fix(operations): restack workflow registry identity guards on current main

[seonghobae]

Purpose

Rebuild only PR #307's workflow-registry repository/duplicate/identity hardening onto the current protected-main lineage after #305 advanced main. No predecessor CI, review, scanner, coverage, model, release, deployment, or operational authority transfers.

Exact construction

• protected main immediately before construction: 534bf1708a6277c443867e87092ac5f2c05ea490;
• source PR fix(operations): restack workflow registry identity guards on current main #307 exact unchanged head at the pre-write refetch: 640e7d2bcb14136acd0df55b66a9eac85c382337;
• successor exact head: 606fad5be3d36ad7d1b7ea85738d95f61942d782;
• ancestry: exactly 1 commit ahead / 0 behind protected main, merge base exactly protected main;
• net scope: exactly five paths: scripts/workflow-registry-audit.mjs, test/workflow-registry-audit.test.ts, test/workflow-registry-collector-repository-binding.test.ts, test/workflow-registry-duplicate-records.test.ts, and test/workflow-registry-repository-binding.test.ts.

The only protected-main movement since #307's base changes the rate-limiter source/tests, so this successor overlays #307's exact five head blobs on the current protected-main tree without overwriting intervening protected bytes.

Security / reliability contract

The collector/classifier fails closed on wrong repository identity, repeated registry records, workflow-ID reuse across conflicting paths, and workflow-path reuse across conflicting IDs. It remains read-only evidence processing and cannot disable workflows or confer merge/release/deployment authority.

Evidence boundary

Keep Draft until this unchanged exact head receives fresh terminal-success application ci, reviewer-ci, and protected-base-eligible central Security Scan, exact 100% owned production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending, queued, skipped, absent, neutral, failed, cancelled, stale, predecessor, status-only, model-only, or rate-limited evidence is non-passing.

Live Noema governance currently requires the central .github/workflows/security-scan.yml@refs/heads/main workflow and does not currently impose an independent formal-approval rule. Immediately before Ready or merge, independently re-resolve protected main, exact head/base/ancestry, reviews/threads, checks and checkout SHAs, live rulesets, central scanner revision/triggers/base filters/thresholds, releases, and writer state.

Supersedes #307 only after fresh exact-head verification and protected integration. Related: #226.

Summary by CodeRabbit

• 버그 수정

  • 워크플로 레지스트리 감사가 지정된 저장소에서만 실행되도록 검증을 강화했습니다.
  • 잘못된 저장소 정보는 외부 수집 전에 즉시 실패로 처리됩니다.
  • 중복 워크플로 기록과 동일 경로의 재사용을 오류로 감지합니다.

• 테스트

  • 저장소 식별자 검증 및 다양한 잘못된 입력 사례를 추가했습니다.
  • 중복 기록과 경로 충돌에 대한 검증을 추가했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a1065f6b-b3c1-4014-a089-d62ba9127fda

📥 Commits

Reviewing files that changed from the base of the PR and between 534bf17 and 606fad5.

📒 Files selected for processing (5)

• scripts/workflow-registry-audit.mjs
• test/workflow-registry-audit.test.ts
• test/workflow-registry-collector-repository-binding.test.ts
• test/workflow-registry-duplicate-records.test.ts
• test/workflow-registry-repository-binding.test.ts

---

📝 Walkthrough

Walkthrough

워크플로 레지스트리 감사가 특정 저장소에만 적용되도록 검증을 추가했다. 수집 전 잘못된 저장소를 거부한다. 중복 레코드와 경로 재사용을 별도 실패 유형으로 분류한다. 관련 수집 및 분류 테스트를 추가·수정했다.

Changes

워크플로 레지스트리 검증

Layer / File(s)	Summary
저장소 바인딩 검증 scripts/workflow-registry-audit.mjs, test/workflow-registry-collector-repository-binding.test.ts, test/workflow-registry-repository-binding.test.ts	EXPECTED_REPOSITORY를 추가했다. classifyWorkflowRegistry와 collectWorkflowRegistryAudit는 ContextualWisdomLab/noema와 정확히 일치하지 않는 저장소를 repository_identity_invalid 실패로 처리한다. 수집 함수는 API 호출 전에 빈 결과를 반환한다.
중복 레코드 검증 scripts/workflow-registry-audit.mjs, test/workflow-registry-audit.test.ts, test/workflow-registry-duplicate-records.test.ts	동일 ID·동일 경로의 반복 레코드를 workflow_record_duplicate로 처리한다. 서로 다른 ID가 동일 경로를 사용하면 workflow_path_reused로 처리한다. 기존 workflow_id_reused 검사는 유지한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/workflow-registry-identity-534bf1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}