fix(release): require verified release tags

[ericksoa]

Summary

• Requires release operators to create the immutable semver tag as a signed annotated tag on their workstation.
• Requires GitHub to report that exact tag object as verified: true before the release workflow can promote latest.
• Makes latest a second ref to the exact verified semver tag object instead of minting a distinct unsigned tag object in Actions.
• Verifies raw tag-object equality as well as peeled commit equality, while retaining main ancestry, newest-semver, rollback, and unchanged-lkg guards.
• Uses an exact-object force-with-lease so a concurrent out-of-band latest update cannot be overwritten.

Why

The current release workflow creates latest with git tag -fa, which produces a separate unsigned annotated object even when the semver release tag is signed. Authentication through GITHUB_TOKEN authorizes the ref update but does not cryptographically sign the object. This caused latest for v0.0.86 to report verified: false until protected-tag remediation.

The new trust chain keeps private signing material out of Actions: the operator signs the immutable semver object locally, GitHub verifies it, and Actions only aliases the mutable latest ref to that already-verified object.

Security Boundary

This change authenticates the exact tag object and requires GitHub to recognize its signature. It does not introduce a separate allowlist of release signers: authorization to create a release tag remains governed by repository permissions and tag rulesets. Restricting tag creation to a designated release team or app, if required, is a separate policy hardening step.

Coordination

#7118 also updates the latest-tag workflow for release-label retirement. This patch applies cleanly over its current head; if #7118 lands first, its permissions, concurrency group, and retirement steps must be preserved when this branch is refreshed.

Type of Change

• Code change with tests
• Release/security workflow hardening

Verification

• vitest run --project integration test/release-latest-tag.test.ts test/release-latest-tag-workflow.test.ts — 22 passed
• Real ephemeral SSH signing keys prove the cut tag contains an SSH signature.
• Git semantics test proves latest and vX.Y.Z resolve through the same signed tag object.
• Negative tests cover mismatched verified object, permanently unverified GitHub state, verification propagation, distinct same-commit objects, and concurrent latest movement.
• npm run build:cli && npm run check:diff — passed
• bash -n, ShellCheck, formatting, repository checks, source-shape budget, test-size budget, gitleaks, and DCO hooks — passed
• Commit is SSH-signed and includes DCO sign-off.

---

Signed-off-by: Aaron Erickson aerickson@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

Release tagging now creates signed annotated semver tags. The workflow verifies GitHub’s tag object before promotion, updates latest to that exact object, and validates propagation through polling and integration tests.

Changes

Release tag integrity

Layer / File(s)	Summary
Signed release tag creation scripts/release-plan.mts, scripts/release-cut-tag.sh, test/release-latest-tag.test.ts	Release plans and help text specify signed annotated semver tags, the cut script signs tags, and fixtures and assertions cover SSH signatures.
Verified tag validation and promotion .github/workflows/release-latest-tag.yaml, scripts/release-latest-tag.sh, test/release-latest-tag-workflow.test.ts, test/release-latest-tag.test.ts, ci/source-shape-test-budget.json	The workflow polls GitHub verification and passes the verified object SHA to promotion; the script validates object identity, updates latest directly, uses lease-based pushing, and verifies the remote object.
Tag-object propagation results scripts/release-wait-latest.sh	Polling and result generation now require and record matching semver and latest tag objects.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant ReleaseWorkflow
  participant GitHubAPI
  participant ReleaseLatestTag
  participant GitRemote
  ReleaseWorkflow->>GitHubAPI: Verify release tag object
  GitHubAPI-->>ReleaseWorkflow: Return verified tag object SHA
  ReleaseWorkflow->>ReleaseLatestTag: Pass release tag and expected object SHA
  ReleaseLatestTag->>GitRemote: Update latest to verified tag object
  GitRemote-->>ReleaseLatestTag: Return remote latest object
  ReleaseLatestTag-->>ReleaseWorkflow: Confirm matching object

Loading

Possibly related PRs

• NVIDIA/NemoClaw#7118: Both changes modify release-latest-tag handling around tag-object verification and post-tag workflow operations.

Suggested labels: bug-fix

Suggested reviewers: cv, laitingsheng

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: release tooling now requires verified release tags before promoting latest.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/verified-release-tag-alias

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage remains at 96%, unchanged from the main branch.

TypeScript / code-coverage/cli

The overall coverage in the fix/verified-release... branch remains at 80%, unchanged from the main branch.

Show a code coverage summary of the most impacted files.

File	main f1270ec	fix/verified-release... 6f181e3	+/-
src/lib/inferen...lama/process.ts	100%	50%	-50%
src/lib/inferen...er-lifecycle.ts	71%	65%	-6%
src/lib/sandbox...rce-identity.ts	91%	91%	0%
src/lib/state/m...lock-storage.ts	97%	97%	0%
src/lib/tunnel/services.ts	73%	73%	0%
src/lib/inference/local.ts	80%	82%	+2%
src/lib/onboard...carryforward.ts	92%	96%	+4%

---

_{Updated July 17, 2026 21:34 UTC
Code Coverage is in Public Preview. Learn more and provide us with your feedback.}

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections match; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.