fix(noema): accept refreshed GitHub App publication identity

[seonghobae]

Incident

ContextualWisdomLab/appguardrail run 33553871167, job 100009806999 completed model review and minted a fresh repository-scoped cwl-noema-review installation token, then failed during exact-head publication with Noema GitHub App identity binding is invalid.

Confirmed root cause

The publication step intentionally labels the renewed credential noema-review-github-app-refresh. scripts/ci/noema_review_gate.py::current_actor() accepts bound App metadata only when the source is exactly noema-review-github-app, so the refreshed credential is rejected despite the same valid bot actor and numeric installation ID.

TDD state

This first commit contains only a focused regression test using the production incident metadata. It is expected to fail on the unchanged protected-main implementation. After RED evidence is recorded, the implementation will be changed minimally while retaining bot-login and numeric-installation fail-closed checks.

Scope

The existing long-running PR #1198 also touches noema_review_gate.py, but its delta concerns primary-review ordering and review pagination; it does not modify this identity binding. This repair remains isolated to the refreshed-token contract.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}