Publication-order gate never runs on the direct-push production path

[devantler]

🤖 Generated by the Agentic Engineer

Evidence

Raised by Codex against #2848 at e2749af3 and confirmed by reading the workflows.

The publication-order validator is wired into ci.yaml, which triggers on pull_request and
merge_group only. cd.yaml's documented direct-push recovery path goes from the EKS
authorization job straight into ./.github/actions/deploy-prod, and never invokes the validator.

So a change reaching main by direct push can be dispatched to production without the ordering gate
examining it even once.

Why this is separate from the analyzer work

#2873 and #2870 are about what the guard can see inside a step it inspects. This is about steps it
is never handed. The distinction matters because they fail in opposite directions: hardening the
analyzer does nothing here, and any strengthening of it creates a false sense that the ordering
property is enforced on every path to production when one path is unguarded.

It also caps the value of that work — the guarantee is only as strong as its weakest route, so the
analyzer's ceiling is currently set by this gap rather than by its own precision.

What resolving it looks like

Make the publication validation a check the production deploy actually depends on, rather than a
PR-time check. Either add it to the manual pre-deploy gate in cd.yaml, or make the CD job require
a check that runs it — so the path cannot execute without it.

Acceptance criteria

• A direct-push production deploy cannot proceed without the publication-order validation running.
• The recovery path documented in cd.yaml is covered, not just pull_request / merge_group.
• A regression proof: a deliberately mis-ordered publication reaches the CD path and is refused.

Part of #2627. Related: #2873, #2870, #2848.

[coderabbitai]

🔗 Related PRs

#2330 - ci: heal prod when a merge-group deploy fails (restore main) [merged]
#2622 - fix(ci): heal cancelled merge-group deploys [merged]
#2633 - fix(deploy): verify incoming image on Talos nodes [merged]
#2825 - fix(ci): queue prod deploys instead of dropping the pending one [merged]
#2830 - feat(ci): publish Kubescape posture findings to Code Scanning [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[devantler]

🤖 Generated by the Agentic Engineer

Second instance of the same scope gap: startup env inherited from the callers

Raised by Codex against #2848 at 57d69088, confirmed by reading the entry point.

ci.yaml:53 runs the validator over .github/actions/deploy-prod/action.yml and nothing else:

go run ./scripts/validate-publication-order .github/actions/deploy-prod/action.yml

A caller can set BASH_ENV, ENV, SHELLOPTS or BASHOPTS at job scope, or on the step that
invokes the composite. Those are inherited by the composite's bash run steps, but they live in a
file the guard never reads. A startup file defining cosign() { true; } leaves the action
byte-identical, validating clean, and reconciling without a signature.

Why it belongs here rather than on #2873

This issue already draws the line: #2873/#2870 are about what the guard can see inside a step it
inspects; this is about what it is never handed. The caller's job-level env: block is
squarely the second. #2848 hardened assignments to those names inside the analyzed action, which
does not touch this vector and does not claim to.

Two candidate fixes

1. Neutralize inside the action — unset/override BASH_ENV, ENV, SHELLOPTS, BASHOPTS at
   the top of the composite, so an inherited value cannot reach its run steps. Self-contained, and
   does not depend on enumerating callers.
2. Analyze every production caller — widen the validator's input to the invoking workflows, which
   also addresses this issue's original trigger-coverage half.

(1) is the smaller and more durable half and could ship independently.

[devantler]

🤖 Generated by the Agentic Engineer

Third instance: a step that delegates to a local composite is skipped entirely

Raised by Codex against #2848 at e8c17a5d (P1), confirmed by reading mustModelEveryRunStep:

for i, s := range steps {
    if s.Run == "" {
        continue
    }

A step with uses: has an empty Run, so the loop skips it — and every other check that reasons
about executed commands sees nothing in it either. A local composite invoked between the push and
the signing steps can run ./scripts/run-ksail-prod-with-pull-auth.sh workload reconcile, advancing
production before any evidence exists, while the later direct reconcile still satisfies the visible
release marker. Ordering asserted, ordering not held.

This is the same axis as the two instances above — the validator is handed a file and reasons only
about that file's literal run: blocks. A uses: step is a hole inside the very file it does
inspect, which makes it the cheapest of the three to close.

Candidate fixes

1. Reject an unmodeled delegated step inside the protected sequence. Fail closed, no recursion,
   consistent with the inversion test(ci): pin the prod publication ordering so evidence precedes release #2848 already applied on its shell-state axis: if a step between the
   first push and the release cannot be reasoned about, say so and name it.
2. Recursively inspect local composite actions (uses: ./...). Strictly better coverage, but it
   needs resolution of the action reference and re-entry into the whole analysis.

(1) is the smaller half and would close the hole today; (2) subsumes it later. Note the real
deploy-prod/action.yml would need checking against (1) before it lands — if it legitimately
delegates inside that window, (1) needs a narrow allowance rather than a blanket rejection.

[devantler]

🤖 Generated by the Agentic Engineer

Draft PR: #2939.

Acceptance criteria, and how each is met:

1. A direct-push production deploy cannot proceed without the publication-order validation running. — cd.yaml gains a validate-publication-contract job running the identical invocation ci.yaml uses, and deploy-prod needs it. GitHub will not start a job whose dependency failed, so the deploy cannot execute without the contract passing.
2. The recovery path documented in cd.yaml is covered, not just pull_request / merge_group. — the gate is a job in cd.yaml itself, so it runs on the workflow_dispatch that path uses.
3. A regression proof: a deliberately mis-ordered publication reaches the CD path and is refused. — TestMisorderedPublicationIsRefusedOnTheDirectPushPath asserts both halves, because either alone still ships unsigned bytes: the contract rejects a publication that pushes straight to the promoted reference, and the CD deploy cannot run without that rejection reaching it.

One thing worth recording beyond the criteria. The wiring is checked by the validator itself, because the wiring is exactly the part that goes missing quietly — removing a needs: entry breaks no test, fails no lint, and leaves a workflow that still reads as gated because the job is still sitting there. jobNeeds() fails closed on any shape it cannot parse, so an unrecognised workflow style reports "not established" rather than "wired". Five ablations, each removing one link in the chain, each refused.

And a defect this surfaced in the neighbouring guard. TestManualDeployIsGatedByTheValidator asserted the authorization gate by grepping cd.yaml for the literal needs: [validate-eks-authorization]. That fails in both directions: it passes on the same text sitting in a comment, and it breaks the moment a second legitimate gate joins the list — which is what adding this one did. It now parses and asserts membership, matching the sibling assertion on ci.yaml in the same file. Verified as a strengthening, not a relaxation: with the authorization gate removed the parsed form still fails and names the bypass.