fix(release): reject ignored runtime source and bytecode

Author: Coding-Dev-Tools

scripts/check_release_readiness.py

@@ -32,7 +32,12 @@
 _COMMIT = re.compile(r"[a-f0-9]{40}\Z")
 _MAX_BYTES = 8 * 1024 * 1024
 _EXECUTABLE_SUFFIXES = frozenset({
-    ".dll", ".dylib", ".exe", ".node", ".pyd", ".pyc", ".pyo", ".so",
+    # Source files are included because an ignored module such as
+    # ``sitecustomize.py`` executes before the candidate package and can alter
+    # imports even when the tracked tree is clean.
+    ".bat", ".cjs", ".cmd", ".css", ".dll", ".dylib", ".exe", ".html",
+    ".js", ".jsx", ".mjs", ".node", ".ps1", ".pyd", ".py", ".pyc", ".pyo",
+    ".pyw", ".sh", ".so", ".ts", ".tsx",
 })
 _IGNORED_RUNTIME_DIRS = frozenset({
     ".codex-pytest-tmp", ".hosted-eval-results", ".playwright", ".private-eval",
@@ -87,18 +92,12 @@ def _ignored_executable_paths(root: Path) -> list[str]:
     """Return ignored executable artifacts that can affect a source checkout.
 
     ``git status`` deliberately hides ignored files. Release qualification may
-    import source from the checkout, so an ignored bytecode/native artifact can
-    change behavior even when the tracked tree is clean. Standard tool caches
-    are excluded; bytecode under ``__pycache__`` is allowed only when it maps to
-    a tracked Python source file.
+    import source from the checkout, so an ignored source, bytecode, native
+    artifact or runtime script can change behavior even when the tracked tree
+    is clean. Standard tool/runtime directories are excluded because they are
+    not candidate source paths; all matching artifacts elsewhere fail closed,
+    including bytecode under ``__pycache__``.
     """
-    tracked = {
-        Path(os.fsdecode(entry)).as_posix()
-        for entry in subprocess.check_output(
-            ["git", "ls-files", "-z"], cwd=root, stderr=subprocess.DEVNULL
-        ).split(b"\0")
-        if entry
-    }
     ignored = subprocess.check_output(
         ["git", "ls-files", "--others", "--ignored", "--exclude-standard", "-z"],
         cwd=root, stderr=subprocess.DEVNULL,
@@ -113,13 +112,6 @@ def _ignored_executable_paths(root: Path) -> list[str]:
         parts = {part.lower() for part in relative.parts}
         if parts & _IGNORED_RUNTIME_DIRS:
             continue
-        if "__pycache__" in parts:
-            cache_index = next(index for index, part in enumerate(relative.parts)
-                               if part.lower() == "__pycache__")
-            stem = relative.name.split(".", 1)[0]
-            source = Path(*relative.parts[:cache_index]) / (stem + ".py")
-            if source.as_posix() in tracked:
-                continue
         suspicious.append(relative.as_posix())
     return suspicious
 

tests/test_product_release_readiness.py

@@ -1,6 +1,8 @@
 """A checklist label cannot bypass missing, stale or contradictory evidence."""
 import hashlib
+import importlib.util
 import json
+import py_compile
 import subprocess
 
 import pytest
@@ -271,6 +273,54 @@ def test_ignored_executable_artifact_cannot_qualify_candidate(ledger, tmp_path):
     assert not result["valid"]
 
 
+def test_ignored_importable_source_cannot_qualify_candidate(ledger, tmp_path):
+    repository = tmp_path / "ignored-source-repo"
+    repository.mkdir()
+    (repository / ".gitignore").write_text("sitecustomize.py\n", encoding="utf-8")
+    (repository / "engine.py").write_text("original", encoding="utf-8")
+    subprocess.run(["git", "init", "--quiet", str(repository)], check=True)
+    subprocess.run(["git", "add", ".gitignore", "engine.py"], cwd=repository, check=True)
+    subprocess.run(["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                    "commit", "--quiet", "-m", "fixture"], cwd=repository, check=True)
+    ledger["components"]["engine"]["commit"] = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=repository, text=True).strip()
+    ledger["candidate_id"] = candidate_id(ledger["components"])
+    for name in RELEASE_GATES:
+        pass_gate(ledger, tmp_path, name)
+    (repository / "sitecustomize.py").write_text("raise RuntimeError('ignored')\n", encoding="utf-8")
+    result = validate(ledger, tmp_path, engine_root=repository)
+    assert not result["engine_checkout_verified"]
+    assert any("sitecustomize.py" in error for error in result["errors"])
+    assert not result["valid"]
+
+
+def test_unchecked_hash_bytecode_cannot_qualify_candidate(ledger, tmp_path):
+    repository = tmp_path / "unchecked-bytecode-repo"
+    repository.mkdir()
+    (repository / ".gitignore").write_text("__pycache__/\n", encoding="utf-8")
+    source = repository / "engine.py"
+    source.write_text("value = 'tracked'\n", encoding="utf-8")
+    subprocess.run(["git", "init", "--quiet", str(repository)], check=True)
+    subprocess.run(["git", "add", ".gitignore", "engine.py"], cwd=repository, check=True)
+    subprocess.run(["git", "-c", "user.name=Fixture", "-c", "user.email=fixture@example.invalid",
+                    "commit", "--quiet", "-m", "fixture"], cwd=repository, check=True)
+    ledger["components"]["engine"]["commit"] = subprocess.check_output(
+        ["git", "rev-parse", "HEAD"], cwd=repository, text=True).strip()
+    ledger["candidate_id"] = candidate_id(ledger["components"])
+    for name in RELEASE_GATES:
+        pass_gate(ledger, tmp_path, name)
+    py_compile.compile(
+        str(source),
+        cfile=importlib.util.cache_from_source(str(source)),
+        doraise=True,
+        invalidation_mode=py_compile.PycInvalidationMode.UNCHECKED_HASH,
+    )
+    result = validate(ledger, tmp_path, engine_root=repository)
+    assert not result["engine_checkout_verified"]
+    assert any("__pycache__" in error for error in result["errors"])
+    assert not result["valid"]
+
+
 @pytest.mark.parametrize("flag", ["--assume-unchanged", "--skip-worktree"])
 def test_hidden_git_changes_cannot_qualify_candidate(ledger, tmp_path, flag):
     repository = tmp_path / "hidden-repo"