fix(oidc): roll forward trusted central workflow source

[seonghobae]

Scope

Restore Noema's immutable OIDC reusable-workflow source trust after read-only central .github protected main advanced from 731af58e954901c4f1cc853231c592abb1eaf617 to dd58a88391e44a32fb399f7407f508d8e73cc1c7.

The trusted .github/workflows/noema-review.yml blob is unchanged at 59b25e343444d0b97fc1c7ba33cb15543dd70102, so this is a source-commit roll-forward, not acceptance of changed reviewer workflow bytes or a widened workflow ref.

Test-first repair

• RED 4e031a60dab643ee70dc612e7d37786d7b655dbb: executable trust regression requires central source commit dd58a883... while wrangler.toml still trusts predecessor 731af58....
• Candidate eaf3e158afc513f1755f1ac6e3443f965c72e8c9: update only ALLOWED_WORKFLOW_SHA to the freshly audited central source commit.
• Non-destructive convergence 11cd11c2ae0d6cf0488a1b130fc5ce903de344fa: merge protected main 80925420bb14c673510e0ed206257befa55da7a9 without changing the two reviewed feature blobs.
• Exact feature delta remains two one-line substitutions: test/trusted-workflow-source-rollforward.test.ts and wrangler.toml.

Issuer, audience, repository owner, exact workflow ref, cryptographic source-SHA comparison, replay protection and GitHub App credential scope are unchanged. Central .github remains read-only from this writer.

Current identity and evidence

• protected base: 80925420bb14c673510e0ed206257befa55da7a9
• exact candidate head: 11cd11c2ae0d6cf0488a1b130fc5ce903de344fa
• central protected source: dd58a88391e44a32fb399f7407f508d8e73cc1c7
• trusted workflow blob: 59b25e343444d0b97fc1c7ba33cb15543dd70102
• application CI 32498957233: queued
• reviewer-ci 32498957247: queued
• central Security Scan 32498957203: queued

Fresh terminal-success evidence on this unchanged exact head is required before Ready/merge. Pending, predecessor or stale evidence is non-passing.

Summary by CodeRabbit

• 업데이트
  • OIDC 신뢰 설정이 최신 중앙 워크플로 소스 커밋을 인식하도록 허용된 커밋 식별자를 업데이트했습니다.
  • 배포된 신뢰 설정에 새 식별자가 올바르게 포함되는지 검증을 갱신했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f5e10131-e740-4a6a-ad63-ddd7d13216ac

📥 Commits

Reviewing files that changed from the base of the PR and between 8092542 and 11cd11c.

📒 Files selected for processing (2)

• test/trusted-workflow-source-rollforward.test.ts
• wrangler.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

ALLOWED_WORKFLOW_SHA와 감사된 중앙 워크플로 소스 SHA 테스트 상수를 기존 커밋에서 dd58a88391e44a32fb399f7407f508d8e73cc1c7로 변경했습니다.

Changes

중앙 워크플로 신뢰 설정 갱신

Layer / File(s)	Summary
허용된 워크플로 SHA 갱신 wrangler.toml, test/trusted-workflow-source-rollforward.test.ts	배포 설정의 ALLOWED_WORKFLOW_SHA와 테스트의 감사된 워크플로 소스 SHA를 새 커밋으로 교체했습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 11cd1

The PR only advances the trusted workflow source commit without changing the workflow bytes or trust scope. No actionable merge-blocking risk remains once the required checks complete successfully.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 중앙 워크플로 소스의 신뢰 SHA를 롤포워드하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/oidc-trust-dd58a883

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.