow-up + work and MUST NOT fail this check when the field is absent. - Only after the pinning checks pass: confirm the release exists, the exact ZIP asset is attached to that release, and the download URL returns HTTP 200. - Confirm the asset name is versioned and consistent with the submitted bundle diff --git a/.github/workflows/add-community-extension.md b/.github/workflows/add-community-extension.md index 4c75736227..cf1344fe6a 100644 --- a/.github/workflows/add-community-extension.md +++ b/.github/workflows/add-community-extension.md @@ -110,17 +110,25 @@ deciding pass/fail: - Confirm the repository contains a `LICENSE` file ### 2d. Release and download URL validation +- The download URL MUST belong to the submitted repository + (`https://github.com///...` with the same `/` as + the Repository URL). Reject URLs for any other GitHub repository. - The download URL MUST follow one of the accepted tag-pinned patterns: - `https://github.com///archive/refs/tags/v.zip` + `https://github.com///archive/refs/tags/.zip` or `https://github.com///releases/download//.zip` - If the download URL path contains `releases/latest/`, reject with an explanation — this URL is floating and not acceptable. Fail immediately, before any HTTP check. -- The version segment embedded in the URL (`/tags/v.zip` or - `/download//`) MUST match the submitted version (`vX.Y.Z` or `X.Y.Z`). -- Only after the pinning checks pass: verify a GitHub release exists matching - the submitted version, and that the download URL returns HTTP 200. +- The `` segment in the URL MUST correspond to the submitted version. + Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches + (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose + embedded semver does not equal the submitted version. +- `sha256` is optional. If the submission includes it, verify it matches the + downloaded archive. Requiring `sha256` on every catalog entry is follow-up + work and MUST NOT fail this check when the field is absent. +- Only after the pinning checks pass: verify a GitHub release exists for that + tag, and that the download URL returns HTTP 200. ### 2e. Submission checklists - Confirm that all required checkboxes in the Testing Checklist and Submission diff --git a/.github/workflows/add-community-preset.md b/.github/workflows/add-community-preset.md index 0e1bb87e05..f46b95d8b5 100644 --- a/.github/workflows/add-community-preset.md +++ b/.github/workflows/add-community-preset.md @@ -161,17 +161,25 @@ preset** — not just any file named `README.md`, and not a product/framework pi `specify preset add ...` command for this preset; otherwise it fails check 2d above. ### 2e. Release and download URL validation +- The download URL MUST belong to the submitted repository + (`https://github.com///...` with the same `/` as + the Repository URL). Reject URLs for any other GitHub repository. - The download URL MUST follow one of the accepted tag-pinned patterns: - `https://github.com///archive/refs/tags/v.zip` + `https://github.com///archive/refs/tags/.zip` or `https://github.com///releases/download//.zip` - If the download URL path contains `releases/latest/`, reject with an explanation — this URL is floating and not acceptable. Fail immediately, before any HTTP check. -- The version segment embedded in the URL (`/tags/v.zip` or - `/download//`) MUST match the submitted version (`vX.Y.Z` or `X.Y.Z`). -- Only after the pinning checks pass: verify a GitHub release exists matching - the submitted version, and that the download URL returns HTTP 200. +- The `` segment in the URL MUST correspond to the submitted version. + Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches + (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose + embedded semver does not equal the submitted version. +- `sha256` is optional. If the submission includes it, verify it matches the + downloaded archive. Requiring `sha256` on every catalog entry is follow-up + work and MUST NOT fail this check when the field is absent. +- Only after the pinning checks pass: verify a GitHub release exists for that + tag, and that the download URL returns HTTP 200. ### 2f. Submission checklists - Confirm that all required checkboxes in the Testing Checklist and Submission diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py index 63cb737f5a..81df58c97d 100644 --- a/tests/test_github_workflows.py +++ b/tests/test_github_workflows.py @@ -111,19 +111,59 @@ def test_community_submission_automation_is_wired_to_allowed_files(): assert label in assignment_text +# Full clauses from the catalog download-URL checks (issue #4185). Assert the +# complete sentences so independent keywords cannot drift apart. +_CATALOG_DOWNLOAD_URL_CLAUSES = ( + ( + "The download URL MUST belong to the submitted repository\n" + " (`https://github.com///...` with the same `/` as\n" + " the Repository URL). Reject URLs for any other GitHub repository." + ), + ( + "If the download URL path contains `releases/latest/`, reject with an\n" + " explanation — this URL is floating and not acceptable. Fail immediately,\n" + " before any HTTP check." + ), + ( + "The `` segment in the URL MUST correspond to the submitted version.\n" + " Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches\n" + " (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose\n" + " embedded semver does not equal the submitted version." + ), + ( + "`sha256` is optional. If the submission includes it, verify it matches the\n" + " downloaded archive. Requiring `sha256` on every catalog entry is follow-up\n" + " work and MUST NOT fail this check when the field is absent." + ), +) + + def test_community_submission_workflows_require_tag_pinned_download_urls(): """Catalog agents must reject floating releases/latest URLs (issue #4185).""" for workflow, *_ in COMMUNITY_SUBMISSION_WORKFLOWS: source_text = (WORKFLOWS_DIR / f"add-community-{workflow}.md").read_text( encoding="utf-8" ) - lowered = source_text.lower() - assert "should follow the pattern" not in lowered - assert "releases/latest/" in source_text - assert "reject" in lowered - assert "`vX.Y.Z` or `X.Y.Z`" in source_text - assert "MUST" in source_text or "must" in lowered + assert "should follow the pattern" not in source_text.lower() + for clause in _CATALOG_DOWNLOAD_URL_CLAUSES: + assert clause in source_text, f"missing clause in {workflow}: {clause!r}" + + if workflow == "bundle": + assert ( + "`https://github.com///releases/download//.zip`." + in source_text + ) + assert "archive/refs/tags/" not in source_text + else: + assert ( + "`https://github.com///archive/refs/tags/.zip`" + in source_text + ) + assert ( + "`https://github.com///releases/download//.zip`" + in source_text + ) def test_community_submission_allowed_files_do_not_include_other_catalogs_or_docs(): From 45295ea2a81831f415e0638a52d276b9114a5b87 Mon Sep 17 00:00:00 2001 From: shaurya2k06 Date: Thu, 20 Aug 2026 18:57:11 +0530 Subject: [PATCH 4/4] fix: keep collecting catalog validation failures after a latest URL Skip the HTTP check for a floating releases/latest URL without aborting the rest of Step 2. Refs #4185 Assisted-by: Cursor Grok 4.6 (supervised) Signed-off-by: shaurya2k06 --- .github/workflows/add-community-bundle.md | 5 +++-- .github/workflows/add-community-extension.md | 5 +++-- .github/workflows/add-community-preset.md | 5 +++-- tests/test_github_workflows.py | 5 +++-- 4 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.github/workflows/add-community-bundle.md b/.github/workflows/add-community-bundle.md index 6be3b1f26e..b7c4da15a9 100644 --- a/.github/workflows/add-community-bundle.md +++ b/.github/workflows/add-community-bundle.md @@ -124,8 +124,9 @@ Run every check and collect all failures before deciding the outcome. - The download URL MUST follow the accepted tag-pinned pattern: `https://github.com///releases/download//.zip`. - If the download URL path contains `releases/latest/`, reject with an - explanation — this URL is floating and not acceptable. Fail immediately, - before any HTTP check. + explanation — this URL is floating and not acceptable. Mark this pinning + check failed and skip the HTTP request for this URL, then continue the + remaining validations. - The `` segment in the URL MUST correspond to the submitted version. Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose diff --git a/.github/workflows/add-community-extension.md b/.github/workflows/add-community-extension.md index cf1344fe6a..3ef2637244 100644 --- a/.github/workflows/add-community-extension.md +++ b/.github/workflows/add-community-extension.md @@ -118,8 +118,9 @@ deciding pass/fail: or `https://github.com///releases/download//.zip` - If the download URL path contains `releases/latest/`, reject with an - explanation — this URL is floating and not acceptable. Fail immediately, - before any HTTP check. + explanation — this URL is floating and not acceptable. Mark this pinning + check failed and skip the HTTP request for this URL, then continue the + remaining validations. - The `` segment in the URL MUST correspond to the submitted version. Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose diff --git a/.github/workflows/add-community-preset.md b/.github/workflows/add-community-preset.md index f46b95d8b5..9eaaadedb0 100644 --- a/.github/workflows/add-community-preset.md +++ b/.github/workflows/add-community-preset.md @@ -169,8 +169,9 @@ preset** — not just any file named `README.md`, and not a product/framework pi or `https://github.com///releases/download//.zip` - If the download URL path contains `releases/latest/`, reject with an - explanation — this URL is floating and not acceptable. Fail immediately, - before any HTTP check. + explanation — this URL is floating and not acceptable. Mark this pinning + check failed and skip the HTTP request for this URL, then continue the + remaining validations. - The `` segment in the URL MUST correspond to the submitted version. Accept `vX.Y.Z`, `X.Y.Z`, and scoped tags whose version suffix matches (for example `aide-v1.0.0` for version `1.0.0`). Reject a tag whose diff --git a/tests/test_github_workflows.py b/tests/test_github_workflows.py index 81df58c97d..c54804727d 100644 --- a/tests/test_github_workflows.py +++ b/tests/test_github_workflows.py @@ -121,8 +121,9 @@ def test_community_submission_automation_is_wired_to_allowed_files(): ), ( "If the download URL path contains `releases/latest/`, reject with an\n" - " explanation — this URL is floating and not acceptable. Fail immediately,\n" - " before any HTTP check." + " explanation — this URL is floating and not acceptable. Mark this pinning\n" + " check failed and skip the HTTP request for this URL, then continue the\n" + " remaining validations." ), ( "The `` segment in the URL MUST correspond to the submitted version.\n"