test(ci): disposable synthetic Git atomic lease provider probe

.github/workflows/sourcefree-exact-pr-preflight.yml

@@ -0,0 +1,77 @@
+name: Synthetic exact-head PR admission proof
+on:
+  push:
+    branches: [ci/synthetic-native-git-lease-probe-20261030]
+permissions:
+  contents: read
+  pull-requests: read
+jobs:
+  source-free-head-admission:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 7
+    steps:
+      - name: Verify GitHub API PR head matches exact workflow commit
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REPOSITORY" = 'zed-pkg-test/python-lib'
+          expected_sha="$GITHUB_SHA"
+          [[ "$expected_sha" =~ ^[0-9a-f]{40}$ ]]
+          command -v gh
+          receipt="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/3" \
+            --jq '[.head.sha, .head.repo.full_name, .state, (.head.repo.private|tostring)] | @tsv')"
+          IFS=$'\t' read -r actual_sha actual_repo state private <<< "$receipt"
+          test "$actual_sha" = "$expected_sha"
+          test "$actual_repo" = "$GITHUB_REPOSITORY"
+          test "$state" = 'open'
+          test "$private" = 'false'
+          if [[ "$actual_sha" == 0000000000000000000000000000000000000000 ]]; then
+            echo "CRITICAL: invalid source commit admitted" >&2
+            exit 1
+          fi
+          echo 'SOURCEFREE_EXACT_PR_SHA_ADMISSION=PASS'
+      - name: Checkout pinned exact public source-free commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          ref: ${{ github.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+          submodules: false
+          lfs: false
+      - name: Verify checked out tree and no persisted checkout credentials
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          git diff --quiet --exit-code
+          test -z "$(git ls-files --others --exclude-standard)"
+          test -f .github/workflows/synthetic-native-git-lease-probe.yml
+          test -f .github/workflows/sourcefree-exact-pr-preflight.yml
+          echo "SOURCEFREE_EXACT_TREE_SHA=$(git rev-parse 'HEAD^{tree}')"
+          echo 'SOURCEFREE_EXACT_CHECKOUT=PASS'
+      - name: Verify source-free fail-closed negative gates against live GitHub
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REPOSITORY" = "zed-pkg-test/python-lib"
+          protected_main="$(gh api "repos/${GITHUB_REPOSITORY}/branches/main" --jq '.protected')"
+          test "$protected_main" = "false"
+          echo "UNPROTECTED_MAIN_WOULD_BE_DENIED=PASS"
+          last_review="$(gh api "repos/${GITHUB_REPOSITORY}/pulls/3/reviews?per_page=100" \
+            --jq 'if length >= 100 then "TOO_MANY_REVIEWS" else
+              ([.[] | select(.user.login == "ORESoftware" and .submitted_at != null)]
+               | sort_by(.submitted_at) | last // {}
+               | [(.state // ""), (.commit_id // ""), (.user.id // 0 | tostring)] | @tsv)
+            end')"
+          IFS=$'\t' read -r review_state review_commit reviewer_id <<< "$last_review"
+          test "$review_state" != "APPROVED"
+          echo "UNREVIEWED_PR_WOULD_BE_DENIED=PASS"
+          echo "SOURCEFREE_PROTECTED_MAIN_AND_REVIEW_NEGATIVE_PROBE=PASS"
+      - name: Scope result
+        run: |
+          echo 'Source-free GitHub PR identity/checkout test only.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'This does not verify any private Oreslang code, self-hosted runner, or real guest execution.' >> "$GITHUB_STEP_SUMMARY"

.github/workflows/synthetic-native-git-lease-probe.yml

@@ -0,0 +1,136 @@
+name: Synthetic native Git atomic lease probe
+on:
+  push:
+    branches: [ci/synthetic-native-git-lease-probe-20261030]
+  workflow_dispatch:
+permissions:
+  contents: write
+jobs:
+  native-git-lease:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 8
+    steps:
+      - name: Checkout local test repository only
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Exercise native two-ref atomic compare-and-delete on synthetic refs
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          test "$GITHUB_REPOSITORY" = "zed-pkg-test/python-lib"
+          test "$(git rev-parse HEAD)" = "$GITHUB_SHA"
+          command -v git
+          command -v gh
+          # This credential is scoped to the local Actions repository and is
+          # never copied to another organization or committed to a tree.
+          gh auth setup-git --hostname github.com
+          remote="https://github.com/$GITHUB_REPOSITORY.git"
+          root="ci/sourcefree-lease-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT"
+          a="refs/heads/$root-a"
+          b="refs/heads/$root-b"
+          head="$(git rev-parse HEAD)"
+          moved=""
+          get_sha() {
+            git ls-remote "$remote" "$1" | awk '{print $1}'
+          }
+          cleanup() {
+            # Synthetic test refs only. Never blindly delete an unexpected SHA.
+            set +e
+            for ref in "$a" "$b"; do
+              now="$(get_sha "$ref")"
+              if [[ -z "$now" ]]; then continue; fi
+              if [[ "$now" == "$head" || ( -n "$moved" && "$now" == "$moved" ) ]]; then
+                git push --force-with-lease="$ref:$now" "$remote" ":$ref" >/dev/null 2>&1
+              else
+                echo "SYNTHETIC_REF_CLEANUP_REQUIRES_REVIEW=$ref" >&2
+              fi
+            done
+          }
+          trap cleanup EXIT
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+          git push --atomic "$remote" "HEAD:$a" "HEAD:$b" >/dev/null
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$head"
+          echo "EXACT_TWO_REF_INITIALIZATION=PASS"
+
+          # Another writer moves B after the first read. The stale deletion
+          # must fail atomically, leaving A untouched and B at the new SHA.
+          export GIT_AUTHOR_NAME="Synthetic Git Probe"
+          export GIT_AUTHOR_EMAIL="synthetic-atomic-probe@example.invalid"
+          export GIT_COMMITTER_NAME="$GIT_AUTHOR_NAME"
+          export GIT_COMMITTER_EMAIL="$GIT_AUTHOR_EMAIL"
+          moved="$(printf 'source-free synthetic lease mutation\n' | git commit-tree 'HEAD^{tree}' -p HEAD)"
+          git push --force-with-lease="$b:$head" "$remote" "$moved:$b" >/dev/null
+          test "$(get_sha "$b")" = "$moved"
+          if git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$head" \
+              "$remote" ":$a" ":$b" >/dev/null 2>&1; then
+            echo "CRITICAL: stale lease deleted synthetic refs" >&2
+            exit 1
+          fi
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$moved"
+          echo "STALE_LEASE_ATOMIC_ABORT=PASS"
+
+          # Correct leases must then delete BOTH refs as one transaction.
+          git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$moved" \
+              "$remote" ":$a" ":$b" >/dev/null
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+          echo "TWO_REF_ATOMIC_DELETE=PASS"
+          # An authorization ref absent during pre-read may appear before
+          # the push. Its empty expected-old lease must abort BOTH deletions.
+          git push --force-with-lease="$a:" "$remote" "HEAD:$a" >/dev/null
+          test -z "$(get_sha "$b")"
+          git push --force-with-lease="$b:" "$remote" "HEAD:$b" >/dev/null
+          if git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:" \
+              "$remote" ":$a" ":$b" >/dev/null 2>&1; then
+            echo "CRITICAL: newly created marker escaped absent-ref lease" >&2
+            exit 1
+          fi
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$head"
+          echo "CONCURRENT_CREATION_ATOMIC_ABORT=PASS"
+          git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$head" \
+              "$remote" ":$a" ":$b" >/dev/null
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+
+          # Deliberate ABA demonstration: head -> other -> head. Git's SHA
+          # lease accepts the original hash after intervening changes.
+          # This is a confirmed LIMITATION, not a security PASS.
+          git push --atomic "$remote" "HEAD:$a" "HEAD:$b" >/dev/null
+          git push --force-with-lease="$b:$head" "$remote" "$moved:$b" >/dev/null
+          git push --force-with-lease="$b:$moved" "$remote" "$head:$b" >/dev/null
+          test "$(get_sha "$a")" = "$head"
+          test "$(get_sha "$b")" = "$head"
+          git push --atomic \
+              --force-with-lease="$a:$head" \
+              --force-with-lease="$b:$head" \
+              "$remote" ":$a" ":$b" >/dev/null
+          test -z "$(get_sha "$a")"
+          test -z "$(get_sha "$b")"
+          echo "GITHUB_ABA_NOT_DETECTED_BY_SHA_LEASE=CONFIRMED_LIMITATION"
+          # A ref deletion is not an object erasure guarantee. Reveal only
+          # this newly synthesized, source-free commit for later read-only API
+          # reachability checks, never a private source object.
+          echo "SYNTHETIC_UNREFERENCED_COMMIT_SHA=$moved"
+          echo "GITHUB_PROVIDER_ATOMIC_LEASE_PROBE=PASS"
+      - name: Delimit evidence and residual ABA risk
+        run: |
+          echo 'Only two synthetic same-repository Git ref names and synthetic commit were used.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'No source from another repository, cross-organization token, or publisher was involved.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'Exact-SHA force-with-lease does not detect ABA when a ref moves away and returns to the expected SHA.' >> "$GITHUB_STEP_SUMMARY"
+          echo 'This is a provider transport probe, not private export authorization or retention remediation.' >> "$GITHUB_STEP_SUMMARY"