fix(cosign): correct trust-list github org refs by namastex888 · Pull Request #96 · automagik-dev/autopg

namastex888 · 2026-05-09T13:39:49Z

Summary

Two of the three hardcoded TRUSTED_IDENTITIES regexes in src/cosign/trust-list.js referenced GitHub orgs that don't host the actual release workflows. Without this fix, pgserve verify against any actually-signed pgserve binary fails — and the upcoming wave 2 G3 "manifest LOCK 1" verifier would freeze the broken values into every per-consumer manifest in perpetuity.

publisher	trust-list regex	actual repo	status
`@automagik/genie`	`github.com/automagik-dev/genie/…`	`automagik-dev/genie`	✅ correct (untouched)
`@automagik/omni`	`github.com/automagik/omni/…`	`automagik-dev/omni`	❌ → fixed
`@automagik/pgserve`	`github.com/automagik/pgserve/…`	`namastexlabs/pgserve`	❌ → fixed

Verified org names via git remote -v in /repos/omni and /repos/pgserve. The release-publish.yml workflow's gh attestation verify --owner namastexlabs already uses the correct owner — the bug was only in the in-process verifier (used by pgserve verify and the upcoming pgserve create-app LOCK 1 path).

Why now

Surfaced during pre-flight audit of wave 4 G5 (ENGINEER-AUDIT-G5.md) while warming up on wave 2 G3 deliverables. Held wave 2 G3 dispatch: G3's manifest LOCK 1 verifier deep-clones TRUSTED_IDENTITIES at pgserve create-app time, so a wrong-regex live state would lock broken trust roots into every consumer's frozen manifest. Best to land before G3 starts coding.

Test plan

bun test tests/cosign/ tests/cli/trust.test.js tests/cli/verify.test.js → 83 pass / 0 fail
bun run lint → clean
bun run deadcode → clean (only pre-existing knip config hints)
No test pins the literal regex string (verified via grep -rn "automagik/omni\|automagik/pgserve" tests/ — only tests/cli/verify.test.js:238 references '@automagik/pgserve' which is the npm package name field, not the regex)
Optional: dogfood pgserve verify against a real signed binary (route to qa for smoke)

Out of scope (follow-ups, not blockers)

The publisher: '@automagik/pgserve' literal still lives in trust-list.js:52 even though the actual published npm package name is pgserve (no scope) per npm view pgserve. Worth a separate audit; not changed here per orchestrator's tight-scope instruction.
Whether v2.5.0 needs a hot-republish to ship this fix to operators already on the broken trust list (Felipe-decision; coordinates with QA Phase 1 B1).

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated internal formatting in the cosign trust list configuration with no functional impact to system behavior.

…, pgserve → namastexlabs) The hardcoded TRUSTED_IDENTITIES regexes in src/cosign/trust-list.js referenced two GitHub orgs that don't host the actual release workflows: | publisher | trust-list regex | actual repo | |---------------------|-----------------------------------|----------------------| | @automagik/genie | github.com/automagik-dev/genie/… | automagik-dev/genie ✓| | @automagik/omni | github.com/automagik/omni/… | automagik-dev/omni ✗ | | @automagik/pgserve | github.com/automagik/pgserve/… | namastexlabs/pgserve✗| Verified via `git remote -v` in /repos/omni and /repos/pgserve. The release-publish.yml workflow's `gh attestation verify --owner namastexlabs` already uses the correct owner — the bug was only in the in-process verifier. Impact without this fix: - `pgserve verify` against any actually-signed pgserve binary fails because cosign's --certificate-identity-regexp never matches `namastexlabs/pgserve` against a regex pinned to `automagik/pgserve`. Same for omni. - Wave 2 G3 ships a "manifest LOCK 1" verifier that deep-clones TRUSTED_IDENTITIES at create-app time. Without this fix, LOCK 1 would freeze the broken regex into every per-consumer manifest in perpetuity. Operators would never reach a working verify state. Surfaced by: pre-flight audit during ENGINEER-AUDIT-G5 cross-checking; 2/3 hardcoded trust roots had wrong-org references. No tests pin the literal regex string; cache-token + verify tests use the `id` field (`automagik-pgserve-release` etc.), which is unchanged. trust-store tests use generic regexes (`^https://github.com/acme/.*$`). Validation: bun test tests/cosign/ tests/cli/trust.test.js tests/cli/verify.test.js → 83/83 pass bun run lint → clean bun run deadcode → clean (only pre-existing knip config hints) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

coderabbitai · 2026-05-09T13:40:00Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: e9d9e688-6430-4c1c-a080-a69566eeb41f

📥 Commits

Reviewing files that changed from the base of the PR and between a18c849 and 935832d.

📒 Files selected for processing (1)

src/cosign/trust-list.js

📝 Walkthrough

Walkthrough

The PR reformats property line ordering within two entries of the hardcoded TRUSTED_IDENTITIES array in src/cosign/trust-list.js. The identityRegexp and description fields are repositioned within the automagik-omni-release and automagik-pgserve-release objects. No exported symbols, immutability guarantees, or functional behavior are altered.

Changes

Trust List Entry Formatting

Layer / File(s)	Summary
Trust List Entry Reordering `src/cosign/trust-list.js`	Properties within `automagik-omni-release` and `automagik-pgserve-release` entries are reordered for consistent formatting without changing constants, exports, or lookup logic.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A rabbit hops through trust lists with care,
Reordering entries with gentle flair,
Names and regexps in neat array,
Still frozen and faithful come what may! 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: correcting GitHub organization references in the hardcoded trust list that were pointing to wrong repositories.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/trust-list-org-corrections

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request updates the GitHub repository paths in the identityRegexp for the omni and pgserve release workflows. A review comment identifies a potential mismatch in the pgserve workflow filename, suggesting that release-publish.yml should be used instead of release.yml to ensure successful OIDC identity verification.

gemini-code-assist · 2026-05-09T13:45:10Z

    publisher: '@automagik/pgserve',
    issuer: SIGSTORE_GITHUB_ACTIONS_ISSUER,
-    identityRegexp: '^https://github.com/automagik/pgserve/.github/workflows/release.yml@refs/tags/v.*$',
+    identityRegexp: '^https://github.com/namastexlabs/pgserve/.github/workflows/release.yml@refs/tags/v.*$',


The pull request description explicitly mentions that the release-publish.yml workflow in the namastexlabs/pgserve repository is used for attestations. However, the identityRegexp updated here still references release.yml. If release-publish.yml is indeed the workflow responsible for signing the binary, this regex will fail to match the OIDC identity during verification. Please verify the correct filename and update the regex if necessary.

Suggested change

identityRegexp: '^https://github.com/namastexlabs/pgserve/.github/workflows/release.yml@refs/tags/v.*$',

identityRegexp: '^https://github.com/namastexlabs/pgserve/.github/workflows/release-publish.yml@refs/tags/v.*$',

gemini-code-assist Bot reviewed May 9, 2026

View reviewed changes

namastex888 mentioned this pull request May 9, 2026

feat(g2): integration test scaffold + queries rename + CI matrix wire #97

Merged

5 tasks

namastex888 merged commit 9c4cdf1 into main May 9, 2026
9 checks passed

namastex888 mentioned this pull request May 9, 2026

fix(cosign): correct publisher field for pgserve + reconcile SHARED-DESIGN org refs #102

Merged

3 tasks

namastex888 deleted the fix/trust-list-org-corrections branch May 10, 2026 02:44

namastex888 mentioned this pull request May 10, 2026

docs(wish): autopg-distribution-cutover-finalize refresh — IN-PROGRESS state + G1/G3 history blocks #109

Merged

4 tasks

coderabbitai Bot mentioned this pull request May 11, 2026

fix(trust-list): omni regex anchors on sign-attest.yml@ (pre-emptive G2 mirror) #127

Merged

3 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(cosign): correct trust-list github org refs#96

fix(cosign): correct trust-list github org refs#96
namastex888 merged 1 commit into
mainfrom
fix/trust-list-org-corrections

namastex888 commented May 9, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 9, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	identityRegexp: '^https://github.com/namastexlabs/pgserve/.github/workflows/release.yml@refs/tags/v.*$',
	identityRegexp: '^https://github.com/namastexlabs/pgserve/.github/workflows/release-publish.yml@refs/tags/v.*$',

Conversation

namastex888 commented May 9, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why now

Test plan

Out of scope (follow-ups, not blockers)

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 9, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

namastex888 commented May 9, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 9, 2026 •

edited

Loading