fix(release): bind immutable publication to protected main

[seonghobae]

Problem

The release workflow verifies the tag, package version, release inventory, asset digests, attestations, and immutable publication, but it did not prove that the release commit is the exact protected main selected for release. A vMAJOR.MINOR.PATCH tag could therefore point at a non-protected commit that independently passes release:verify and still enter immutable publication.

RED

Test-only exact 4a937bafa1d688f39bfe95fd72d0424c1d90cf36 added executable release-authority regressions before production code existed. Hosted application CI 34758659968 completed FAILURE at the release-tests step while typecheck and all preceding checkout/toolchain/base/lockfile controls passed, establishing the intended reality RED.

Causal repair

• scripts/release-protected-source.mjs admits tag-triggered GitHub Actions release verification only when the release commit equals a freshly resolved refs/heads/main from canonical origin.
• The resolver is non-shell, prompt-disabled, 20-second bounded, 16 KiB bounded, and accepts exactly one canonical lowercase full SHA record for refs/heads/main.
• Repository identity, release SHA, protected-main SHA, ambiguous/wrong refs, and release/main mismatch fail closed.
• Local and pull-request release:verify contexts skip the live remote admission rather than introducing network dependence into ordinary verification.
• Both release:verify and release:verify:strict invoke this protected-source gate first.
• No branch-governance truth, provider routing, immutable-policy administration, deployment authority, secrets, or foreign-owner state is copied into Noema.

During exact diff review, the uppercase hostile fixture was found to use digit-only SHAs, so .toUpperCase() was a no-op. Commit 8bc768756a10bab1d32b14039cdcfdb48d001931 repairs the fixture to contain hexadecimal letters; this changes only the regression's ability to exercise lowercase canonicalization, not the production contract.

Exact-head GREEN

Final exact head: 8bc768756a10bab1d32b14039cdcfdb48d001931.

• application CI 34758877516: SUCCESS, including exact checkout/base controls, release typecheck/tests/security/KPI/license/acquisition verification, and final base-drift refusal.
• reviewer-ci 34758877486: SUCCESS, including 100% line+branch/docstring gates and real no-network CodeGraph sandbox path.
• required Security Scan 34758877507: SUCCESS.
• patch-validator-image 34758877476: SUCCESS.
• Devin Review: SUCCESS.
• CodeRabbit manual exact-head review is running; any actionable finding will be repaired before merge.

No self-approval, gate weakening, force-push, destructive rebase, provider authority duplication, or release-policy substitution is part of this lane.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 169cd6f4-ec2e-42cf-937d-f13cb78cc6be

📥 Commits

Reviewing files that changed from the base of the PR and between ee13fb5 and 8bc7687.

📒 Files selected for processing (3)

• package.json
• scripts/release-protected-source.mjs
• test/release-protected-main-authority.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

릴리스 검증에 보호된 origin/main 커밋 확인 단계를 추가했습니다. 새 스크립트는 GitHub Actions 릴리스 태그와 원격 main SHA를 검증합니다. 관련 실행 명령과 테스트도 추가했습니다.

Changes

릴리스 보호 소스 게이트

Layer / File(s)	Summary
보호된 main 검증 구현 scripts/release-protected-source.mjs	GitHub Actions의 vX.Y.Z 릴리스 태그에서 릴리스 커밋과 보호된 origin/main SHA를 비교합니다. 원격 응답 형식과 SHA를 검증합니다. 직접 실행하면 JSON 결과를 출력하고 실패 시 종료 코드 1을 설정합니다.
릴리스 검증 체인 연결 및 테스트 package.json, test/release-protected-main-authority.test.ts	release:protected-source 명령을 추가하고 release:verify 및 release:verify:strict의 첫 단계로 연결합니다. 성공, 불일치, 건너뛰기, 잘못된 원격 응답 조건을 테스트합니다.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseVerify
  participant ProtectedSourceScript
  participant GitRemote
  ReleaseVerify->>ProtectedSourceScript: release:protected-source 실행
  ProtectedSourceScript->>GitRemote: refs/heads/main 조회
  GitRemote-->>ProtectedSourceScript: 보호된 main SHA 반환
  ProtectedSourceScript-->>ReleaseVerify: PASS, SKIPPED 또는 오류 반환

Loading

Merge Risk: ⚪ Minimal · up to 8bc76

The release verification gate is wired into the release workflow and correctly compares the tagged commit with protected main. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보호된 main 커밋 검증을 통해 immutable publication을 보호하는 이번 변경의 핵심을 정확히 설명합니다. 간결하고 구체적입니다.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-protected-main-boundary-20260913

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[seonghobae]

Exact-head review for 8bc768756a10bab1d32b14039cdcfdb48d001931: test-first hosted RED is preserved; causal protected-main admission is bounded and fail-closed; base→head diff is limited to package wiring, the Noema-owned release source gate, and its regression tests; application CI, reviewer-ci, required Security Scan, patch-validator-image, Devin Review, and CodeRabbit are all GREEN; inline review threads are zero. No self-approval.