fix(oidc): roll forward trusted central workflow source

[seonghobae]

Summary

Roll Noema's immutable OIDC job_workflow_sha trust anchor forward to the current protected central .github source commit without changing the reviewed noema-review.yml workflow bytes.

Current evidence boundary

• protected Noema base: 3d4ba0846352b2b10fd4506fa0aea29de32d079f
• protected central .github/main: 885f2cd251999f21cf562cab3e2d9cc3cc3ec737
• reviewed .github/workflows/noema-review.yml blob: 59b25e343444d0b97fc1c7ba33cb15543dd70102

The central workflow blob is unchanged from the preceding trusted source revision, but GitHub OIDC job_workflow_sha binds the source commit identity. Noema therefore must trust the current audited source commit rather than a predecessor commit with identical workflow bytes.

Test-first lineage

• RED 5518c53ed5bfaafbd67c7f766db70aa40ae4a723: the executable trusted-workflow-source regression requires central source 885f2cd... while production still trusts the predecessor source. This commit was immediately superseded; cancelled/queued workflow evidence on it is not treated as a terminal RED gate.
• Candidate b15cdd9554101a3038545c72d96a95ed75d32b44: changes only Noema-owned wrangler.toml to trust the same audited central source commit.
• Convergence d5be7af0f099a92f3d688b4bd2f567bd955590d0: non-destructively incorporates current protected Noema base after fix(pilot): reject placeholder or ambiguous readiness evidence #493 integrated. Current diff remains only the executable trust regression and ALLOWED_WORKFLOW_SHA value.

Current exact-head evidence

On unchanged exact head d5be7af0f099a92f3d688b4bd2f567bd955590d0 against base 3d4ba084...:

• Application CI 32632718435: success
• reviewer-ci 32632718478: success
• central Security Scan 32632718705: success
• dedicated patch-validator-image 32632718448: in progress at exact-head image build
• unresolved review threads: 0 at last fresh read

The in-progress image run is non-passing. No predecessor image result substitutes for it.

Merge boundary

Keep Draft until the dedicated image workflow on the unchanged exact head reaches terminal-success, zero valid unresolved findings remain, and protected Noema base plus central source/workflow identity are freshly unchanged. Pending/in-progress/predecessor evidence is non-passing. This PR writes only Noema-owned trust configuration/tests; central .github remains read-only.

Summary by CodeRabbit

• 유지보수
  • 승인된 중앙 워크플로 소스 버전을 최신 커밋으로 업데이트했습니다.
  • 업데이트된 버전이 허용 목록에 정상적으로 반영되도록 검증을 갱신했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a9c26ea-8c71-411c-87ad-f571bece3be3

📥 Commits

Reviewing files that changed from the base of the PR and between 3d4ba08 and d5be7af.

📒 Files selected for processing (2)

• test/trusted-workflow-source-rollforward.test.ts
• wrangler.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

감사된 중앙 워크플로 소스 커밋 SHA를 새 값으로 갱신했습니다. Wrangler 설정과 관련 테스트가 동일한 SHA를 사용하도록 변경했습니다.

Changes

워크플로 소스 SHA 갱신

Layer / File(s)	Summary
SHA 설정 및 검증 wrangler.toml, test/trusted-workflow-source-rollforward.test.ts	ALLOWED_WORKFLOW_SHA와 auditedCentralWorkflowSourceSha를 885f2cd251999f21cf562cab3e2d9cc3cc3ec737로 변경했습니다.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: 🟡 Moderate · up to d5be7

This change updates the trusted central workflow source for OIDC security validation, but the exact commit still lacks a completed successful image validation check. Keep the PR unmerged until that required check reaches terminal success.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 중앙 워크플로 소스의 신뢰 앵커를 롤포워드하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/oidc-trusted-source-9ad0ad

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.