#1208 fix(release): verify Tauri release tags with a pinned trusted verifier

User description

Summary

Anchor the Tauri desktop release to trusted code and the exact pushed commit. Until now the verify-release-tag job checked out the tagged source and ran the signature verifier from that same checkout, so the revision under verification supplied its own verifier, and the release job checked out the mutable tag ref. This brings the Tauri workflow to the same trust model as the GHCR gate from #1205.

Part of #1206. The satisfying evidence for the remaining acceptance items (real-tag protection, non-publishing proof) is tracked in #1206 and #1201.

Security controls

• verify-release-tag runs only for a real push of a protected v* tag (github.ref_protected == true).
• The verifier is checked out from the pinned protected-main commit 147470682b62 (GitHub-verified) into trusted-verifier with no credentials, and runs there under env -i with only the real push-event variables. It never runs from the tag.
• The job exposes verified-tag-sha. bundle (which holds the updater signing secrets) and release require that output to equal github.sha.
• release needs bundle, security-audit and verify-release-tag, requires the exact audited SHA, and checks out github.sha instead of the tag ref. Publishing keeps the all-or-nothing asset staging from #1202.
• scripts/release-security-gate.mjs now covers tauri-build.yml with the same exact conjunction as docker.yml: the pinned verifier job, its allowlisted environment, no if or continue-on-error on verifier steps, no workflow-level environment, and an exact-commit checkout for the publishing job.

Tests

• releaseSecurityGate (67 tests) covers 18 new negative cases for Tauri: dispatchable or unprotected release, missing verifier result or SHA equality, permissive ||, status function, missing verifier needs, mutable checkout ref, tag-supplied verifier, unprotected or dispatchable verifier job, fake verifier command, preload wrapper, NODE_OPTIONS, wrong verifier output, skipped or non-blocking verifier step, inherited workflow environment.
• pnpm run ci:prepush passed locally on Node 22.23.3 and pnpm 12.13.0.

Tag protection evidence (read-only)

Active repository rulesets for refs/tags/v*: release-tags-authorized-creation (26812638, creation and non-fast-forward, one user bypass) and release-tags-immutable (26812769, update, deletion and non-fast-forward, no bypass actors). No v* test tag was created.

Release boundary

No tag, GitHub Release, registry push or Vercel mutation. This PR does not authorize v1.29.3; release status stays on hold in #1201 until the final exact-main candidate qualification is complete.

Summary by Sourcery

Require trusted verification and exact audited commits before publishing Tauri desktop releases.

Bug Fixes:

• Require Tauri releases to verify protected version tags using a trusted verifier and publish only the exact verified and audited commit.

Enhancements:

• Align Tauri release security controls with the GHCR workflow, including protected-tag checks, verifier output binding, exact-commit checkouts, and fail-closed signing prerequisites.

Documentation:

• Document the trusted verifier, exact-commit release requirements, and corresponding workflow security checks for Tauri publishing.

Tests:

• Expand release security and workflow policy coverage with negative cases for weakened Tauri verification, signing, checkout, environment, and publishing conditions.

Chores:

• Record the strengthened Tauri desktop publishing safeguards in the unreleased changelog.

Summary by cubic

Anchors the Tauri desktop release to a pinned, trusted verifier and the exact audited commit. Previously the verify-release-tag job checked out the tagged source and ran the signature verifier from that same checkout, so the revision under verification supplied its own verifier, and the release job checked out the mutable tag ref. The verifier now runs from a pinned protected-main commit in a clean environment, both bundle and release require the verified tag target to equal the triggering commit SHA, and release checks out that commit rather than the tag ref.

Release gate

• scripts/release-security-gate.mjs enforces the same conditions for tauri-build.yml as for docker.yml, and now also gates the bundle job, which holds the updater signing secrets: it must need the tag verifier and plugin parity, run only for manual builds or tag builds with a verified target, and check out the exact commit.
• 18 new negative test cases cover dispatchable or unprotected releases, mutable checkouts, fake verifier commands, skipped or non-blocking verifier steps, and inherited environments.

CodeAnt-AI Description

Require trusted tag verification before publishing Tauri releases

What Changed

• Tauri releases publish only after a protected version tag is verified and the exact tagged commit passes the security audit.
• Release builds use the audited commit, so a tag changing after verification cannot change the published installers.
• Manual workflow runs can still build for diagnosis but cannot publish a release.

Impact

✅ Installers match the audited commit
✅ Unverified or unprotected tags cannot publish
✅ Manual workflow runs cannot publish

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review

Summary by CodeRabbit

• Release Publishing
  • Desktop and Docker releases now publish only from protected version tags that pass tag verification and a security audit.
  • Published builds are tied to the exact commit that was verified and audited. Manual workflow runs cannot publish releases.
• Documentation
  • Updated release guidance to describe the publishing requirements and verification process.