security(oidc): bind reusable workflow to immutable source SHA

[seonghobae]

Summary

Binds Noema's configured GitHub Actions workflow trust to an immutable source commit in addition to the exact reusable-workflow ref. The public runtime edge remains a denial-only prefilter; the authoritative credential-exchange verifier independently checks cryptographically verified workflow identity/source claims before GitHub App credential minting.

Current exact identity

• Noema exact head: e30d40e86b7418c5c44b0855629a91600eb6e5eb.
• Protected Noema base: bcef225f1cf1a640a78a7c5b55b662cc5deb8ef4.
• Trusted central .github source commit: f16280a0aa215563d29200c5d0bab75c48af614a.
• Trusted noema-review.yml blob: 59b25e343444d0b97fc1c7ba33cb15543dd70102.
• The central workflow blob is unchanged from the previously trusted revision; only the immutable source commit binding advanced.
• All check/review evidence from predecessor heads is historical.

Repair lineage

The branch adds real RS256 /exchange regressions for reusable and fallback workflow identity/source pairs and makes both the denial-only runtime prefilter and authoritative verifier fail closed when immutable workflow-source identity is missing or mismatched. Runtime readiness also requires the configured immutable source SHA to be canonical lowercase 40-hex.

Exact application CI on predecessor head eef2690f199beacf205250cafc844eacc57e53a7 exposed two concrete failures in test/runtime-workflow-prefilter-coverage.test.ts: both no-credential delegation cases expected the authoritative 401 ERR_AUTH_MISSING response but received 503 ERR_RATE_LIMIT because the new runtime-prefilter fixture omitted NOEMA_RATE_LIMITER. The fixture repair supplies an allowing Durable Object rate-limiter namespace so the requests can traverse the prefilter and distributed limiter to the authoritative missing-auth boundary.

A later central .github move was handled without mutating that read-only dependency: the trusted noema-review.yml blob was reverified unchanged at 59b25e..., and Noema's configured ALLOWED_WORKFLOW_SHA was deliberately rolled to central protected commit f16280a.... The current branch head already contains that roll-forward.

CHANGELOG.md remains untouched because separate Draft #425 owns that mutable documentation surface; this lane does not race it.

Current exact-head evidence

Fresh runs for unchanged head e30d40e86b7418c5c44b0855629a91600eb6e5eb remain non-passing until terminal:

• application CI 32207167682: queued;
• reviewer-ci 32207167823: queued;
• central Security Scan 32207167774: queued.

Current formal reviews: none. Current unresolved review threads: none. No predecessor result substitutes for this head.

Authority boundary

This PR writes only Noema. It does not mutate central .github, naruon, contextual-orchestrator, live GitHub App installations, rulesets, or deployed Cloudflare settings. Repository source can enforce a configured immutable source SHA; it cannot fabricate deployed-configuration evidence.

Merge boundary

Keep Draft until the unchanged exact head has terminal-success application CI, reviewer-ci, eligible central Security Scan, current review/thread evidence, and fresh live-base/governance revalidation. If central .github advances again, compare the exact trusted workflow artifact and deliberately roll the configured immutable SHA only when the intended trusted source is unchanged or a separately reviewed source change is accepted; then reacquire exact-head evidence.

Summary by CodeRabbit

• 새로운 기능

  • OIDC 인증 시 워크플로 참조와 불변 소스 SHA를 함께 검증합니다.
  • 허용된 SHA가 누락되거나 잘못된 경우 readiness 상태에서 명확히 안내합니다.
  • 검증 실패 시 구조화된 오류와 적절한 HTTP 상태 코드를 제공합니다.

• 버그 수정

  • 승인되지 않은 워크플로 소스의 자격 증명 교환을 차단합니다.
  • 누락되거나 불일치하는 워크플로 SHA 처리의 안정성을 개선했습니다.

• 문서

  • 워크플로 소스 SHA 검증 및 추적성 관련 아키텍처 문서를 업데이트했습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8dd83d52-c948-4821-8187-71f099c544cb

📥 Commits

Reviewing files that changed from the base of the PR and between bcef225 and e30d40e.

📒 Files selected for processing (26)

• ARCHITECTURE.md
• docs/TRACEABILITY.md
• src/index.ts
• src/runtime-entrypoint.ts
• src/runtime-readiness.ts
• test/architecture-documentation.test.ts
• test/credential-request-helper-coverage.test.ts
• test/documentation-architecture-contract.test.ts
• test/exchange-success-path-coverage.test.ts
• test/github-app-runtime-coverage.test.ts
• test/oidc-jwks-cache-expiry.test.ts
• test/oidc-verification-residual-coverage.test.ts
• test/oidc-workflow-sha-authoritative-boundary.test.ts
• test/oidc-workflow-sha-binding.test.ts
• test/oidc-workflow-sha-cryptographic.test.ts
• test/operational-helper-coverage.test.ts
• test/replay-request-core-coverage.test.ts
• test/replay-target-authorization-coverage.test.ts
• test/runtime-readiness-cache.test.ts
• test/runtime-readiness-durable-bindings.test.ts
• test/runtime-readiness-missing-config.test.ts
• test/runtime-readiness-ref-format.test.ts
• test/runtime-readiness.test.ts
• test/runtime-workflow-prefilter-coverage.test.ts
• test/worker.test.ts
• wrangler.toml

---

📝 Walkthrough

Walkthrough

ALLOWED_WORKFLOW_SHA 설정과 workflow_sha 계열 JWT 클레임을 추가했습니다. 런타임은 workflow ref와 source SHA를 readiness, 사전 검증, 암호화된 OIDC 검증 경계에서 확인합니다. 관련 테스트와 아키텍처·traceability 문서를 갱신했습니다.

Changes

워크플로 소스 바인딩

Layer / File(s)	Summary
SHA 계약과 readiness 설정 src/index.ts, src/runtime-readiness.ts, wrangler.toml, test/runtime-readiness*.test.ts	ALLOWED_WORKFLOW_SHA, workflow_sha, job_workflow_sha 계약을 추가했습니다. readiness와 Wrangler 설정은 40자리 소문자 hexadecimal 형식을 확인합니다.
교환 엔드포인트 사전 검증 src/runtime-entrypoint.ts, test/runtime-workflow-prefilter-coverage.test.ts	/exchange 요청에서 workflow ref와 source SHA를 먼저 확인합니다. 설정 오류에는 503을, SHA 불일치에는 403을 반환합니다.
권위 있는 OIDC SHA 검증 src/index.ts, test/oidc-workflow-sha-*.test.ts, test/oidc-verification-residual-coverage.test.ts, test/worker.test.ts, test/*coverage.test.ts	재사용 워크플로에는 job_workflow_sha를 사용하고, fallback 경로에는 workflow_sha를 사용합니다. 일치, 누락, 불일치, malformed token, 암호화된 검증 경계를 테스트합니다.
아키텍처 및 추적성 계약 ARCHITECTURE.md, docs/TRACEABILITY.md, test/architecture-documentation.test.ts, test/documentation-architecture-contract.test.ts	보호된 main 기준과 Active PR #426 후보 동작을 구분합니다. immutable workflow source SHA 검증과 관련 증거 조건을 문서화하고 테스트합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant runtime-entrypoint
  participant src/index.ts
  participant OIDC discovery/JWKS
  Client->>runtime-entrypoint: /exchange 요청과 Bearer 토큰
  runtime-entrypoint->>runtime-entrypoint: workflow ref 및 source SHA 사전 검증
  runtime-entrypoint->>src/index.ts: 통과한 OIDC 교환 요청 전달
  src/index.ts->>OIDC discovery/JWKS: discovery 및 JWKS 조회
  OIDC discovery/JWKS-->>src/index.ts: 검증 키와 OIDC 응답
  src/index.ts-->>Client: 성공 응답 또는 ERR_WORKFLOW_NOT_ALLOWED

Loading

Possibly related PRs

• ContextualWisdomLab/noema#71: 동일한 workflow SHA trust validation 및 readiness 영역을 다룹니다.
• ContextualWisdomLab/noema#404: 동일한 src/index.ts OIDC 교환 및 검증 테스트 경로와 직접 연결됩니다.
• ContextualWisdomLab/noema#422: 동일한 src/runtime-entrypoint.ts에 OIDC 검증 동작을 확장합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/oidc-workflow-sha-binding

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}