fix(release): pin metadata across integrations

[sozercan]

Summary

• capture one bounded, authenticated Homebrew metadata bundle before building the release frontend
• bind the bundle manifest digest into release frontend children and require the matching named input at runtime
• reuse the same signed payload bytes across both platforms and every integration, then publish the bundle as release evidence
• keep local component-rebuild mode on live authenticated fetches when no bundle is compiled

Root cause

The v0.2.7 integrations fetched signed Homebrew metadata independently over roughly 35 minutes. The authenticated Formula payload rotated mid-run, so the sign gate correctly rejected the mixed evidence identities.

Verification

• ./scripts/check.sh
• docker buildx bake --print release-children frontend
• go test -race ./internal/config ./internal/frontend ./internal/homebrew/metadata
• go test ./cmd/metadata-bundle ./internal/buildfiles
• bash scripts/live-test-test.sh
• git diff --check
• $autoreview clean after fixing its two accepted P0 findings

[Copilot]

Pull request overview

Pins one authenticated Homebrew metadata bundle across release frontend builds and integrations.

Changes:

• Adds bounded metadata bundle capture, validation, and loading.
• Binds the bundle digest into frontend builds and release integrations.
• Publishes bundle contents as signed release evidence.

Show a summary per file

File	Description
SECURITY.md	Documents pinned metadata guarantees.
scripts/live-test.sh	Supplies bundle context and digest.
scripts/live-test-test.sh	Tests bundle argument handling.
internal/homebrew/metadata/bundle.go	Implements bundle capture and validation.
internal/homebrew/metadata/bundle_test.go	Tests authentication, bounds, and tampering.
internal/frontend/metadata_bundle.go	Loads bundle input in the frontend.
internal/frontend/metadata_bundle_test.go	Tests frontend bundle handling.
internal/frontend/handler.go	Uses bundled or live metadata loading.
internal/config/config.go	Adds compiled digest binding.
internal/config/config_test.go	Tests digest configuration rules.
internal/buildfiles/release_workflow_test.go	Verifies release workflow integration.
internal/buildfiles/dockerfile_test.go	Verifies Dockerfile binding.
docs/release.md	Documents release bundle workflow.
docs/architecture.md	Documents bundle architecture.
Dockerfile	Compiles bundle digest into frontend.
docker-bake.hcl	Propagates the digest to build targets.
cmd/metadata-bundle/main.go	Adds the bundle capture CLI.
cmd/metadata-bundle/main_test.go	Tests bundle output behavior.
.github/workflows/release.yml	Captures, consumes, and publishes bundle evidence.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 20/20 changed files
• Comments generated: 2
• Review effort level: Balanced

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 59766171f1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Review details

Suppressed comments (3)

.github/workflows/release.yml:2455

• These checks only prove that the four bundle assets are nonempty. The later checksum step authenticates each file independently, but neither signing nor promotion recomputes the manifest digest, validates the manifest's size/envelope-digest bindings against the two JWS files, or checks those envelope digests against the integration observations. As a result, the promotion verifier accepts an internally inconsistent signed bundle that cannot reproduce the metadata identity compiled into the frontend. Strictly validate these relationships before signing and repeat that validation during promotion.

          test -s dist/release/metadata-bundle/manifest.json
          test -s dist/release/metadata-bundle/formula.jws.json
          test -s dist/release/metadata-bundle/formula_tap_migrations.jws.json
          test -s dist/release/metadata-bundle.digest

scripts/live-test.sh:93

• This is labeled optional for either mode, but every frontend produced by the updated release workflow has a compiled bundle digest and rejects a published-mode invocation without this setting. The published-component usage example above therefore fails for new releases. Document the bundle as required for current published tuples (including how to reconstruct the flattened release assets), while distinguishing legacy frontends if compatibility is intentional.

       DALEC_HOMEBREW_LIVE_METADATA_BUNDLE=<captured-metadata-directory>

docs/architecture.md:145

• This new mandatory release invocation contract is not reflected in the public build instructions. The production commands in README.md:43-98 and docs/usage.md:45-60,127-139 still pass only DALEC_HOMEBREW_FRONTEND_INDEX_REF; a frontend built by this workflow rejects those commands because the matching bundle digest and named context are absent. Update those examples to obtain/reconstruct the published bundle assets and pass both the digest argument and dalec-homebrew-metadata context.

release inputs: the digest is compiled into both children, and upstream Dalec
must forward the same digest as `DALEC_HOMEBREW_METADATA_BUNDLE_DIGEST` while
the caller supplies the bundle through the fixed
`dalec-homebrew-metadata` named context. A missing context, malformed bundle,
or digest mismatch fails closed. Builds of a frontend without a compiled bundle

• Files reviewed: 20/20 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

internal/frontend/metadata_bundle.go:100

• ReadDir materializes the entire caller-supplied context before the code checks that it has three entries, so a context with a very large root can exhaust frontend/BuildKit memory before failing. Avoid unbounded root enumeration—for example, consume only the three bounded authenticated members and either permit ignored extras or enforce exact inventory through a bounded mechanism.

	entries, err := ref.ReadDir(ctx, gwclient.ReadDirRequest{Path: "/"})

• Files reviewed: 32/32 changed files
• Comments generated: 1
• Review effort level: Balanced

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5a284b6228

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Review details

• Files reviewed: 33/33 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

Suppressed comments (1)

docs/usage.md:16

• The production path described here no longer contacts formulae.brew.sh: a release-bound frontend takes Formula and migration metadata exclusively from the required bundle. Listing that host as required egress now asks operators to allow unnecessary network access; remove it here or qualify it as needed only by unbound local frontends that use the live-fetch fallback.

- The authenticated Homebrew metadata bundle and manifest digest from that
  same release

• Files reviewed: 33/33 changed files
• Comments generated: 0 new
• Review effort level: Balanced

[Copilot]

Review details

• Files reviewed: 33/33 changed files
• Comments generated: 0 new
• Review effort level: Balanced