fix(ci)!: only a push to the caller's own repo may release

[btravers]

Vulnerability

release-reusable.yml's documented caller pattern, used by amqp-contract, temporal-contract, unthrown and this repo's own release.yml, is:

on: { workflow_run: { workflows: ["CI"], types: [completed], branches: [main] } }
jobs:
  release:
    if: ${{ github.event.workflow_run.conclusion == 'success' }}

workflow_run's branches: filter matches the triggering run's head branch. CI also runs on pull_request, fork PRs included, so a fork PR from a branch named main passes the filter.

The release job then runs in the base repository with RELEASE_PAT, contents: write and id-token: write. It checks out workflow_run.head_sha, which is the fork's commit, and runs that commit's install and release scripts. npm Trusted Publishing does not stop this: the OIDC claims name the right repository and workflow file, so the tarball would even carry provenance.

The only gate is the fork-PR approval policy, and with first_time_contributors it disappears after one merged PR.

Fix

• release-reusable.yml: the job refuses any workflow_run that isn't a successful push-triggered run of the caller's own repository. A called workflow sees its caller's github context, so this protects every caller once it picks up this version, even one that never updates its own if:. Other triggers such as workflow_dispatch are unaffected. The header example now shows the guard and a SHA pin.
• release.yml (this repo's own release): same guard.
• SHA pins: every action is pinned by commit SHA with a version comment. changesets/action@v2 was a branch, not a tag. Renovate helpers:pinGitHubActionDigests keeps the digests current.

actionlint passes. The only output is pre-existing shellcheck style notes in ci-reusable.yml.

After merge

• Move workflows-v1 to the merge commit so existing @workflows-v1 callers get the guard.
• Callers should then pin the reusable workflow by SHA (amqp-contract: ci: harden release pipeline and supply chain amqp-contract#689).
• Protect workflows-* tags with a ruleset so only admins can move them.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Pinned CI and release workflow actions to specific revisions, making the versions used in automation consistent.
  • Release workflows now run only after successful CI runs triggered by pushes from the repository. Successful runs from pull requests or forks no longer qualify.
  • Updated automated dependency maintenance to track pinned action revisions.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: btravstack/tools/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 5e4069c1-19b5-4eac-8de7-8d4c8f0a4731

📥 Commits

Reviewing files that changed from the base of the PR and between 25e7147 and 46a28c5.

📒 Files selected for processing (6)

• .github/actions/setup/action.yml
• .github/workflows/ci-reusable.yml
• .github/workflows/ci.yml
• .github/workflows/release-reusable.yml
• .github/workflows/release.yml
• renovate.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

CI and release workflows now reference actions by commit SHA. Release workflows add checks for successful push runs from the expected repository. Renovate adds a preset for GitHub Action digest pinning.

Changes

Workflow hardening

Layer / File(s)	Summary
CI action pins and digest configuration .github/actions/setup/action.yml, .github/workflows/ci-reusable.yml, .github/workflows/ci.yml, renovate.json	Setup and CI jobs use SHA-pinned actions. Renovate extends its configuration with the GitHub Action digest pinning preset.
Release workflow conditions and action pins .github/workflows/release-reusable.yml, .github/workflows/release.yml	Release jobs add checks for success, push events, and matching repositories where specified. Reusable workflow, checkout, setup, and Changesets references are pinned to commit SHAs.

Priority: ⬆️ High

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 46a28

The release gates are intended to exclude fork pull-request runs, and no merge-blocking issue is established by the supplied evidence. The change is ready for normal merge checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: release workflows now allow releases only after a push to the caller's own repository.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Copilot review overview

🟢 Approval recommended

The new workflow_run guards correctly restrict release execution to successful push runs from the same repository and the action SHA pinning reduces supply-chain risk without introducing functional regressions.

Review effort: Lite
Findings: None

What changed in this PR

This PR hardens the release pipeline against a workflow_run escalation where a fork PR (with a main-named branch) could trigger a release job in the base repo and execute attacker-controlled code with release credentials/OIDC, and it also standardizes GitHub Actions pinning to immutable SHAs.

Changes:

• Add a defensive if: gate to only allow releases from successful push-triggered CI runs in the same repository (blocking fork PR workflow_run abuse).
• Pin GitHub Actions (checkout, setup-node, cache, pnpm/action-setup, changesets/action) to commit SHAs.
• Enable Renovate’s helpers:pinGitHubActionDigests to keep pinned action digests current automatically.

File	Description
renovate.json	Enables Renovate helper to pin GitHub Actions by digest/SHA.
.github/​workflows/​release.yml	Adds release gating for workflow_run and pins actions used by the release workflow.
.github/​workflows/​release-reusable.yml	Adds “defense in depth” gating for callers and pins actions used by the reusable release workflow.
.github/​workflows/​ci.yml	Pins actions/checkout to a commit SHA for CI jobs.
.github/​workflows/​ci-reusable.yml	Pins commonly used actions (checkout, setup-node, cache, pnpm/action-setup) to commit SHAs across reusable CI jobs.
.github/​actions/​setup/​action.yml	Pins pnpm/action-setup and actions/setup-node to commit SHAs in the composite setup action.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.