fix(ci): recover tag-bound helper attestation

[psimaker]

Summary

• keep the tag-bound binary attestation job runnable after the intentionally
  skipped recovery branch while requiring every upstream safety gate to succeed
• advance the unused helper release path to 2.0.2 without changing or replacing
  the partial 2.0.1 publication
• keep public 2.0.0 as the scheduled-scan fallback and 1.8.0 as the rollback
  baseline

Failure and fix

Owner-gated publication run 29358780832 published and selected the immutable
2.0.1 image, but GitHub skipped Attest Release Binaries because its upstream
selector aggregates an intentionally skipped recovery branch with always().
The downstream job now uses always() as well and explicitly requires the
publish-safety policy, notify guard, owner publish gate, and immutable image
selector to have succeeded.

The policy test enforces all five condition fragments so a later workflow edit
cannot revive the skip or weaken the safety dependencies.

Scope

This change only affects helper publication workflow control, release pins, and
publication documentation. It does not change helper runtime behavior, D024,
application runtime, relay behavior, or wire compatibility.

Local verification

• ruby -c .github/scripts/notify-publish-safety.rb
• ruby .github/scripts/notify-publish-safety.rb
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
• uvx --from zizmor==1.27.0 zizmor .github/workflows/docker.yml .github/workflows/security.yml
• cd notify && go test ./...
• cd notify && go test -race ./...
• cd notify && go vet ./...
• cd notify && govulncheck ./...
• installer dry-run tests
• ShellCheck 0.10.0
• git diff --check

All passed. Zizmor reported no findings with the repository's nine existing
suppressions. Govulncheck reported no vulnerabilities.

Security and privacy

The release remains owner-gated and fail-closed. The added always() cannot
bypass an upstream failure because every safety result is checked explicitly.
No secret-scanner exception, permission expansion, mutable tag, public default
port, discovery, trust, namespace, application, relay, or protocol behavior is
introduced.

Partial 2.0.1 publication

Tag notify-v2.0.1 remains bound to commit
2e0b0914b0066141b3e3c0bf9cab8878430120b3. Its published image index remains
sha256:2c0f620fa1ce934ae75b358a60935460d244b19d4e98718728dd0338e0b24229.
There is no 2.0.1 GitHub release, binary set, rollout transcript, or public
verification, so 2.0.1 is retained only as immutable partial-publication
evidence and is not treated as a supported helper release.

Compatibility and rollback

The helper protocol and compatibility matrix are unchanged. A successful 2.0.2
publication must still prove 1.8.0 to 2.0.2, rollback to 1.8.0, and forward
recovery to 2.0.2 before finalization. Until then, public 2.0.0 remains the last
completed release and the VaultSync 2.0 release remains NO-GO.

[coderabbitai]

📝 Walkthrough

Walkthrough

The notify helper release was advanced from 2.0.1 to 2.0.2 across release metadata, image consumers, security scanning, publication gates, tests, and rollout documentation. Binary attestation now explicitly requires successful image readiness.

Changes

Notify 2.0.2 release

Layer / File(s)	Summary
Release metadata and image consumers notify/release.json, notify/scripts/install.sh, notify/docker-compose.yml, notify/README.md, .github/workflows/security.yml, notify/scripts/tests/*	Release metadata, default images, security scan targeting, documentation examples, and installer dry-run assertions now use 2.0.2.
Publication safety gates .github/scripts/notify-publish-safety.rb, .github/workflows/docker.yml	Safety assertions target the 2.0.2 release, and attest-binaries requires successful image-ready completion while preserving the recovery-path gating behavior.
Rollout and compatibility documentation docs/helper-publication-rollout.md, docs/relay-spec.md	Publication, compatibility, migration, monitoring, rollback, and relay references now describe helper 2.0.2.

Estimated code review effort: 2 (Simple) | ~15 minutes

Possibly related PRs

• psimaker/vaultsync#116: Related publication-safety and attest-binaries prerequisite gating changes.
• psimaker/vaultsync#117: Related handling of image-ready gating and the intentionally skipped recovery path.
• psimaker/vaultsync#123: Related helper release-tag and pinned image version updates.

Poem

Two point oh two takes flight,
Gates check readiness just right.
Images, scans, and docs align,
Release tags follow one clear line,
The helper ships beneath the sign.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	Touched changes are version pins and workflow gates; no new logging, analytics, diagnostics, or network path carries note contents, paths, keys, or receipts.
Bounded Ios Background Work	✅ Passed	No Swift/background-execution files changed; the diff is limited to workflow/docs/release pins, so this check is not applicable.
Bridge Contract Compatibility	✅ Passed	PR only changes workflow/docs/notify release pins; no Go or Swift bridge code or bridge tests were touched, so the bridge contract is unchanged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, conventional-commit style, and accurately reflects the attestation workflow change in this PR.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/helper-publication-dag-recovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}