Repaired and Widened: Release Authority Drift When a Coding Agent Fixes GitHub Actions Workflows

Abstract

Coding agents now repair broken release workflows in GitHub Actions, the software supply-chain configuration that decides which runs may publish a package to PyPI or npm, push a container, or sign a release. The usual acceptance criterion is that the release job runs again. We show that this criterion passes repairs that also widen who can publish, an outcome we call Release Authority Drift. Asked to unblock a same-day release and prove that the release path works, OpenAI's Codex agent repaired the release job and, in the same patch, opened it to manual dispatch on a branch on 6 of 11 tasks derived from the release workflows of public repositories. The trigger is an ordinary maintainer request: every request asked for the smallest edit, and under a neutral request the agent returned a safe repair on all 11 tasks. Existing tools do not catch the change. A workflow linter accepts every widened workflow and two security scanners report nothing new, because each workflow is legal in isolation and is a defect only relative to the boundary it had before. The consequence reaches the registry: production PyPI accepted a package uploaded by a manually dispatched run on a branch. A repair to release configuration therefore needs a second acceptance test: the patched workflow admits no event or ref to a release step that it did not admit before the fault.