fix(notify): keep recovery gate read-only

[psimaker]

Summary

• grant the owner publication gate only actions: read in addition to its existing contents: read, so it can validate the exact failed workflow run and jobs;
• keep the gate free of every write permission and accept that a read-only token cannot enumerate a draft release;
• defer an invisible draft to the existing contents: write staging resolver, which requires exactly one matching release and refuses to recreate a missing draft during recovery before any release mutation.

Failure evidence

Recovery run 29332225420 completed its notify guard and publication safety policy, then failed closed in Owner Publish Gate. Every registry, image-selection, binary, draft-staging, rollout, finalization, and public-verification job was skipped, so the failed recovery attempt changed no release state.

The exact tag, source commit, failed source run, draft, rollback release, image digest, platform digests, attached image attestations, and five binary attestations were independently reverified before this change. GitHub's release API exposes drafts only to callers with push access, while this gate intentionally remains read-only.

Security and compatibility

• no write, OIDC, attestation, package, or release permission is added to the gate;
• the recovery-only image verifier remains packages: read;
• missing or mismatched recovery drafts still abort in the write-isolated staging job and cannot be recreated;
• normal tag publication, public read-only retries, helper runtime, wire formats, pairing, namespace behavior, and Decision 024 are unchanged;
• existing installations remain dormant without explicit operator configuration;
• upload, download, and roundtrip product evidence remain unset.

Verification

• ruby -c .github/scripts/notify-publish-safety.rb
• ruby .github/scripts/notify-publish-safety.rb
• actionlint 1.7.12 with ShellCheck 0.10.0
• zizmor --offline 1.26.1: no findings
• cd notify && GOTOOLCHAIN=local go test ./... -count=1
• Trivy 0.70.0 filesystem vulnerability and secret scan: no HIGH/CRITICAL vulnerabilities or secret findings
• git diff --check

Release truth

Helper publication remains incomplete until a new exact-main recovery run passes immutable image and binary verification, draft staging, published upgrade/rollback/forward-recovery proof, finalization, and public read-only verification.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 514f27e5-cf95-4c2c-b608-0bb7e8400187

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The publish-gate workflow now uses explicit read-only permissions. Recovery mode accepts an unavailable draft release and reports that draft visibility is deferred to later recovery staging logic. The safety script validates both requirements.

Changes

Publish gate safety

Layer / File(s)	Summary
Read-only publish-gate permissions .github/workflows/docker.yml, .github/scripts/notify-publish-safety.rb	The job grants and validates only actions: read and contents: read permissions.
Recovery draft visibility validation .github/workflows/docker.yml, .github/scripts/notify-publish-safety.rb	Recovery mode treats release_type=null as deferred draft visibility and requires the corresponding validation text.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• psimaker/vaultsync#111: Updates the same publish-gate policy and validation logic.
• psimaker/vaultsync#116: Expands the publish and draft-state validation model used by this gate.
• psimaker/vaultsync#117: Adjusts related recovery-mode draft visibility handling.

Suggested reviewers: dependabot[bot]

Poem

Read-only keys guard the gate,
Recovery waits instead of fate.
A hidden draft may safely stay,
Until staging lights the way.
Checks now echo what workflows say.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, uses conventional-commit style, and accurately reflects the read-only recovery gate change.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	Changed code only tightens read-only permissions and emits a generic recovery-gate message; it adds no note/content capture, secret logging, or exfiltrating network calls.
Bounded Ios Background Work	✅ Passed	The PR only changes a Ruby safety script and a GitHub workflow; no Swift/iOS background-execution code was modified, so this check is not applicable.
Bridge Contract Compatibility	✅ Passed	The diff only changes a Ruby safety script and workflow YAML; no Go/Swift bridge code, JSON shapes, or gomobile-compatible types were touched.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/helper-publication-gate-recovery

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[psimaker]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.