build: refuse PyPI packages uploaded less than 3 days ago

Defense against the recent wave of PyPI hijack attacks where attackers
publish a malicious version and have a few hours before maintainers
notice. Mirrors npm's `min-release-age=3` setting.

- Set PIP_UPLOADED_PRIOR_TO=P3D at workflow level so all pip subprocesses
  (including those spawned from integration test venvs and `python -m
  build`) refuse PyPI artifacts younger than 3 days.
- Pin pip>=26.1 in every explicit upgrade step. The relative-duration
  form `P3D` was added in pip 26.1 (April 2026); older pip silently
  ignores the env var instead of failing, so the bootstrap is safe.
- Commit a repo-level pip.conf so local developers can opt in by
  pointing PIP_CONFIG_FILE at it.

Known gap: the test job's tox-managed venvs install testing deps
(pytest, pytest-cov, pytest-bdd) through pip seeded by virtualenv,
which currently ships an older pip that does not honor the env var.
Closing this fully would require either per-package tox config
changes across 7 packages or a virtualenv bundle bump; deferred.

Author: gibiw

.github/workflows/pythonpackage.yml

@@ -2,6 +2,11 @@ name: Python package
 
 on: [ push ]
 
+env:
+  # Supply-chain protection: refuse PyPI packages uploaded less than 3 days ago.
+  # Honored by pip>=26.1 (relative durations); silently ignored by older pip.
+  PIP_UPLOADED_PRIOR_TO: "P3D"
+
 jobs:
   test:
     runs-on: ubuntu-22.04
@@ -41,7 +46,7 @@ jobs:
       - name: Install dependencies
         if: steps.filter.outputs.changes == 'true'
         run: |
-          python -m pip install --upgrade pip
+          python -m pip install --upgrade 'pip>=26.1'
           pip install tox tox-gh-actions
       - name: Run tox
         if: steps.filter.outputs.changes == 'true'
@@ -60,7 +65,7 @@ jobs:
 
       - name: Install reporters-validator
         run: |
-          python -m pip install --upgrade pip
+          python -m pip install --upgrade 'pip>=26.1'
           pip install git+https://github.com/qase-tms/reporters-validator.git
 
       - name: Download report schemas
@@ -69,6 +74,7 @@ jobs:
       - name: Validate Pytest reporter
         run: |
           python -m venv /tmp/venv-pytest
+          /tmp/venv-pytest/bin/python -m pip install --upgrade 'pip>=26.1'
           /tmp/venv-pytest/bin/pip install -q \
             ./qase-api-client ./qase-api-v2-client ./qase-python-commons ./qase-pytest
 
@@ -84,6 +90,7 @@ jobs:
       - name: Validate Behave reporter
         run: |
           python -m venv /tmp/venv-behave
+          /tmp/venv-behave/bin/python -m pip install --upgrade 'pip>=26.1'
           /tmp/venv-behave/bin/pip install -q \
             ./qase-api-client ./qase-api-v2-client ./qase-python-commons ./qase-behave
 
@@ -101,6 +108,7 @@ jobs:
       - name: Validate Robot Framework reporter
         run: |
           python -m venv /tmp/venv-robot
+          /tmp/venv-robot/bin/python -m pip install --upgrade 'pip>=26.1'
           /tmp/venv-robot/bin/pip install -q \
             ./qase-api-client ./qase-api-v2-client ./qase-python-commons ./qase-robotframework \
             robotframework
@@ -119,6 +127,7 @@ jobs:
       - name: Validate Tavern reporter
         run: |
           python -m venv /tmp/venv-tavern
+          /tmp/venv-tavern/bin/python -m pip install --upgrade 'pip>=26.1'
           /tmp/venv-tavern/bin/pip install -q \
             ./qase-api-client ./qase-api-v2-client ./qase-python-commons ./qase-tavern \
             tavern
@@ -161,7 +170,7 @@ jobs:
       - name: Install build dependencies
         if: contains(github.event.ref, matrix.prefix)
         run: |
-          python -m pip install --upgrade pip setuptools wheel build
+          python -m pip install --upgrade 'pip>=26.1' setuptools wheel build
       - name: Build the package
         if: contains(github.event.ref, matrix.prefix)
         working-directory: ./${{ matrix.prefix }}

pip.conf

@@ -0,0 +1,10 @@
+# Supply-chain protection: refuse PyPI packages uploaded less than 3 days ago.
+# Defends against hijack attacks where a malicious version is published and
+# stays unnoticed for a few hours.
+#
+# Requires pip>=26.1 (relative durations). Older pip silently ignores this key.
+#
+# To activate for local development, point pip at this file:
+#   export PIP_CONFIG_FILE=$(git rev-parse --show-toplevel)/pip.conf
+[global]
+uploaded-prior-to = P3D