feat: recover incomplete signed application versions - #456

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall line coverage in commit 445da55 in the codex/actions-app-re... branch remains at 50%, unchanged from commit e271b7f in the main branch.

C# / code-coverage/dotnet

The overall line coverage in commit 445da55 in the codex/actions-app-re... branch remains at 100%, unchanged from commit e271b7f in the main branch.

_{Updated October 04, 2026 23:57 UTC}

🤖 Generated by the Agentic Engineer

Current head: 445da550d757535440f30af1af9291cd8df29226.

RED: paired recovery was absent; the new workflow regression failed before implementation. GREEN: the actual helper passes missing/matching/partial releases, both signature failures, authentication/partial/forbidden/redirect/mixed absence reads, both conflicts, failed readbacks, interrupted writes and idempotent retries. The workflow-order simulator also executes refusal before legacy writes when either prerequisite is disabled.

Required native CI completed successfully at this head. Its native registry step observed real Cosign claim acceptance and rejection, real Flux recovery, and real Buildx recovery of a single-platform image without changing its digest. Either partial pair recovered; matching retries and every refusal produced no manifest PUTs; contradictory claims on the second signature were rejected; both latest aliases retained their original bytes.

Correctness/security and simplification self-review completed. Its two native-proof findings were fixed: count every manifest PUT and independently exercise the second signature. The local-key fixture proves cryptographic claims and registry behavior; production OIDC identity remains covered by the workflow and command contracts. Unrelated registry writers cannot be fenced by a cross-repository transaction; that limitation is documented.

🤖 Generated by the Agentic Engineer

@coderabbitai full review

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

Learnt from: CR
Repo: devantler-tech/.github

Timestamp: 2026-10-05T00:08:38.367Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/.github (GitHub-as-code)

## Actions catalogue

### Maintaining the catalogue

**Validate before any PR:** `actionlint` on every changed workflow/action (else a thorough YAML parse); confirm `uses:` refs resolve and are pinned/aligned; check `inputs`/`outputs`/`shell:` are declared; for reusable workflows keep `on: workflow_call` inputs/secrets backward-compatible. No app build here — YAML correctness + pinning is the gate. Keep all remote actions pinned to full-length commit SHAs; first-party self-references resolve by local path after the same-commit self-checkout (never a remote ref — see the self-reference rule above). Never weaken a security control to pass a check.

Learnt from: CR
Repo: devantler-tech/.github

Timestamp: 2026-10-05T00:08:38.367Z
Learning: Source excerpt:
# AGENTS.md — devantler-tech/.github (GitHub-as-code)

## Actions catalogue

### Adding / Changing a Reusable Workflow

#### Test jobs

Every `.github/tests/test-*.sh` is a test entrypoint and must have an explicit invocation in a
`ci.yaml` step's `run:` block. Put `bash .github/tests/test-name.sh` (or the executable path) in a
dedicated step without a step-level `if`; quoting, arguments, and surrounding comments or blank lines
are supported. Use portable filenames containing letters, digits, dots, underscores, and hyphens.
Explicit shells and job/workflow shell defaults must use `bash`; a custom shell could return
success without executing the test script.
Working-directory overrides at those scopes must be `.` so relative paths identify the repository's
actual test entrypoints, rather than a shadow script in a fixture directory.
The containing job may omit `if` or use CI's exact merge-group/release scheduling
exclusion; arbitrary job conditions do not count because th...

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 445da

Recovery checks both version aliases after writing. No actionable issue remains identified before merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 445da

Recovery is opt-in and authenticates both original artifacts before restoring version tags. Conflicting or ambiguous observations stop recovery, and latest tags are preserved. Remaining uncertainty concerns concurrent writers and production registry permissions, not a verified new vulnerability.

Retained concerns
No architecture-level concerns identified.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

🤖 Generated by the Agentic Engineer

Reviewed CodeRabbit's complete current-head review 5985957654, including its ancillary output, at 445da550d757535440f30af1af9291cd8df29226.

The 8.33% docstring warning is a generic coverage metric applied to Bash fixture helpers. These functions have no language docstring interface: their contract is expressed by descriptive names, file headers, inline parameter comments and the executable scenario assertions. The production helper documents paired authentication, admission and the non-transactional write boundary; the operator documentation supplies all recovery inputs and limitations. Inspection found no missing behavior explanation that this warning identifies, so adding artificial docstring blocks would not improve the documented contract. The language-name warning matches the literal .github/tests/test-app-recovery.sh path; capitalizing it would make the path incorrect. Both warnings are refuted at this head; body_findings=0-resolved@445da55.

The review processed all eight changed files and explicitly reported no actionable comments at this head. All 268 check contexts have settled (173 successful, 95 intentional skips), including the successful required aggregate and real registry recovery exercises. There are no review threads, no competing branch activity, and the current base is clean. The runtime evaluation is recorded in 5985878505.