fix(notify): continue verified recovery chain

[psimaker]

Summary

• evaluate every dual-path publication job after the recovery-only binary-attestation job is intentionally skipped;
• require every direct predecessor to succeed before draft staging, published rollout, or release finalization;
• turn any failed or skipped publication predecessor into a failing final read-only verification job.

Failure evidence

Recovery run 29334987744 was bound to main@ba91d4d72785b5101bf2c53d446a6ebcea8b3d72. Publication safety, notify tests, the owner gate, immutable image recovery, image selection, and binary-attestation selection succeeded. The tag-only Attest Release Binaries job was correctly skipped, but GitHub propagated that skip through the implicit job-level success condition, so draft staging, rollout, finalization, and public verification were all skipped.

The workflow reported success, but release draft 353712477 remained unpublished with zero assets and its staging body unchanged. No registry, draft, release, rollout, or public-state mutation occurred in this recovery run.

Security and compatibility

• every job with draft or release write access remains gated by exact owner, ref, confirmation, and explicit direct-predecessor success checks;
• the final public verifier remains read-only and now fails the workflow if any required predecessor failed or was skipped;
• no permission, tag, image, binary, attestation, release-note, helper-runtime, wire-format, pairing, namespace, or Decision 024 behavior changes;
• existing installations remain dormant without explicit operator configuration;
• upload, download, and roundtrip product evidence remain unset.

Verification

• ruby -c .github/scripts/notify-publish-safety.rb
• ruby .github/scripts/notify-publish-safety.rb
• actionlint 1.7.12 with ShellCheck 0.10.0
• zizmor --offline .github/workflows/docker.yml 1.26.1: no findings
• cd notify && GOTOOLCHAIN=local go test ./... -count=1
• Trivy 0.70.0 filesystem vulnerability and secret scan: no HIGH/CRITICAL vulnerabilities or secret findings
• git diff --check

Release truth

Helper publication remains incomplete until a new exact-main recovery run passes immutable image and binary verification, draft staging, the published upgrade/rollback/forward-recovery proof, finalization, and public read-only verification.

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

Publication gating

Layer / File(s)	Summary
Workflow predecessor gates .github/workflows/docker.yml	Publication staging, rollout, finalization, and verification jobs now use always() with explicit predecessor success checks; verify-published also validates all listed predecessor results in a dedicated step.
Safety validator enforcement .github/scripts/notify-publish-safety.rb	Validation now checks sequenced predecessor gates, dual-path always() selection, and the exact verify-published result mapping and fail-closed command.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• psimaker/vaultsync#111: Tightens publication gating and verification in the same workflow and safety script.
• psimaker/vaultsync#116: Updates immutable publication and result-based verification logic.
• psimaker/vaultsync#118: Hardens publish-gate conditional and recovery validation.

Suggested reviewers: dependabot[bot]

Poem

Gates stand firm where releases flow,
Success is checked before they go.
A skipped path cannot sneak through,
Every result must ring true.
The safety script watches too.

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
No Private Note Leakage	✅ Passed	Changed code only tightens job gating/status checks; it adds no logging or network path for note contents, paths, or secrets.
Bounded Ios Background Work	✅ Passed	Not applicable: the PR only changes GitHub Actions Ruby/YAML publication gating; no Swift/iOS background-execution code is touched.
Bridge Contract Compatibility	✅ Passed	Diff only touches .github automation; no go/bridge or Swift bridge-service files/tests changed, so the Swift-Go bridge contract is unaffected.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise, conventional-commit style, and matches the workflow recovery-chain hardening in this changeset.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/helper-publication-recovery-propagation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[psimaker]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[psimaker]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.