fix(release): reject malformed publication JSON bytes

[seonghobae]

Purpose

Test-first repair for #114. Immutable-release publication receipt inputs now reject malformed UTF-8 bytes before JSON and release-identity semantics are trusted.

Exact source / test-first identity

• protected/live base: main c85d710804139c0697d7ef8fa47d02b1389e6d84;
• branch: fix/release-publication-fatal-utf8;
• RED head: 865e1d1de927b823f7cdf15c0a20fa73003e7d62;
• GREEN head: c08adafe30fc21c1e2d6ae36418c0d3f63a4afc7.

RCA -> RED -> GREEN

The shared readJson() helper used readFileSync(path, "utf8"), so malformed retained bytes could be normalized into U+FFFD and parsed as a different but structurally valid JSON document before immutable-release semantics were checked.

The RED regression replaces the otherwise valid immutable-policy JSON with byte-invalid UTF-8 in an irrelevant extra field. Application ci run 31439512211 completed failure on exact RED head 865e1d1de927b823f7cdf15c0a20fa73003e7d62; its central Security Scan completed successfully and the predecessor reviewer run was cancelled after the GREEN push, so cancelled predecessor reviewer evidence is not promoted.

GREEN c08adafe30fc21c1e2d6ae36418c0d3f63a4afc7 reads exact bytes for every readJson() input and uses TextDecoder("utf-8", { fatal: true }) before the existing JSON object/identity validators. The change applies consistently to the release evidence manifest, immutable-policy response, release view/API response and verification response without modifying their semantic contracts.

Current exact-head technical evidence

For unchanged GREEN head c08adafe30fc21c1e2d6ae36418c0d3f63a4afc7:

• application ci run 31439576448: terminal success;
• reviewer-ci run 31439576475: terminal success;
• central Security Scan run 31439576419: terminal success;
• central scanner authority was independently re-read at .github revision 6eb06cdd08c79a06f7b390069d4ffa49e2eb7dba, workflow blob c3b8fa5dbbb21a684209683a3d4b6d29c8e0d536: PRs targeting main|master|develop are eligible; OSV and dependency-review are diff-scoped hard gates; fixable MEDIUM/HIGH/CRITICAL Trivy findings are repo-wide hard failures; Scorecard is soft evidence;
• current formal reviews: 0;
• current inline review threads: 0;
• GitHub reports the PR mergeable and Ready for review.

Boundary / authority

This is a publication-evidence byte-decoding hardening. It does not publish a release, prove deployment, modify workflow permissions, select an outbound license, create owner/legal/IP authority, or manufacture acquisition evidence.

Technical exact-head success is not merge authority. Live enforceable governance under #27 and a qualifying independent non-author review path under #29 remain separate fail-closed gates where required. No self-approval, protection weakening, synthetic status, release or deployment is performed.

Related: #5, #112, #114

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 25 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 28a17411-148d-4afa-a5b7-e8174f183338

📥 Commits

Reviewing files that changed from the base of the PR and between c85d710 and c08adaf.

📒 Files selected for processing (2)

• scripts/release-publication-receipt.mjs
• test/immutable-release-publication.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Superseded by protected-main successor #204. Fresh comparison shows #115 and #204 touch the same two paths. #204 preserves #115's fatal UTF-8 publication JSON boundary and malformed-byte regression, then strengthens it by separating file-read failures from UTF-8 decoding and directly asserting receipt-path absence. #204 exact head 2688cdb4587778cca90b20a692dd7bdee4637174 passed application ci 31559657472, reviewer-ci 31559657478, and protected-base eligible central Security Scan 31559657507 with both current CodeRabbit threads resolved, and was merged to protected main as fd0c4e9cc00085ad160602beb0636dd641b7257e. Historical #115 checks/reviews do not transfer; this PR is closed unmerged because its unique behavior is preserved and strengthened on protected main.