fix(oidc): roll forward central workflow source

[seonghobae]

Scope

Restore Noema's immutable GitHub OIDC workflow-source binding after central .github protected main advanced from 6a79f075d62b5f8dcfef6145960f1c42c147f273 to fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39 while .github/workflows/noema-review.yml remained the same reviewed blob (59b25e343444d0b97fc1c7ba33cb15543dd70102).

Test-first repair

• RED ed622047b87d6a09f1ac8935918b77ac27e30ebb: test/trusted-workflow-source-rollforward.test.ts requires the current central source commit while the production wrangler.toml still names the predecessor SHA.
• Non-destructive convergence 3ef12075098fdd34cc2e74bb20f20147ee13ca56: incorporate protected main e7b07142619887d9c82107c7be73a0b50808f463 after fix(security): reject future-dated validation evidence #445 without dropping the RED contract.
• Candidate 2f560ccd13071aa8b970f48091b6f1dcf9b0b14b: update only Noema's ALLOWED_WORKFLOW_SHA to fce028b4c3bf8e2e5e4819c1c5622e90cfa6ab39.

Current exact evidence

• protected base: e7b07142619887d9c82107c7be73a0b50808f463
• exact head: 2f560ccd13071aa8b970f48091b6f1dcf9b0b14b
• application CI 32514516621: queued
• reviewer-ci 32514516721: queued
• central Security Scan 32514516712: queued
• Draft; mergeable; unresolved review threads: 0

Merge boundary

Keep Draft until application CI, reviewer-ci, and eligible central Security Scan are terminal-success on this unchanged exact head; then refetch protected Noema base, central source commit plus workflow blob, review/thread state, and current central scanner authority before Ready/merge.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 4 seconds

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 059cab98-73eb-4c67-8a96-3e24acc74ec8

📥 Commits

Reviewing files that changed from the base of the PR and between e7b0714 and 2f560cc.

📒 Files selected for processing (2)

• test/trusted-workflow-source-rollforward.test.ts
• wrangler.toml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: SHA roll-forward consistent across config and test

ALLOWED_WORKFLOW_SHA in wrangler.toml and the audited constant in trusted-workflow-source-rollforward.test.ts are updated to the same value. No stale references to the old SHA remain, and the new value is valid 40-char hex matching the readiness check in src/runtime-readiness.ts:175.

---

Was this helpful? React with 👍 or 👎 to provide feedback.