verify-action-build: credit vendored files git normalised from CRLF

[potiuk]

Vendored npm registry check byte-compares each committed file against the integrity-verified registry tarball. A package whose tarball ships CRLF can never pass that comparison: git normalises line endings on commit, so the committed blob holds the LF form while the tarball does not. Every such file was reported as modified, which reads as tampering.

• Retries a failed byte comparison against the tarball content with \r\n folded to \n, and credits the file when that hashes to the committed blob.
• Reports those files in a new crlf_normalized category rather than silently folding them into verified, so the output says why the file did not byte-match.
• Adds a regression test for the shape, plus a precision guard asserting a real content edit still fails after the folding is in place.

This is a proof rather than a heuristic: if the folded bytes hash to the committed blob, the committed file is the published content, line endings aside.

Live case — #1283. benchmark-action/github-action-benchmark vendors node-fetch's nested whatwg-url@5.0.0, a 2016-era package whose tarball ships lib/url-state-machine.js with CRLF:

	line endings	CR count	bytes	git blob
registry tarball	CRLF	1297	33573	c25dbc2c4862...
committed in the action	LF	0	32276	27d977a25f90...

33573 - 32276 = 1297, exactly the CR count, and diff --strip-trailing-cr reports the two identical. Folding the tarball's CRLF hashes to 27d977a25f9011fc31ed28c17ba11f729b85edea - the committed blob GitHub reports. The other 26 vendored packages in that action matched byte-for-byte, so this was a single file failing for a reason unrelated to the action's security posture, on every bump.

Test plan: uv run pytest utils/tests/ - 353 passed. prek run --files ... passes. The two new tests fail without the fix (reproducing #1283's exact output: content differs from registry tarball) and pass with it.

🤖 Generated with Claude Code

[potiuk]

Nudge on my open PRs, @dfoulks1 @ppkarwasz - five are green and waiting, and they are easier to read as one set than separately.

Two are checker fixes, and these are the ones worth your time:

• verify-action-build: credit vendored files git normalised from CRLF #1297 - verify-action-build reported a vendored file as modified whenever the npm tarball shipped CRLF, because git normalises line endings on commit and the committed blob can then never byte-match. That is what made action-allowlist-review: bump benchmark-action/github-action-benchmark from 1.22.1 to 1.22.2 in /.github/actions/for-dependabot-triggered-reviews #1283 red. Without it the same false positive returns on every future bump of that action.
• allowlist-check: match owner/repo case-insensitively (closes #1304) #1305 (closes allowlist-check: match owner/repo case-insensitively #1304) - fnmatch applies os.path.normcase, the identity on POSIX, so a correctly-cased Swatinem/rust-cache@v2 was rejected against a lower-cased entry. apache/sedona-spatialbench hit it (Should approved_patterns.yml use the correct word casing for actions ? #950); fix(actions): correct casing for owner identifier of approved rust-cache action #1300 fixed the single entry, this removes the class. Only owner/repo folds - tags and SHAs stay case-sensitive, with tests pinning that.

Two record how the checkers get used:

• sweep-open-prs: skill for triaging the whole open PR queue #1294 - a sweep-open-prs skill for triaging the whole open PR queue in one pass, plus a README section documenting both skills.
• analyze-action-pr: correct the carabiner-dev row, add three precedents #1303 - corrects the analyze-action-pr precedent row that still says carabiner-dev's installers curl without verification. That upstream issue is closed and those actions now verify SLSA provenance by default, so the row was steering reviewers to re-raise a settled finding. Adds three precedents.

And one tool change:

• actions-queue-status: colour progress, totals and PMC grouping #1263 - actions-queue-status colour, totals and PMC grouping. Rebased onto current main after utils: colorize CLI help and borrow the gh CLI's token #1273 landed; the two had built competing progress-reporting designs, so this keeps the Reporter abstraction and main's stored-repo-list behaviour.

No rush on any of them, and happy to split #1263 up if the rebase makes it awkward to review. #1297 is the one I would land first if you only have time for one.