From 4e031a60dab643ee70dc612e7d37786d7b655dbb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 08:17:48 -0700 Subject: [PATCH 1/2] test(oidc): require latest central workflow source --- test/trusted-workflow-source-rollforward.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/trusted-workflow-source-rollforward.test.ts b/test/trusted-workflow-source-rollforward.test.ts index b94f64e8e..f2a2feec6 100644 --- a/test/trusted-workflow-source-rollforward.test.ts +++ b/test/trusted-workflow-source-rollforward.test.ts @@ -2,7 +2,7 @@ import { readFileSync } from "node:fs"; import { describe, expect, it } from "vitest"; const auditedCentralWorkflowSourceSha = - "731af58e954901c4f1cc853231c592abb1eaf617"; + "dd58a88391e44a32fb399f7407f508d8e73cc1c7"; describe("trusted central workflow source revision", () => { it("binds the deployed OIDC trust configuration to the audited central source commit", () => { From eaf3e158afc513f1755f1ac6e3443f965c72e8c9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 21 Aug 2026 08:18:09 -0700 Subject: [PATCH 2/2] fix(oidc): roll forward trusted workflow source --- wrangler.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wrangler.toml b/wrangler.toml index bbd006c37..fbb0ea3e9 100644 --- a/wrangler.toml +++ b/wrangler.toml @@ -24,7 +24,7 @@ ALLOWED_AUDIENCE = "cwl-noema-review" ALLOWED_REPOSITORY_OWNER = "ContextualWisdomLab" ALLOWED_WORKFLOW_REPOSITORY = "ContextualWisdomLab/.github" ALLOWED_WORKFLOW_REF_PREFIX = "ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main" -ALLOWED_WORKFLOW_SHA = "731af58e954901c4f1cc853231c592abb1eaf617" +ALLOWED_WORKFLOW_SHA = "dd58a88391e44a32fb399f7407f508d8e73cc1c7" GITHUB_API_BASE = "https://api.github.com" GITHUB_APP_SLUG = "noema" NOEMA_RATE_LIMIT_PER_MINUTE = "60"