fix(publish): reject incomplete OIDC identity reads

[devantler]

🤖 Generated by the Agentic Engineer

Why

Publishing can continue after a failed identity check, leaving release signing dependent on an incomplete response.

What

Stop publication when the identity check fails while preserving successful releases and existing caller choices.

Fixes #488

[devantler]

🤖 Generated by the Agentic Engineer

Evaluation at edf5a79: the actual implicit-shell resolver accepted a token body followed by curl exit 7 (RED). Both workflows now declare Bash with pipeline failure propagation. Healthy padding/alphabet cases pass; failed transfer and empty responses emit no ref. Removing the declared shell fails again for the failed-transfer reason in each workflow (GREEN with independent controls).

The complete publisher preflight simulation, all fourteen repository baseline commands, ShellCheck and scoped zizmor passed locally. GitHub verifies the signed commit. Hosted CI remains queued; this comment is local validation, not merge readiness. No signer identity, permission or rollout default changed.

[github-code-quality]

Code Coverage Overview

Languages: Go, C#

Go / code-coverage/test

The overall line coverage in commit edf5a79 in the codex/publisher-oidc... branch remains at 50%, unchanged from commit 3bc2e9e in the main branch.

C# / code-coverage/dotnet

The overall line coverage in commit edf5a79 in the codex/publisher-oidc... branch remains at 100%, unchanged from commit 3bc2e9e in the main branch.

---

_{Updated October 05, 2026 17:13 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: edf5a79

• CodeRabbit: the included OSS review is unavailable for this public catalogue. Provider summary #486 (comment) was updated at 2026-10-05T17:51:17Z and states a 38-minute reset; its invocation refusal at #486 (comment) is 17:51:19Z. The event-bound reset is 18:29:17Z.
• Codex: account review usage is exhausted, directly verified at devantler-tech/platform#4533 (comment), updated 2026-10-05T16:59:30Z. Recovery requires account quota renewal or a maintainer decision; no paid overage is authorized.
• Cursor Bugbot: this user/team reached its usage or spend limit, directly verified at devantler-tech/world-at-ruin#1240 (comment), updated 2026-10-05T16:38:41Z. Only its admin can change that limit.

Direct reads at this head found no formal reviews, no review threads, no provider verdict/finding conversation artifacts and no Bugbot check. All current-head CI checks have settled without failures. I reviewed both production resolver changes and the complete regression diff for correctness, security and compatibility. Explicit Bash propagates curl failure through the token-reading pipeline; failed reads emit no authenticated calling ref. Successful token decoding and default-off bypass behavior remain covered. The independently removed-shell controls reproduce failed-transfer acceptance in both families. No permissions, identity match or rollout defaults changed.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Delivery verified at merge commit 018f267: main CI passed, issue #488 is closed and the board readback is Done. Fresh main retains the repair.

Process deviation: promotion queued a non-required automation check after the earlier CLEAN preflight, and the merge proceeded while that check was queued. Its current readback is settled, and main CI passed. Subsequent merges in this round require a fresh CLEAN state immediately before mutation.