[devantler]

🤖 Generated by the Agentic Engineer

Why

The publish that ships this app mints a signature the cluster trusts. Today nothing stops that signature being minted from a mutable reference to the shared publish workflow, so a moved tag upstream could produce an artifact the cluster still accepts. The upstream template already turned the protection on; this app never received it, so the decision exists but is not in force here.

What

Turns on the existing enable-caller-pin protection in this app's release workflow. The pin this app already uses passes it unchanged, so releases behave exactly as they do today — the difference is that a mutable reference would now fail the publish loudly instead of shipping an over-trusted artifact.

Part of devantler-tech/platform#2818

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review pull request #260.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

The publish workflow now passes enable-caller-pin: true to the reusable publish-app.yaml workflow. The workflow also documents the signing-trust risk of mutable action tags. Publishing therefore requires a commit-pinned caller reference.

Possibly related PRs

• devantler-tech/wedding-app#155: Updates the pinned version used when invoking publish-app.yaml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly describes the main security change: requiring a SHA-pinned caller for the publish workflow before signing.
Description check	✅ Passed	The description explains why and how the workflow change prevents signing from mutable references.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 1a3acd9bba

Programmatically tested — every check green, CI - Required Checks included.

Reviewed — cr@1a3acd9bba. CodeRabbit published zero review objects, so the artifact is its auto-generated summary comment: refreshed after the authenticated request, naming the full head sha, no finding sections, no rate-limit marker — corroborated by the head's CodeRabbit status reading Review completed. Zero unresolved threads, zero body findings.

Tried and evaluated as a user — the guard this flag switches on only executes during a real tag publish, so I exercised it directly instead: extracted the shipped 🔒 Require a SHA-pinned caller step from 8357620c14, the exact revision this repo pins, and ran it against this repo's real uses: ref.

• accepts …/publish-app.yaml@8357620c14… → turning the flag on is a no-op for today's releases;
• rejects …/publish-app.yaml@refs/tags/v13.0.3 → the mutable-tag path the control targets is genuinely closed.

I also confirmed the enable-caller-pin input exists at that pinned revision (it landed in v12.0.0; passing an undeclared input would fail the workflow outright), and actions' own test-publish-caller-pin.sh passes at main.

The honest limit: neither the live OIDC token round-trip nor a real publish is exercised here — that happens at the next tag. The failure mode is fail-closed before checkout, build or signing, so the worst case is a release that does not ship, never a bad artifact.

Promoting and merging.