Found by a full-library audit (the completeness-critic pass). Two problems in .github/workflows/smoke-test.yml.
1. On a tag push it tests the wrong version
On push: tags: v* the workflow_dispatch input is empty, so the job runs a bare pip install modelfuzz — PyPI's current latest. There is no publish workflow anywhere in .github/ (grep -rl "pypi\|twine" .github/ returns nothing), so the tag lands before the manual upload. The job therefore smoke-tests the previous release and reports green.
The only version assertion (line ~91) is a tautology: both sides of the comparison come from the same install. Nothing is ever compared against github.ref_name.
Fix: on the tag path, pip install "modelfuzz==${GITHUB_REF_NAME#v}" with a retry loop (PyPI needs a moment to index), and assert modelfuzz.__version__ == ref_name.lstrip('v').
2. ${{ github.event.inputs.version }} is interpolated into run: bash
Command substitution fires even inside the quoted [ -n "…" ] test. Confirmed locally: VERSION='0.3.8$(id -un)' produced pip install modelfuzz==0.3.8gagandeep.
Triggering it requires repo write access, so this is low-privilege-escalation rather than an external threat — but it is free to fix.
Fix: pass the input through env: and reference "$VERSION" in the script body.
3. While in there
- Neither workflow declares
permissions:, so both run with the repo-default GITHUB_TOKEN. Add permissions: contents: read.
astral-sh/setup-uv@v3 is a third-party action on a mutable tag. Pin to a SHA.
Found by a full-library audit (the completeness-critic pass). Two problems in
.github/workflows/smoke-test.yml.1. On a tag push it tests the wrong version
On
push: tags: v*theworkflow_dispatchinput is empty, so the job runs a barepip install modelfuzz— PyPI's current latest. There is no publish workflow anywhere in.github/(grep -rl "pypi\|twine" .github/returns nothing), so the tag lands before the manual upload. The job therefore smoke-tests the previous release and reports green.The only version assertion (line ~91) is a tautology: both sides of the comparison come from the same install. Nothing is ever compared against
github.ref_name.Fix: on the tag path,
pip install "modelfuzz==${GITHUB_REF_NAME#v}"with a retry loop (PyPI needs a moment to index), and assertmodelfuzz.__version__ == ref_name.lstrip('v').2.
${{ github.event.inputs.version }}is interpolated intorun:bashCommand substitution fires even inside the quoted
[ -n "…" ]test. Confirmed locally:VERSION='0.3.8$(id -un)'producedpip install modelfuzz==0.3.8gagandeep.Triggering it requires repo write access, so this is low-privilege-escalation rather than an external threat — but it is free to fix.
Fix: pass the input through
env:and reference"$VERSION"in the script body.3. While in there
permissions:, so both run with the repo-defaultGITHUB_TOKEN. Addpermissions: contents: read.astral-sh/setup-uv@v3is a third-party action on a mutable tag. Pin to a SHA.