docs(cd): state that the workflow ref is load-bearing for cosign verification

[devantler]

🤖 Generated by the Agentic Engineer

Why

The comment above the publish-workflow pin told the next person to edit this file
that the ref shape is free — "the platform verifier matches @.+$, so the ref does
not affect cosign verification". That stopped being true when the platform narrowed
its cosign subject matcher, and it sits directly above the one line where the ref is
now load-bearing.

Acting on it fails nothing here. The artifact still publishes, signed under an
identity the platform rejects, and the consuming tenant quietly stops reconciling
some time later. Renovate keeps the pin's value correct, so nothing would force
the mistake to surface.

What

The comment now states the real constraint — keep it a 40-hex commit — and what
breaks if it changes. It deliberately does not quote the current matcher regex,
since that is what went stale here twice.

Comment-only; the pinned SHA and everything else are untouched.

Part of devantler-tech/platform#3044

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

@devantler I will review the changes.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

📝 Walkthrough

Walkthrough

The continuous delivery workflow comments now state that the reusable workflow ref must use a 40-hex commit format and pass verifier acceptance. The comments also state that reconciliation can stop after artifact publication when the ref is not accepted.

Possibly related issues

• devantler-tech/platform#3044: The changes document the same 40-hex commit ref and reconciliation requirements described in this issue.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the documentation change and the workflow ref requirement for cosign verification.
Description check	✅ Passed	The description explains the changed comment, the 40-hex ref requirement, and the reconciliation risk, all of which match the changeset.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 9a8782675b

Programmatically tested. All required checks green (CI - Required Checks, zizmor, CodeQL,
🧹 Validate manifests, dependency-review), mergeStateStatus: CLEAN, 0 unresolved threads,
0 non-thread review findings. yq confirms .jobs.publish-manifests.uses is byte-identical to
main — the pinned SHA is untouched, so nothing about what this workflow dispatches changed.

Reviewed. CodeRabbit green at this exact head: head status Review completed, summary comment
refreshed after my request and naming the full SHA, no rate-limit/service marker, and its only finding
section is the excluded 🔇 Additional comments (1). Stopping here rather than spending Codex or
Bugbot — one successful current-head review satisfies the gate.

Tried and evaluated as a user. The user of a comment is the next person editing this line, so I
read it back in place rather than only in the diff. Two things I checked and would have changed it for:
it no longer contradicts this file's own header (lines 12–19 already say the signing identity is the
workflow path including its ref — the old comment argued the opposite eight lines further down), and
it names no matcher regex, which is what went stale here twice.

One judgement worth stating plainly: the deployed matcher today is
@([0-9a-f]{40}|refs/tags/v.+)$, so a v-tag would still verify right now — platform#3043 is what
removes that alternative and is still queued. Wording this as "nothing but a commit is accepted" would
therefore have been false on merge and true only later. It instead states the instruction and the
consequence, which is accurate under both matchers.

The runtime surface here is the workflow parsing and dispatching, and that is what CI exercised; the
comment text itself has no behaviour to observe beyond that.