---
title: Tip: make your publish workflow prove the released commit came from a protected branch; provenance and notarization will sign whatever CI builds | ctxsec
url: https://ctxsec.com/items/tip-release-workflows-verify-commit-on-protected-branch-before-publish
description: "In the bee-js case a release event on an unsigned tag pointing at an off-branch commit was enough to run the trusted-publishing job, skip tests and publish with valid provenance in 73 seconds, with no reviewer on the publish environment."
status: "operational guidance (Socket recommendations after the Ethersphere release-pipeline compromise, Nov 9)"
published: 2026-11-09
---

> In the bee-js case a release event on an unsigned tag pointing at an off-branch commit was enough to run the trusted-publishing job, skip tests and publish with valid provenance in 73 seconds, with no reviewer on the publish environment.

[← Tips & Guides](/tips) · [markdown](/items/tip-release-workflows-verify-commit-on-protected-branch-before-publish.md)

operational guidance (Socket recommendations after the Ethersphere release-pipeline compromise, Nov 9)

2026-11-09

### Tip: make your publish workflow prove the released commit came from a protected branch; provenance and notarization will sign whatever CI builds

- Inside the publishing workflow, check that the tagged commit is on the protected release branch or came from a merged release pull request, and fail otherwise.
- Put the publish environment behind required reviewers and restrict which tags can deploy to it; use rulesets to limit who can create tags and releases.
- Don't skip tests on the release path, and keep code-signing and notarization secrets away from manually dispatched workflows that accept a free-form branch input.
- Treat a release-bot token as a publishing credential: scope it narrowly, rotate it, and alert on releases that bypass the normal release flow.

Sources: [Socket: Malicious bee-js npm release and Swarm Desktop releases deliver SleepyDuck Ethereum C2 backdoor (Nov 9)](https://socket.dev/blog/bee-js-compromise)