#1211 fix(release): pin the ruleset-checking verifier and drop ref_protected from the release gates

User description

Summary

Part of #1206, step 2 of 2 after #1210. The release verifier now checks the active tag rulesets itself, so the GHCR and Tauri release gates stop depending on github.ref_protected, which community reports describe as false for tag pushes (discussion 142985, discussion 66588). If that value were false on the real tag push, both verifier jobs would be skipped, nothing would publish, and the immutable tag could not be removed.

What changes

• docker.yml and tauri-build.yml: the verifier pin moves from 147470682b62 to d348d863f0cc, the protected-main commit from #1210 that contains the ruleset check (GitHub-verified). github.ref_protected == true is removed from the verifier job and from both publish conditions.
• scripts/release-security-gate.mjs and its types: the pin constant moves, and the exact conjunction for the verifier job and for both publish jobs no longer contains ref_protected. Re-adding it, or adding any permissive branch, is rejected as a change of the exact condition.
• tests/unit/tooling/releaseSecurityGate.test.ts and tests/unit/workflowPolicy.test.ts follow the new contract. A test pins that neither workflow mentions ref_protected, and another that a looser or a stricter verifier condition is rejected for both workflows. The two "unprotected tag" cases were removed because the condition they mutated no longer exists.
• New .github/workflows/tag-verifier-proof.yml: dispatch-only, contents: read, no secrets. It runs the pinned verifier with the production token against an existing annotated tag (default v1.29.2), so the ruleset read with the Actions token is proven before a real release tag is pushed. Its pin must match the release workflows, which a test enforces.
• docs/CI.md and the changelog describe the new contract.

Evidence

• Local: releaseSecurityGate, workflowPolicy and workflowPolicyCheck tests pass (217), the release gate and the workflow policy check pass.
• The proof script was run locally and unauthenticated against v1.29.2 (ok: true), and it rejects a malformed tag input.
• The Actions-token run of the proof workflow can only be dispatched after this merges; it is recorded in #1206 before any release tag is considered.

Known limit

The API hides bypass_actors from callers without admin rights, so the verifier cannot prove that no actor can bypass release-tags-immutable. That stays a maintainer-verified setting (read earlier: no bypass actors on ruleset 26812769).

Release boundary

No tag, GitHub Release, registry push or Vercel mutation. This PR does not authorize v1.29.3.

Summary by Sourcery

Ensure tag-based GHCR and Tauri releases rely on the pinned ruleset-aware verifier rather than the unreliable github.ref_protected status.

New Features:

• Add a dispatch-only, read-only workflow to prove the pinned release-tag verifier can validate an existing tag with the production Actions token.

Bug Fixes:

• Prevent GHCR and Tauri publishing from being skipped when GitHub reports github.ref_protected as false for tag pushes.

Enhancements:

• Move the release verifier pin to the ruleset-checking protected-main commit and make the verifier itself responsible for enforcing tag protection.
• Update release security validation and documentation to require exact verifier and publish conditions without github.ref_protected.

Documentation:

• Document the updated release-gate contract and tag-verifier proof workflow.
• Record the release-gate changes in the unreleased changelog.

Tests:

• Update workflow and release-gate tests to enforce the new verifier pin, exact conditions, and read-only proof workflow.

Summary by cubic

Completes step 2 of 2 for #1206: drops github.ref_protected from the GHCR and Tauri release gates. Community reports describe it as false for tag pushes, so both verifier jobs and both publish jobs could be skipped and nothing would publish.

The verifier pin moves to the protected-main commit that checks active tag rulesets itself (added in #1210).

• The security gate, its tests, and the workflow-policy tests require the exact condition without ref_protected and reject looser or stricter variants.
• New dispatch-only, read-only tag-verifier-proof.yml runs the pinned verifier with the production token against an existing tag, proving the ruleset read before a real tag is pushed.
• The verifier still cannot prove that no actor can bypass the release-tags-immutable ruleset, which stays a maintainer-verified setting.

CodeAnt-AI Description

Allow verified version tags to reach release publishing without relying on GitHub’s protection flag

What Changed

• GHCR and Tauri releases no longer depend on GitHub’s unreliable protection flag for tag pushes; publishing still requires the pinned verifier and exact-commit security audit to succeed.
• Added a dispatch-only, read-only workflow to test the pinned verifier against an existing tag before a release.

Impact

✅ Fewer skipped GHCR releases on tag pushes
✅ Fewer skipped Tauri releases on tag pushes
✅ Releases still require successful tag verification and security audits

@codeant-ai ask: Your question here

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

@codeant-ai: Your feedback here

@codeant-ai: Do not flag unused imports.

@codeant-ai: review

Summary by CodeRabbit

• Release Improvements
  • Docker and Tauri releases can now publish from version tags without requiring the tag to be marked as protected. Tag verification, security checks, and commit matching are still required.
• New Features
  • Added a manual, read-only workflow to verify an existing annotated release tag. It does not publish a release.
• Documentation
  • Updated CI documentation to reflect the release checks and manual workflow behavior.