fix(security): publish main builds only from pushes to main, and lift oauthlib to 4.0.1

.github/workflows/release.yml

@@ -35,10 +35,14 @@ concurrency:
 
 jobs:
   prepare:
+    # The workflow_run branches filter matches the head branch name, which a
+    # fork PR opened from its own `main` shares; only a push here may publish.
     if: >-
       github.repository == 'Tracer-Cloud/opensre' &&
       (github.event_name != 'workflow_run' ||
-      github.event.workflow_run.conclusion == 'success')
+      (github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_repository.full_name == github.repository))
     runs-on: ubuntu-24.04
     outputs:
       channel: ${{ steps.meta.outputs.channel }}
@@ -81,6 +85,10 @@ jobs:
           fi
 
           if [ "$EVENT_NAME" = "workflow_run" ]; then
+            if ! git merge-base --is-ancestor "$source_sha" refs/remotes/origin/main; then
+              echo "Release source commit is not on main: ${source_sha}" >&2
+              exit 1
+            fi
             released_sha="$(git rev-parse -q --verify "refs/tags/main-build^{commit}" || true)"
             if [ -n "$released_sha" ]; then
               if ! git merge-base --is-ancestor "$released_sha" "$source_sha"; then

integrations/neon/client.py

@@ -8,7 +8,6 @@
 
 from __future__ import annotations
 
-import logging
 import re
 from http import HTTPStatus
 from typing import Any
@@ -19,8 +18,6 @@
 from integrations.neon.config import NeonConfig
 from integrations.probes import ProbeResult
 
-logger = logging.getLogger(__name__)
-
 _MAX_PATH_SEGMENT_LEN = 128
 # Neon project/branch IDs and bucket names are lowercase slugs: letters,
 # digits, hyphens (bucket names may also hold dots). Reject anything else so a

pyproject.toml

@@ -265,6 +265,8 @@ constraint-dependencies = [
     "setuptools>=84.1.0",
     # GHSA-45c3-73f7-pv4m (via pymongo).
     "dnspython>=2.9.0",
+    # GHSA-3jp2-3mrg-2vxc (via kubernetes).
+    "oauthlib>=4.0.1",
 ]
 # litellm caps filelock below 4, and GHSA-v4x8-3wr5-3wq8 (high), GHSA-9vhv-jxww-xfm5
 # and GHSA-567q-5qvw-pf92 have no 3.x fix. 4.0 changed only SoftReadWriteLock's

tests/packaging/test_release_manifest.py

@@ -168,6 +168,13 @@ def test_release_workflow_does_not_run_on_pull_requests() -> None:
     assert 'echo "channel=pr" >> "$GITHUB_OUTPUT"' not in workflow
     assert "opensre_pr_" not in workflow
 
+    # A fork PR from its own `main` passes the branches filter, so the CI run
+    # must also be a push to this repository and the commit must be on main.
+    prepare_if = yaml.load(workflow, Loader=yaml.BaseLoader)["jobs"]["prepare"]["if"]
+    assert "github.event.workflow_run.event == 'push'" in prepare_if
+    assert "github.event.workflow_run.head_repository.full_name == github.repository" in prepare_if
+    assert 'git merge-base --is-ancestor "$source_sha" refs/remotes/origin/main' in workflow
+
 
 def test_release_workflow_does_not_publish_python_distributions_to_pypi() -> None:
     raw = _RELEASE_WORKFLOW.read_text(encoding="utf-8")