[gontzess]

DO NOT MERGE — coordinated registry cutover required

This producer validation pin must ship atomically with the fleet registry exact-ref enforcement flip. Complete the observed-ref inventory and protect the selected workflow tag before cutover. This draft is not authorization to merge, promote a tag or change registry configuration.

Why

The existing release.yaml@.* certificate policy trusts any branch/tag spelling under the reusable workflow path. A valid certificate from an unselected workflow ref must not pass producer-side release verification.

What

• Configure the sole accepted fleet identity as https://github.com/ConductorOne/github-workflows/.github/workflows/release.yaml@refs/tags/v4.
• Anchor both ends and escape literal dots so lookalike hosts/paths and suffixes cannot match.
• Keep the exact GitHub Actions issuer and existing retry/failure behavior. The configured policy cannot be widened by an environment variable or a presented certificate.
• Apply the same constant through every existing cosign verification: binary detached signatures, provenance, SBOM, ECR Public image attestations, manifest bundles and legacy detached-manifest fallback.
• Document the coordination hold and the reviewed moving-tag promotion model (not a frozen workflow SHA).

Evidence

• make test-scripts: PASS (native PowerShell fixture unavailable/skipped).
• python3 scripts/test-certificate-identities.py: PASS, four test groups through the actual validation script with offline curl/cosign fixtures.
• Positive: exact selected identity succeeds on all five verification calls, including both manifest representations.
• Negative: branch refs, old/other tags, tag-shape lookalikes, commit refs, unqualified refs, host/path lookalikes, prefixes/suffixes, trailing newline and a wrong issuer fail.
• Deliberately widened-regexp negative control: the same branch identity that the real script rejects passes when the fixture copy is changed back to any-ref trust. This proves the policy change, not an always-failing mock, causes rejection.
• bash -n scripts/validate-release-artifacts.sh, make workflow-validate and git diff --check: PASS.

Rollout limits

No live certificate signing, fleet release, registry policy flip, tag-protection change or merge was performed. The fixtures test policy wiring, not cryptographic certificate validity or deployed registry behavior. Keep this PR in draft and DO NOT MERGE until the coordinated registry cutover is ready; validate a real selected-ref release and the rejected nonselected-ref case during that cutover.

[github-actions]

Superseded — see the current review report for commit 6324fedc1669

General PR Review: DO NOT MERGE until registry flip: pin fleet certificate identity ref

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base ad85b5b02764.
Review mode: full
View review run

Review Summary

This PR replaces the unanchored release.yaml@.* cosign identity regexp in scripts/validate-release-artifacts.sh with one anchored, dot-escaped pattern. The only identity it accepts is …/release.yaml@refs/tags/v4. All six cosign calls in the script use this single constant, so every verification path is covered. The PR also adds an offline Python test (stubbed curl and cosign, positive and negative identities, and a widened-regexp control), wires that test into make test-scripts, and documents the coordinated-cutover hold.

I scanned the full diff for security and correctness and found no blocking issues. The regexp is correctly anchored, and Go's $ matches only at end of text, so the trailing-newline case is rejected. CERT_IDENTITY_REGEXP is assigned unconditionally, so an environment override can't widen it.

No repo-local criteria loaded, so I applied the base criteria only.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• New (confidence: high) scripts/validate-release-artifacts.sh:126: release.yaml's verify-release job (around line 1773) runs this script from job.workflow_sha, and record-registry-api (around line 1558) requires verify-release to succeed. After this change, any release that calls the workflow at a branch, an exact tag such as v4.0.1, or a SHA fails in-run verification and is never recorded. That contradicts the branch-testing steps in docs/release-workflow.md:527-540 and README.md:478-482, which this PR leaves unchanged. This may be intended under the cutover, but it isn't documented.
• New (confidence: high) docs/release-workflow.md:438,445,454,632: the consumer verification examples still use release.yaml@.* and @<ref>. That conflicts with the new exact-ref policy described at line 589, and anyone copying those examples keeps the any-ref trust this PR removes.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `scripts/validate-release-artifacts.sh`:
- Around line 126: The exact `@refs/tags/v4` pin is also used by the in-run `verify-release` job in `.github/workflows/release.yaml` (~line 1773), and `record-registry-api` (~line 1558) depends on that job succeeding. Releases run from a workflow branch, exact tag, or SHA will now fail verification and never be recorded. Update the branch-testing instructions in `docs/release-workflow.md` (~lines 527-540) and `README.md` (~lines 478-482) to say that non-v4 refs will fail `verify-release`, or add an explicit, reviewed test-only mechanism for branch canaries.

In `docs/release-workflow.md`:
- Around lines 438, 445, 454 and 632: Replace `release.yaml@.*` and `@<ref>` in the manual cosign verification examples and the Certificate Identity section with the anchored identity `^https://github\.com/ConductorOne/github-workflows/\.github/workflows/release\.yaml@refs/tags/v4$`, so they match the policy documented at line 589.

[github-actions]

🟡 Suggestion (confidence: high): release.yaml's verify-release job (line ~1773) runs this script from job.workflow_sha, and record-registry-api only runs when verify-release succeeds. With this pin, any release that calls the workflow at a ref other than v4 (a branch, @v4.0.1, or a SHA pin) now fails in-run verification and never gets recorded. That breaks the branch-testing process still documented in docs/release-workflow.md:527-540 and README.md:478-482. Please document this limitation in the testing instructions, or add a deliberate test-only path, so maintainers don't hit an unexpected release failure.

[github-actions]

🟡 Suggestion (confidence: high): This section now says the only accepted identity is @refs/tags/v4. But the consumer-facing verification examples in the same doc (lines 438, 445, 632) still use release.yaml@.*, and the Certificate Identity section (line 454) still says @<ref>. Anyone following those examples gets the any-ref trust this PR is meant to remove. Please update them to the anchored regexp.

[github-actions]

Superseded — see the current review report for commit c57fbedbf551

General PR Review: DO NOT MERGE until registry flip: pin fleet certificate identity ref

Blocking Issues: 0 | Suggestions: 2 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base ad85b5b02764.
Review mode: full
View review run

Review Summary

This PR replaces the unanchored release.yaml@.* cosign identity regexp in scripts/validate-release-artifacts.sh with one anchored, dot-escaped pattern. The only identity it accepts is …/release.yaml@refs/tags/v4. All six cosign calls in the script use this single constant, so every verification path is covered. The PR also adds an offline Python test (stubbed curl and cosign, positive and negative identities, and a widened-regexp control), wires that test into make test-scripts, and documents the coordinated-cutover hold.

I scanned the full diff for security and correctness and found no blocking issues. The regexp is correctly anchored, and Go's $ matches only at end of text, so the trailing-newline case is rejected. CERT_IDENTITY_REGEXP is assigned unconditionally, so an environment override can't widen it.

No repo-local criteria loaded, so I applied the base criteria only.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

• New (confidence: high) scripts/validate-release-artifacts.sh:126: release.yaml's verify-release job (around line 1773) runs this script from job.workflow_sha, and record-registry-api (around line 1558) requires verify-release to succeed. After this change, any release that calls the workflow at a branch, an exact tag such as v4.0.1, or a SHA fails in-run verification and is never recorded. That contradicts the branch-testing steps in docs/release-workflow.md:527-540 and README.md:478-482, which this PR leaves unchanged. This may be intended under the cutover, but it isn't documented.
• New (confidence: high) docs/release-workflow.md:438,445,454,632: the consumer verification examples still use release.yaml@.* and @<ref>. That conflicts with the new exact-ref policy described at line 589, and anyone copying those examples keeps the any-ref trust this PR removes.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `scripts/validate-release-artifacts.sh`:
- Around line 126: The exact `@refs/tags/v4` pin is also used by the in-run `verify-release` job in `.github/workflows/release.yaml` (~line 1773), and `record-registry-api` (~line 1558) depends on that job succeeding. Releases run from a workflow branch, exact tag, or SHA will now fail verification and never be recorded. Update the branch-testing instructions in `docs/release-workflow.md` (~lines 527-540) and `README.md` (~lines 478-482) to say that non-v4 refs will fail `verify-release`, or add an explicit, reviewed test-only mechanism for branch canaries.

In `docs/release-workflow.md`:
- Around lines 438, 445, 454 and 632: Replace `release.yaml@.*` and `@<ref>` in the manual cosign verification examples and the Certificate Identity section with the anchored identity `^https://github\.com/ConductorOne/github-workflows/\.github/workflows/release\.yaml@refs/tags/v4$`, so they match the policy documented at line 589.

---

Reviewed commit: 6324fedc1669

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit c57fbedbf551

General PR Review: DO NOT MERGE until registry flip: pin fleet certificate identity ref

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base ad85b5b02764.
Review mode: incremental since 6324fed
View review run

Review Summary

The PR replaces the any-ref release.yaml@.* cosign identity in scripts/validate-release-artifacts.sh with an anchored, dot-escaped regexp for @refs/tags/v4 only. It adds an offline fixture test, scripts/test-certificate-identities.py, which make test-scripts now runs, and documents the exact-ref policy and the coordinated cutover hold. The new commits update the manual cosign examples in docs/release-workflow.md (lines 438, 445, 632) to use the anchored identity, and add the refs/tags/v4-foo and refs/tags/v4/x lookalike negatives to the test. I scanned the full PR diff (4 files) for security and correctness problems. The incremental diff was complete, with no dropped paths or truncation. No repo-local criteria loaded, so only the base criteria were applied.

Security Issues

None found. The new regexp is anchored at both ends, escapes literal dots, comes from a constant, and cannot be overridden by CERT_IDENTITY_REGEXP from the environment. The test asserts that last point.

Correctness Issues

None found.

Suggestions

• Prior — still present (confidence: high) scripts/validate-release-artifacts.sh:126: The verify-release job in .github/workflows/release.yaml:1724-1773 runs this script, and record-registry-api (release.yaml:1558) only runs if verify-release succeeds. Once this merges, any release that calls the workflow at a branch, an exact tag such as v4.0.1, or a SHA will fail in-run verification and never be recorded. The branch-testing instructions at docs/release-workflow.md:527-540 and README.md:478-482 still tell people to point a connector at @your-branch / @my-branch. The DO NOT MERGE hold means this is likely intended, but the docs don't say so. The existing open thread already covers this.

Resolved prior findings

• Fixed: consumer verification examples still used release.yaml@.*. docs/release-workflow.md:438, :445 and :632 now use the anchored @refs/tags/v4$ identity. Line 454 still shows release.yaml@<ref>, but that line describes the identity a signer emits, not a verification pattern, so it no longer contradicts the policy.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `scripts/validate-release-artifacts.sh`:
- Around line 126: The exact `@refs/tags/v4` pin is also used by the in-run `verify-release` job in `.github/workflows/release.yaml` (~line 1773), and `record-registry-api` (~line 1558) only runs if that job succeeds. Releases that call the workflow from a branch, an exact tag, or a SHA will fail verification and never be recorded. Update the branch-testing instructions in `docs/release-workflow.md` (~lines 527-540) and `README.md` (~lines 478-482) to say that non-v4 refs will fail `verify-release`, or add an explicit, reviewed test-only path for branch canaries.

[github-actions]

Superseded — see the current review report for commit 4a98a6fba368

General PR Review: DO NOT MERGE until registry flip: pin fleet certificate identity ref

Blocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base ad85b5b02764.
Review mode: incremental since 6324fed
View review run

Review Summary

The PR replaces the any-ref release.yaml@.* cosign identity in scripts/validate-release-artifacts.sh with an anchored, dot-escaped regexp for @refs/tags/v4 only. It adds an offline fixture test, scripts/test-certificate-identities.py, which make test-scripts now runs, and documents the exact-ref policy and the coordinated cutover hold. The new commits update the manual cosign examples in docs/release-workflow.md (lines 438, 445, 632) to use the anchored identity, and add the refs/tags/v4-foo and refs/tags/v4/x lookalike negatives to the test. I scanned the full PR diff (4 files) for security and correctness problems. The incremental diff was complete, with no dropped paths or truncation. No repo-local criteria loaded, so only the base criteria were applied.

Security Issues

None found. The new regexp is anchored at both ends, escapes literal dots, comes from a constant, and cannot be overridden by CERT_IDENTITY_REGEXP from the environment. The test asserts that last point.

Correctness Issues

None found.

Suggestions

• Prior — still present (confidence: high) scripts/validate-release-artifacts.sh:126: The verify-release job in .github/workflows/release.yaml:1724-1773 runs this script, and record-registry-api (release.yaml:1558) only runs if verify-release succeeds. Once this merges, any release that calls the workflow at a branch, an exact tag such as v4.0.1, or a SHA will fail in-run verification and never be recorded. The branch-testing instructions at docs/release-workflow.md:527-540 and README.md:478-482 still tell people to point a connector at @your-branch / @my-branch. The DO NOT MERGE hold means this is likely intended, but the docs don't say so. The existing open thread already covers this.

Resolved prior findings

• Fixed: consumer verification examples still used release.yaml@.*. docs/release-workflow.md:438, :445 and :632 now use the anchored @refs/tags/v4$ identity. Line 454 still shows release.yaml@<ref>, but that line describes the identity a signer emits, not a verification pattern, so it no longer contradicts the policy.

Prompt for AI agents

Verify each finding against the current code and only fix it if needed.

## Suggestions

In `scripts/validate-release-artifacts.sh`:
- Around line 126: The exact `@refs/tags/v4` pin is also used by the in-run `verify-release` job in `.github/workflows/release.yaml` (~line 1773), and `record-registry-api` (~line 1558) only runs if that job succeeds. Releases that call the workflow from a branch, an exact tag, or a SHA will fail verification and never be recorded. Update the branch-testing instructions in `docs/release-workflow.md` (~lines 527-540) and `README.md` (~lines 478-482) to say that non-v4 refs will fail `verify-release`, or add an explicit, reviewed test-only path for branch canaries.

---

Reviewed commit: c57fbedbf551

[github-actions]

No blocking issues found — see the full review report

[github-actions]

Superseded — see the current review report for commit 4a98a6fba368

General PR Review: DO NOT MERGE until registry flip: pin fleet certificate identity ref

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base ad85b5b02764.
Review mode: incremental since c57fbed
View review run

Review Summary

This PR replaces the release.yaml@.* cosign identity in scripts/validate-release-artifacts.sh with an anchored, escaped pin to @refs/tags/v4. All six cosign verification calls (lines 195–292) use that constant and the fixed GitHub Actions issuer. The PR also adds an offline fixture test (scripts/test-certificate-identities.py, wired into make test-scripts) and updates the docs. The only change in the new commit is a note in README.md:484-486 and docs/release-workflow.md:535-537: after the cutover, a branch-ref run fails verify-release and is not recorded. I scanned the full PR diff for security and correctness, not just the new commit, and found no new issues. No repo-local criteria loaded, so only the base criteria were applied. The incremental diff was not partial.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• Fixed — branch canaries would fail the exact-ref verify-release (release.yaml:1773) and be skipped by record-registry-api (release.yaml:1558), and the docs didn't say so. README.md:484-486 and docs/release-workflow.md:535-537 now state this and note that a reviewed test-only path is not provided. The exact-ref behavior itself is intended and is covered by the PR's DO NOT MERGE / coordinated-cutover hold.

[github-actions]

General PR Review: DO NOT MERGE until registry flip: pin fleet certificate identity ref

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: none loaded - .claude/skills/ci-review.md was not found at trusted base ad85b5b02764.
Review mode: incremental since c57fbed
View review run

Review Summary

This PR replaces the release.yaml@.* cosign identity in scripts/validate-release-artifacts.sh with an anchored, escaped pin to @refs/tags/v4. All six cosign verification calls (lines 195–292) use that constant and the fixed GitHub Actions issuer. The PR also adds an offline fixture test (scripts/test-certificate-identities.py, wired into make test-scripts) and updates the docs. The only change in the new commit is a note in README.md:484-486 and docs/release-workflow.md:535-537: after the cutover, a branch-ref run fails verify-release and is not recorded. I scanned the full PR diff for security and correctness, not just the new commit, and found no new issues. No repo-local criteria loaded, so only the base criteria were applied. The incremental diff was not partial.

Security Issues

None found.

Correctness Issues

None found.

Suggestions

None.

Resolved prior findings

• Fixed — branch canaries would fail the exact-ref verify-release (release.yaml:1773) and be skipped by record-registry-api (release.yaml:1558), and the docs didn't say so. README.md:484-486 and docs/release-workflow.md:535-537 now state this and note that a reviewed test-only path is not provided. The exact-ref behavior itself is intended and is covered by the PR's DO NOT MERGE / coordinated-cutover hold.

---

Reviewed commit: 4a98a6fba368

[github-actions]

No blocking issues found — see the full review report