CLI release-plan recovery cannot create a previously absent exact tag with its GitHub Actions token.

Author: durable-workflow-ops

scripts/ci/cli_release_verifier_contract.py

@@ -250,3 +250,42 @@ def run(arguments: list[str], **_kwargs: object) -> object:
         self.assertEqual(len(self.recovery.CLI_ASSETS), len(attestations))
         self.assertEqual("php", calls[-1][0])
 
+    def test_phar_execution_receives_no_workflow_credentials_or_other_secrets(self) -> None:
+        version = "0.1.94"
+        commit = "36bde75882980e834854a145c9ad0f61ceec4659"
+        phar_environment: dict[object, object] | None = None
+
+        def run(arguments: list[str], **kwargs: object) -> object:
+            nonlocal phar_environment
+            if Path(arguments[0]).name == "php":
+                environment = kwargs.get("env")
+                if isinstance(environment, dict):
+                    phar_environment = environment
+                return mock.Mock(
+                    returncode=0,
+                    stdout=f"dw {version} (commit {commit[:12]}, built 2026-07-20)",
+                    stderr="",
+                )
+            return mock.Mock(returncode=0, stdout="verified", stderr="")
+
+        inherited_secrets = {
+            "GITHUB_TOKEN": "github-token",
+            "GH_TOKEN": "gh-token",
+            "AWS_SECRET_ACCESS_KEY": "cloud-secret",
+            "DATABASE_URL": "postgres://user:password@example.invalid/database",
+        }
+        allowed_path = "/opt/php/bin:/usr/bin"
+        with (
+            mock.patch.dict(self.recovery.os.environ, {**inherited_secrets, "PATH": allowed_path}, clear=False),
+            mock.patch.object(self.recovery.shutil, "which", return_value="/usr/bin/tool"),
+            mock.patch.object(self.recovery.subprocess, "run", side_effect=run),
+        ):
+            self.recovery.verify_cli(
+                self.release_client(version),
+                self.recovery.COMPONENTS["cli"],
+                version,
+                commit,
+            )
+
+        self.assertEqual({"PATH": allowed_path}, phar_environment)
+        self.assertTrue(inherited_secrets.keys().isdisjoint(phar_environment or {}))

scripts/ci/component-release-recovery.py

@@ -1196,7 +1196,11 @@ def verify_cli(client: PublicClient, component: Component, version: str, commit:
         if shutil.which("php") is None:
             raise RecoveryError("PHP is required to verify CLI release source metadata", "registry-publication")
         phar_version = subprocess.run(
-            ["php", str(directory / "dw.phar"), "--version"], check=False, text=True, capture_output=True
+            ["php", str(directory / "dw.phar"), "--version"],
+            check=False,
+            text=True,
+            capture_output=True,
+            env={"PATH": os.environ.get("PATH", os.defpath)},
         )
         expected_identity = f"{version} (commit {commit[:12]},"
         if phar_version.returncode or expected_identity not in phar_version.stdout: