fix(oidc): roll forward trusted central workflow source

[seonghobae]

Scope

Roll Noema's immutable OIDC reusable-workflow source trust to the current protected central .github commit without changing the trusted workflow bytes or widening the trusted ref.

Exact evidence

• Noema protected base: 6b8e4ddcdbf3a6f4a20b9859fc51af1f24e9aa71
• current central .github protected source commit: 731af58e954901c4f1cc853231c592abb1eaf617
• central noema-review.yml blob at that commit: 59b25e343444d0b97fc1c7ba33cb15543dd70102
• the same workflow blob was already present at predecessor central commit 4c7077b3b061f8d674f0932dfecccfe8ad85f93a; the central main movement changed repository source revision, not the trusted workflow bytes.

Test-first repair

• Existing candidate 0b4ba5c040a87344e7546f15742556a700b850df correctly bound Noema to then-current central 4c7077....
• Central protected main subsequently advanced to 731af58..., so immutable source trust became stale even though noema-review.yml stayed byte-identical.
• RED 4286ba60ed60827f981c6afdc14556256d9394c6: the executable trust regression requires current central commit 731af58... while wrangler.toml still trusted 4c7077....
• Candidate b2b1b31b7046604f475d3db98fdc8b775ae20a44: production ALLOWED_WORKFLOW_SHA is rolled forward to 731af58...; an intermediate whole-file write briefly removed the canonical final newline from wrangler.toml, exact diff verification caught it, and the final candidate restores that newline.
• Relative to 0b4ba5c..., the final candidate changes exactly one line in the trust regression and one line in wrangler.toml.

The trusted workflow path/ref and blob bytes are unchanged; this does not widen workflow authority.

Current exact-head evidence

• application CI 32460183414: queued
• reviewer-ci 32460183364: queued
• central Security Scan 32460183360: queued
• unresolved review threads: 0

Queued evidence is non-passing and predecessor runs are not reused.

Merge boundary

Keep Draft until application CI, reviewer-ci and eligible central Security Scan are terminal-success on unchanged exact head b2b1b31..., protected main is freshly confirmed as its live base, central workflow source commit/blob authority is unchanged, and review/thread state is freshly clean.

Summary by CodeRabbit

• 업데이트
  • 신뢰된 중앙 워크플로 소스가 최신 승인 커밋으로 갱신되었습니다.
  • 워크플로 검증 설정이 새 커밋을 올바르게 허용하도록 업데이트되었습니다.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 766608fe-1124-4b26-8be1-086aa160ff85

📥 Commits

Reviewing files that changed from the base of the PR and between 6b8e4dd and b2b1b31.

📒 Files selected for processing (2)

• test/trusted-workflow-source-rollforward.test.ts
• wrangler.toml

---

📝 Walkthrough

Walkthrough

감사된 중앙 워크플로 소스의 커밋 SHA를 새 값으로 갱신했습니다. wrangler.toml의 허용 목록과 관련 테스트가 새 SHA를 사용합니다.

Changes

감사된 워크플로 소스 갱신

Layer / File(s)	Summary
허용된 워크플로 SHA 및 테스트 갱신 wrangler.toml, test/trusted-workflow-source-rollforward.test.ts	ALLOWED_WORKFLOW_SHA와 테스트 검증값을 731af58e954901c4f1cc853231c592abb1eaf617로 변경했습니다.

Estimated code review effort: 1 (매우 낮음) | ~2분

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/oidc-workflow-source-rollforward-4c7077

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

🔍 SHA rollforward consistent; external commit identity unverifiable

The new SHA matches between the test constant and wrangler.toml ALLOWED_WORKFLOW_SHA, and no reference to the old SHA remains. Whether 731af58... actually points to the intended central .github commit with a byte-identical noema-review.yml blob cannot be verified from this repo; it rests on external evidence in the PR description.

---

Was this helpful? React with 👍 or 👎 to provide feedback.