Fix gh identity flag compatibility and verify before publishing

Author: CompleteDotTech

.github/workflows/publish-rules.yml

@@ -43,6 +43,12 @@ jobs:
         with:
           subject-path: dist/node2shell-rules.json
           create-storage-record: false
+      - name: Independently verify the attested publication
+        env:
+          BUNDLE_PATH: ${{ steps.attest.outputs.bundle-path }}
+        run: |
+          gh attestation trusted-root > "$RUNNER_TEMP/sigstore-roots.jsonl"
+          python tools/signed_rules/keyless_rules.py verify --artifact dist/node2shell-rules.json --bundle "$BUNDLE_PATH" --trusted-root "$RUNNER_TEMP/sigstore-roots.jsonl" --state "$RUNNER_TEMP/rule-state.json" --output "$RUNNER_TEMP/rule-review.json"
       - name: Publish immutable-named release assets
         env:
           GH_TOKEN: ${{ github.token }}

docs/KEYLESS_RULES.md

@@ -38,7 +38,8 @@ reviewed workflow and the trusted local GitHub CLI.
 
 An authorized maintainer explicitly dispatches **Publish authenticated rule
 snapshot** on `main`. The job runs local-only tests, packages the existing
-embedded snapshot, attests those exact bytes and creates a new release with
+embedded snapshot, attests those exact bytes, verifies them with independently
+obtained Sigstore roots using the client policy, and creates a new release with
 `node2shell-rules.json` and `node2shell-rules.sigstore.json`. Tags have the form
 `rules-v1-RUN_NUMBER-ATTEMPT`; no existing release/asset is overwritten and no
 unrelated software release is marked latest. There is no recurring schedule.

test_keyless_rules.py

@@ -123,6 +123,10 @@ def test_gh_policy_checks_cert_numeric_ids_and_exact_source_identity(self):
             def run(command, **kwargs):
                 self.assertIn("--custom-trusted-root", command)
                 self.assertIn("--bundle", command)
+                # gh makes these four policy flags mutually exclusive. Exact
+                # certificate identity includes the workflow path AND main ref.
+                identity_flags = {"--cert-identity", "--cert-identity-regex", "--signer-repo", "--signer-workflow"}
+                self.assertEqual({"--cert-identity"}, set(command) & identity_flags)
                 for expected in (k.IDENTITY, k.ISSUER, "--deny-self-hosted-runners", "--source-digest", "--signer-digest", "refs/heads/main"):
                     self.assertIn(expected, command)
                 self.assertNotIn("shell", kwargs)

tools/signed_rules/keyless_rules.py

@@ -116,7 +116,7 @@ def verify_provenance(artifact, bundle, root, commit):
         raise ValueError("Install a trusted GitHub CLI with attestation support")
     command = [gh, "attestation", "verify", str(artifact), "--repo", REPOSITORY,
                "--bundle", str(bundle), "--custom-trusted-root", str(root),
-               "--signer-workflow", WORKFLOW, "--cert-identity", IDENTITY,
+               "--cert-identity", IDENTITY,
                "--cert-oidc-issuer", ISSUER, "--source-ref", "refs/heads/main",
                "--source-digest", commit, "--signer-digest", commit,
                "--deny-self-hosted-runners", "--hostname", "github.com", "--format", "json"]