ci: harden release image provenance

[Snuffy2]

Summary

Makes ShellPort image publication consume the exact read-only OCI build and reject moved release sources or unsafe immutable-tag publication.

What Changed

• Transfers a size- and hash-verified multi-architecture OCI archive to the write-scoped publish job without rebuilding.
• Binds the release event, tag, and default-branch ancestry before publishing.
• Fails closed on registry/API errors and protects semantic image tags.

Why

The image uploaded to GHCR must be the candidate that was validated, with release provenance and immutable-version checks enforced before package writes.

Validation

• npm exec vitest run ui/release_provenance_test.js (10 passing)
• Prettier, actionlint, and git diff --check
• Disposable-registry multi-architecture OCI transport proof

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Team

Run ID: c03f30f9-f30b-48a9-84ab-f7218f07687d

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR hardens container publication by separating provenance validation, OCI image construction, and write-scoped publication.

• Transfers a size- and hash-verified multi-architecture OCI archive instead of rebuilding in the publish job.
• Validates release tags, event commits, default-branch ancestry, and existing immutable registry digests.
• Makes interrupted multi-tag releases resumable when the immutable tag already has the expected digest.
• Prevents manual dispatches from publishing the shared edge tag, resolving the remaining publisher race.

Confidence Score: 5/5

The PR appears safe to merge; no actionable new issue remains, and the previously outstanding concurrent edge-publication race is fixed.

Manual dispatches can no longer publish edge, while main pushes preserve their intended edge publication path. The two earlier findings were manually resolved, and the current workflow also serializes release/manual publishers and permits recovery when an immutable tag already matches the verified archive.

Important Files Changed

Filename	Overview
.github/scripts/release-provenance.mjs	Validates release provenance and now rejects manual attempts to publish the shared edge tag.
.github/scripts/release-registry-guard.mjs	Enforces immutable digest matching and supports skipping an already-correct immutable tag during recovery.
.github/workflows/release.yml	Splits provenance, build, and publish privileges while transferring and verifying the exact OCI archive before publication.
ui/release_provenance_test.js	Covers release provenance rejection, manual edge rejection, immutable-tag recovery, and publisher serialization.

_{Reviews (3): Last reviewed commit: "ci: reject manual edge publications" | Re-trigger Greptile}