Reject duplicate source generation references

2026-10-05 02:40:09 +09:00
parent ceb063dfdc
commit 72232731d1
3 changed files with 11 additions and 1 deletions
@@ -114,10 +114,14 @@ def load_run_inputs(manifest, root):
        migrated = [record for record in load_json(migration_path)['runs'] if record['runId'] == run_id]
        if migrated and (len(migrated) != 1 or file_hash(run_dir / 'manifest.json') != migrated[0]['originalManifestSha256']):
            raise ValueError(f'{run_id}: immutable legacy manifest SHA-256 mismatch')
+    source_ids = set()
    for reference in manifest.get('environment', {}).get('sourceGenerations', []):
        source_id = reference['runId']
        if not isinstance(source_id, str) or not re.fullmatch(r'[A-Za-z0-9_]+', source_id):
            raise ValueError('invalid source generation reference runId')
+        if source_id in source_ids:
+            raise ValueError('duplicate source generation reference runId')
+        source_ids.add(source_id)
        if reference['manifest'] != f'generated/{source_id}/manifest.json':
            raise ValueError('source generation reference must identify its own run manifest')
        source_path = Path(root) / reference['manifest']