fix: bind release verification to platform artifact namespaces

[seonghobae]

Summary

• bind downloaded release artifacts to the producer matrix platform directories
• verify pull-request and tag artifacts through the same fail-closed admission script
• reject cross-platform artifact placement and document the test helpers

Validation

• npm test -- --run src/lib/releaseArtifactVerifierDirectoryContract.test.ts src/lib/releaseTagArtifactVerifierContract.test.ts src/lib/releaseProvenanceContract.test.ts (8 passed)
• shellcheck .github/scripts/verify-release-artifacts.sh
• git diff --check

Supersedes closed, unmerged #307 without reopening it.

---

Summary by CodeRabbit

• 개선 사항

  • 릴리스 아티팩트 검증이 플랫폼별 디렉터리 구조와 파일 구성을 정확히 확인하도록 강화되었습니다.
  • 다운로드한 릴리스 아티팩트가 SBOM 생성 전에 검증됩니다.
  • Windows 릴리스 경로 검증 기준이 업데이트되었습니다.
  • 릴리스 빌드 출처 증명이 최신 버전으로 갱신되었습니다.

• 테스트

  • 올바른 아티팩트 구조와 잘못된 배치가 모두 검증되도록 테스트가 추가되었습니다.
  • 릴리스 워크플로 단계 순서와 아티팩트 검증 계약을 확인하는 테스트가 추가되었습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7772ec31-e784-4eee-af46-0fdf32545afa

📥 Commits

Reviewing files that changed from the base of the PR and between 79067c1 and 1de59f2.

📒 Files selected for processing (5)

• .github/scripts/verify-release-artifacts.sh
• .github/workflows/release.yml
• src/lib/releaseArtifactVerifierDirectoryContract.test.ts
• src/lib/releaseProvenanceContract.test.ts
• src/lib/releaseTagArtifactVerifierContract.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

릴리스 아티팩트 검증기가 플랫폼별 디렉터리의 직접 파일만 검사하도록 변경되었습니다. attest-release 작업은 SBOM 생성과 증명 전에 검증을 수행합니다. 관련 워크플로 계약과 디렉터리 계약 테스트도 갱신되었습니다.

Changes

릴리스 아티팩트 검증

Layer / File(s)	Summary
검증기 디렉터리 계약 .github/scripts/verify-release-artifacts.sh	번들과 운영 CLI 검사를 플랫폼별 디렉터리로 제한합니다. Windows 디렉터리 이름을 release-disksage-windows-2022-${run_attempt}로 변경합니다.
attest-release 검증 단계 .github/workflows/release.yml, src/lib/releaseProvenanceContract.test.ts, src/lib/releaseTagArtifactVerifierContract.test.ts	attest-release 작업이 다운로드한 아티팩트를 검증한 후 SBOM과 증명을 처리하도록 변경합니다. actions/attest 참조와 관련 계약 검사를 갱신합니다.
검증기 계약 테스트 src/lib/releaseArtifactVerifierDirectoryContract.test.ts	예상 플랫폼 디렉터리 아래에 중첩된 Debian 번들이 검증 실패를 발생시키는지 확인합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 1de59

The release verification change tightens platform-specific artifact admission and preserves fail-closed checks before attestation and publication. No actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant AttestRelease as attest-release
  participant ReleaseArtifacts as release-artifacts
  participant ArtifactVerifier as verify-release-artifacts.sh
  participant SBOM as SBOM 생성
  participant Attestation as actions/attest

  AttestRelease->>ReleaseArtifacts: 아티팩트 다운로드
  AttestRelease->>ArtifactVerifier: 아티팩트 루트와 run_attempt 전달
  ArtifactVerifier->>ReleaseArtifacts: 플랫폼별 파일 계약 검사
  ArtifactVerifier-->>AttestRelease: 검증 결과 반환
  AttestRelease->>SBOM: 검증 후 SBOM 생성
  AttestRelease->>Attestation: 검증 후 빌드 증명 생성

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 릴리스 아티팩트 검증을 플랫폼별 아티팩트 네임스페이스에 연결하는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 4 files. (1 skipped: 1 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 7 functions across 4 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/release-artifact-namespace-v2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Superseded after stale-convergence against the canonical release-verifier owner #264.

Preservation proof on current heads:

• fix: bind release verification to platform artifact namespaces #308 head: 67306e9c262d76d721edde8edf2c38a96e125956
• fix: verify Windows release artifact namespace #264 head: c81da762e1480be481e772806b61a4786522458a
• .github/scripts/verify-release-artifacts.sh is now the exact same blob (2f9047c27288195b0b2570c2939e3b7d43f5618f) on both lines, including direct-child bundle/CLI admission.
• Both release workflow deltas add the shared verifier immediately after tag artifact download and before SBOM generation; fix: verify Windows release artifact namespace #264 carries that same production change.
• fix: bind release verification to platform artifact namespaces #308's nested-bundle regression is now preserved on fix: verify Windows release artifact namespace #264 (test: reject nested release bundle placement → direct-depth verifier fix).
• fix: bind release verification to platform artifact namespaces #308's standalone tag-order test is semantically subsumed by fix: verify Windows release artifact namespace #264's stronger contract, which proves download < verifier < SBOM rather than only verifier < SBOM.

No unique #308 release-verification behavior is being discarded. Closing this competing owner avoids duplicate writer lanes; #264 remains the canonical release-verifier integration line. Current #264 checks/rules still govern merge readiness.

[seonghobae]

Superseded by canonical release-verifier owner #264 at exact head 340fcfee83a5c137c8788eb0fae110d2de357620 after explicit delta preservation. Verified succession: .github/scripts/verify-release-artifacts.sh is the same blob (2f9047c27288195b0b2570c2939e3b7d43f5618f); src/lib/releaseTagArtifactVerifierContract.test.ts was missing from #264, was copied byte-for-byte from this PR, and is now the same blob (c24e4368a4a7d0e4a4b6a653f502443effddf68f); src/lib/releaseProvenanceContract.test.ts is the same blob on both lineages (79ea10495f3e864485a97f0fd1373166c9faf006); #264 carries the platform-directory verifier regression in its later expanded form and the release workflow retains the shared verifier-before-SBOM contract while incorporating the current Windows namespace RCA. All returned #308 review threads are resolved. Closing this predecessor only because its useful production/test/contract evidence has been explicitly inherited by #264; no predecessor check or review status is transferred.