fix(release): rebuilds must run at the tag ref — keyless identity integrity

[LukasWodka]

Both Bugbot findings on promotion #428, confirmed real as one defect: workflow_dispatch accepted inputs.ref so a tag could be rebuilt from a branch run — cosign embeds the run's ref in the keyless identity, producing @refs/heads/... signatures that the tag-anchored installers (correctly) reject on every customer machine.

Fix: inputs.ref removed; dispatch runs hard-fail unless started at a v* tag ref; supported rebuild paths are gh run rerun of the tag run or dispatching at the tag (Actions → Run workflow → select the tag). Installers stay untouched — their anchor is right.

Release note: this fix lands on develop → rides the next cycle (v0.10.2). Shipping v0.10.1 with the hazard is internal-only (it bites release-managers doing branch-dispatched rebuilds, never normal installs) — ops rule until then: rebuild only via rerun/tag-ref dispatch.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes only CI release plumbing but directly affects how signed artifacts are published; misconfiguration could still block rebuilds until ops use tag-ref dispatch or rerun.

Overview
Fixes release rebuilds that produced cosign identities installers reject. Manual workflow_dispatch no longer accepts an inputs.ref tag string, so a run started on a branch cannot rebuild a release while embedding @refs/heads/... in keyless signatures. Rebuilds must be triggered at the v* tag (Actions → Run workflow on the tag) or via gh run rerun on an existing tag run; checkouts and version/tag resolution now use github.ref only.

Adds a lightweight guard job that fails branch dispatches before the build matrix starts, with docs in the workflow header explaining why cosign’s run ref must match @refs/tags/v.*.

Hardens runner scripts (R8): version and publish tag steps pass github.ref_name through REF_NAME env instead of interpolating ref strings into shell, avoiding command injection from malicious tag names.

^{Reviewed by Cursor Bugbot for commit b201c11. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 45 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#222 — fix(sklearn): unwrap Pipeline to terminal estimator before merge dispatch (feat(data ingest): wire the 5 text tasks (#182) #209) · author: @divyasinghds · no reviewer assigned
• averaging-service#224 — chore: clear the ruff backlog (E4,E7,E9,F) · author: @LukasWodka · no reviewer assigned
• averaging-service#225 — fix(averaging): fail fast + dead-letter on permission-denied weight write (fix(push): text preflight fails closed on a labels.csv read error #221) · author: @divyasinghds · no reviewer assigned
• backend#1201 — docs(rfc): Data spaces & federated dataset composition (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1217 — docs(rfc): Dataset integrity & score reproducibility (draft) · author: @LukasWodka · reviewer: @saadqbal
• backend#1261 — RFC-BACKEND-0008: board & process reset (decision RFC — for markup) · author: @LukasWodka · reviewer: @saadqbal
• backend#1284 — docs(deploy): backend deploy runbook skeleton (#1263) · author: @LukasWodka · no reviewer assigned
• backend#1293 — fix(heartbeat): tolerate unknown experiment_key in training_info (#1287) · author: @divyasinghds · no reviewer assigned
• backend#1321 — chore: clear house-rules findings · author: @LukasWodka · no reviewer assigned
• backend#1322 — fix(errors): replace bare except clauses with scoped handling (#614) · author: @saqlainsyed007 · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

[saadqbal]

Nice, tight fix 👍 The tag-ref guard lines up with the installers' @refs/tags/v.* anchor, and needs: release means publish can't run when a branch dispatch trips the guard — so all signing runs stay at a tag ref. One non-blocking hardening nit inline. Minor thought: a job-level if: (or a tiny pre-flight job that release needs) would reject a misdirected branch dispatch once, instead of spinning up all 8 matrix legs to each fail the guard.

[saadqbal]

Nice, careful fix — constrains the dispatch ref at the root instead of band-aiding the installers, and the comments make the keyless-identity reasoning easy to follow 👍 Verified the premise holds against develop (installers + header verify block both trust @refs/tags/v.*). One optional non-blocker inline.

[LukasWodka]

@saadqbal both nits implemented (pre-flight guard job + env-passed refs, in-matrix guard removed) — the new commit dismissed your approval per stale-review policy; quick re-tick when you have a second and Lukas lands it.

[LukasWodka]

@saadqbal you're right — that step was the one the earlier hardening pass missed, and Bugbot flagged the same line. Fixed in b201c11.

Determine release tag now does exactly what the guard and version steps do:

      - name: Determine release tag
        id: tag
        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          REF="$REF_NAME"

So the tag ref is passed through the environment, never interpolated into the script — a crafted v* tag carrying backticks or $() can no longer execute on the publish runner before the release is created. Swept the rest of the file to be sure this was the last one: there are now zero ${{ github.* }} expansions inside any run: block. actionlint + shellcheck clean at the pinned versions (1.7.12 / 0.11.0).

Both threads resolved.

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit b201c11. Configure here.}