fix(ci): restore bypass-aware image publication gate

[thebtf]

Summary

• flatten top-level GitHub ruleset arrays before pagination/filtering so active tag and branch rulesets are actually evaluated
• use the empirically proven bypass-aware repository credential only in the two trusted ValidateWorkflowRun steps, while explicitly clearing it from candidate execution
• fail closed when bypass_actors is omitted
• consume preapproved authority epoch authority-0015 and advance to authority-0016

Root cause

PowerShell wrapped the REST API's top-level JSON array as one nested item (@(Invoke-RestMethod ...)), so the validator compared array-valued target/enforcement properties and reported zero matching tag rulesets. The job-scoped github.token also cannot prove bypass policy; GitHub Actions run 29556774487 verified the existing repository credential exposes both bypass actors and required-check integration identity.

Verification

• protected file blobs exactly match the authority-0015 preapproval in merged PR chore(ci): preapprove image gate authority repair #433
• pwsh -NoProfile -File scripts/production-gates/test-pr-authority-data-only.ps1 → PASS 9/9
• integrated candidate (before the required protected/ordinary split): go test -tags critical ./tests/critical/runtime -run TestDockerReleaseRefFreshnessGuard -count=1 → PASS
• live ValidateWorkflowRun against Docker run 29554211846 succeeded for tag v6.46.0, commit b1f4e964708435ce8e265ff0ba412e4ee34e7de8, tag ruleset 19085203, and main ruleset 19040665
• repository default GITHUB_TOKEN permissions reduced from write to read; PR approval permission disabled
• main ruleset restored to GitHub Actions integration 15368 with the sole pull_request recovery bypass actor

The regression-test file is intentionally split into the immediately following ordinary-path PR because the closed-world authority guard rejects maintenance PRs that mix protected control-plane and non-protected test paths.

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 12 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 137841c1-ccba-4ed3-81fd-e8b9d5e06575

📥 Commits

Reviewing files that changed from the base of the PR and between 5ed2cd5 and 73a5f05.

📒 Files selected for processing (3)

• .github/authority-policy.json
• .github/workflows/docker-publish.yml
• scripts/production-gates/build-and-scan-images.ps1

Walkthrough

Обновлены маршрутизация RULESET_AUDIT_TOKEN в workflow, обработка ответов rulesets и проверка bypass_actors в PowerShell. Runtime-тесты расширены проверками API, токенов, изоляции candidate-сборки и отсутствующих bypass-политик.

Changes

Ruleset validation flow

Layer / File(s)	Summary
Маршрутизация токенов workflow .github/workflows/docker-publish.yml	Шаги валидации используют RULESET_AUDIT_TOKEN из secrets.MARKETPLACE_PAT, а candidate-сборка явно очищает этот токен.
Обработка rulesets в production gates scripts/production-gates/build-and-scan-images.ps1	Ответы постраничных запросов приводятся к массивам, а свойства bypass_actors читаются безопасно при проверке rulesets.
Покрытие runtime-контрактов tests/critical/runtime/image_runtime_contract_test.go	Добавлены проверки маршрутизации токенов, изоляции candidate-сборки, live API, пагинации и отсутствующих bypass-политик.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• thebtf/engram#416: изменяет тот же workflow и PowerShell-скрипт для rulesets и provenance-токенов.

Suggested labels: authority-maintenance:authority-0002

Poem

Я兔ик вижу: токен в пути,
Ruleset-ы учатся расти.
Bypass исчез — тест настороже,
API отвечает в свежей строке.
Пагинация скачет: раз, два —
И gate встречает выпуск ура!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Заголовок кратко и точно отражает основное изменение: восстановление публикационного гейта с учетом bypass-политики.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/v646-image-publish-ruleset-token

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

tests/critical/runtime/image_runtime_contract_test.go (1)

602-604: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Покройте live-путь ValidateWorkflowRun.

Тест вызывает только ValidateRelease, поэтому проверяет Get-TagRulesets, но не изменённый Get-LiveRulesetDetails на Line 325–326. Добавьте ValidateWorkflowRun/-EventOnlyValidation сценарий с live API-обработчиком для tag и branch rulesets, включая проверки авторизации и пагинации.

Also applies to: 1283-1318

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/critical/runtime/image_runtime_contract_test.go` around lines 602 -
604, Расширьте тестовый сценарий live ruleset API, добавив вызов
ValidateWorkflowRun с режимом EventOnlyValidation и live-обработчиками для tag и
branch rulesets. Покройте для этого пути проверки авторизации и пагинации, чтобы
тестировался Get-LiveRulesetDetails, сохранив существующие проверки
ValidateRelease и Get-TagRulesets.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@tests/critical/runtime/image_runtime_contract_test.go`:
- Around line 602-604: Расширьте тестовый сценарий live ruleset API, добавив
вызов ValidateWorkflowRun с режимом EventOnlyValidation и live-обработчиками для
tag и branch rulesets. Покройте для этого пути проверки авторизации и пагинации,
чтобы тестировался Get-LiveRulesetDetails, сохранив существующие проверки
ValidateRelease и Get-TagRulesets.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c4afb17c-f819-45a3-a2aa-009dd295ee96

📥 Commits

Reviewing files that changed from the base of the PR and between b1f4e96 and 5ed2cd5.

📒 Files selected for processing (3)

• .github/workflows/docker-publish.yml
• scripts/production-gates/build-and-scan-images.ps1
• tests/critical/runtime/image_runtime_contract_test.go