[patrickryankenneth]

1 commit(s) ahead of main

policy v2.2: IMG-18 input hashes, IMG-19/20 VEX coverage report; assert-image hardening checks

(401152b)

Summary by CodeRabbit

• Security & Release Validation
  • Builder images now undergo additional checks for unwanted utilities and unsupported binary-format targets.
  • Releases verify that vulnerability coverage reports match the scan, software bill of materials, and vulnerability data for each architecture.
  • Release checks also verify key input files against the tagged source and confirm coverage reports are attested.
• Release Assets
  • Per-architecture vulnerability coverage reports are included with release assets.

[cloudflare-workers-and-pages]

Deploying python-wheels-builder with    Cloudflare Pages

Latest commit:	401152b
Status:	✅  Deploy successful!
Preview URL:	https://13f86c2f.python-wheels-builder.pages.dev
Branch Preview URL:	https://dev.python-wheels-builder.pages.dev

View logs

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c283a34b-9fbd-44bc-beba-ceea6cf36a28

---

📥 Commits

Reviewing files that changed from the base of the PR and between 03ba1c1 and 401152b.

---

📒 Files selected for processing (10)

• .github/scripts/assert-image.sh
• .github/scripts/check-vex-coverage.py
• .github/scripts/verify_builder_policy.py
• .github/workflows/release.yml
• .gitignore
• policy/builder-image/POLICY.md
• policy/builder-image/policy.json
• tests/test_assert_image.py
• tests/test_policy_tool.py
• tests/test_verify_builder_policy.py

---

 ____________________________________________________________________________________________________________________________________________
< Every great developer you know got there by solving problems they were unqualified to solve until they actually did it. - Patrick McKenzie >
 --------------------------------------------------------------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[deepsource-io]

DeepSource Code Review

We reviewed changes in 03ba1c1...401152b on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Python		Oct 11, 2026 4:11a.m.	Review ↗
Shell		Oct 11, 2026 4:11a.m.	Review ↗
Secrets		Oct 11, 2026 4:11a.m.	Review ↗
Docker		Oct 11, 2026 4:11a.m.	Review ↗
Rust		Oct 11, 2026 4:11a.m.	Review ↗
PowerShell		Oct 11, 2026 4:11a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[deepsource-io]

'subprocess.run' used without explicitly defining the value for 'check'.

subprocess.run uses a default of check=False, which means that a nonzero exit code will be
ignored by default, instead of raising an exception.

You can ignore this issue if this behaviour is intended.