ErenAri · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026 · Oct 18, 2026
@@ -61,6 +61,12 @@ jobs:
         # v0.3.6 shipped a broken action; the docs kept pointing at it for two
         # weeks because nothing checked the pins a reader copy-pastes.
         run: bash scripts/check-doc-pins.sh
+      - name: Documented action pins regression
+        # The stable release window: docs may name vX.Y.Z before its tag
+        # exists (only that tag, only in the stable channel, only when the
+        # remote positively lacks it), and SHA-pinned templates may stay on
+        # the release the consumer canary's stable pin names until the tag.
+        run: bash scripts/check-doc-pins_test.sh
       - name: Action OCI-artifact detection regression
         # Guards the fix that lets the action accept remote OCI references
         # (ghcr.io/...) as `artifact`. Extracts is_remote_artifact() from
@@ -108,6 +114,10 @@ jobs:
         # missing or inconsistent inputs; open distribution decisions withhold
         # optional assets and block stable builds.
         run: bash scripts/distribution-bundle_test.sh
+      - name: RC preflight regression
+        # The read-only release-candidate inventory reports VERIFIED, MISSING
+        # or PENDING from observed state only; lookup failures abort it.
+        run: bash scripts/rc-preflight_test.sh
       - name: Image prefetch reliability regression
         # The public matrix lane lost five of seven weekly runs (Aug-Oct 2026)
         # to a single failed image download aborting the whole prefetch. These
@@ -156,6 +166,13 @@ jobs:
         run: bash scripts/check-production-code-scanning_test.sh
       - name: Production-readiness evidence regression
         run: bash scripts/production-readiness-report_test.sh
+      - name: Release-workflow gate regression
+        # Run by a tag's own copy, so they cannot be fixed for a release after
+        # it is tagged: the stable gate requires a completed rollback drill of
+        # the release's own candidate; promotion requires the candidate run's
+        # signature files and SBOM, this tag's exact signer identity, and
+        # tag- and commit-bound attestations.
+        run: bash scripts/release-workflow-gates_test.sh
       - name: Campaign-to-candidate binding regression
         # A scheduled campaign must test the designated immutable release
         # candidate (tag, commit, signed assets, attestations), not whatever

@@ -151,6 +151,12 @@ jobs:
 
           cmp candidate/run-assets/SHA256SUMS candidate/draft-assets/SHA256SUMS
           cmp "$evidence" candidate/draft-assets/release-candidate-evidence.json
+          # The SBOM and the signature files are not listed in SHA256SUMS:
+          # the draft must carry the exact candidate run's copies.
+          for signed in SHA256SUMS.sig SHA256SUMS.crt \
+            bpfcompat.sbom.cdx.json bpfcompat.sbom.cdx.sig bpfcompat.sbom.cdx.crt; do
+            cmp "candidate/run-assets/${signed}" "candidate/draft-assets/${signed}"
+          done
 
           assets=(
             bpfcompat-linux-amd64
@@ -170,23 +176,28 @@ jobs:
           if [[ "$channel" == "stable" ]]; then
             assets+=(production-readiness.json production-readiness.md)
           fi
+          # Attestations and signatures must come from this tag's release
+          # run at the expected commit, not from any v* tag's run.
+          export BPFCOMPAT_EXPECTED_SOURCE_SHA="$EXPECTED_COMMIT"
+          export BPFCOMPAT_EXPECTED_SOURCE_REF="refs/tags/$RELEASE_TAG"
           bash scripts/verify-release-assets.sh \
             candidate/draft-assets "$GITHUB_REPOSITORY" "${assets[@]}"
           gh attestation verify "$evidence" \
             --repo "$GITHUB_REPOSITORY" \
-            --signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/release-artifacts.yml"
+            --signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/release-artifacts.yml" \
+            --source-digest "$EXPECTED_COMMIT" --source-ref "refs/tags/$RELEASE_TAG"
 
-          identity_regexp="^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-artifacts.yml@refs/tags/v"
+          identity="https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-artifacts.yml@refs/tags/${RELEASE_TAG}"
           cosign verify-blob \
             --certificate candidate/draft-assets/SHA256SUMS.crt \
             --signature candidate/draft-assets/SHA256SUMS.sig \
-            --certificate-identity-regexp "$identity_regexp" \
+            --certificate-identity "$identity" \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
             candidate/draft-assets/SHA256SUMS
           cosign verify-blob \
             --certificate candidate/draft-assets/bpfcompat.sbom.cdx.crt \
             --signature candidate/draft-assets/bpfcompat.sbom.cdx.sig \
-            --certificate-identity-regexp "$identity_regexp" \
+            --certificate-identity "$identity" \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
             candidate/draft-assets/bpfcompat.sbom.cdx.json
 
@@ -219,7 +230,7 @@ jobs:
             version --json | jq -r .version)"
           test "$actual_version" = "$expected_version"
           cosign verify \
-            --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-artifacts.yml@refs/tags/v" \
+            --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release-artifacts.yml@refs/tags/${RELEASE_TAG}" \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
             "${IMAGE}@${EXPECTED_DIGEST}"
 

@@ -201,6 +201,14 @@ jobs:
             .slo.campaign_count == 4 and
             .slo.infrastructure_errors == 0 and
             (.canaries | length == 3) and
+            ([.canaries[] |
+              (.workflow_run_attempt | type == "number" and . >= 1 and . == floor) and
+              (.attempt_started_at | type == "string" and test("^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$"))
+            ] | all) and
+            ($c.published_at | type == "string" and test("^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$")) and
+            .rollback.completed == true and
+            .rollback.alias == (($c.image | sub("@[^@]*$"; "")) + ":rollback-drill-" + $c.tag) and
+            .rollback.candidate_digest == ($c.image | sub("^.*@"; "")) and
             .incident.completed == true and
             .operator.approval_mode == "solo-maintainer" and
             .operator.confirmed == true
@@ -329,6 +337,8 @@ jobs:
       - name: Verify candidate attestations
         env:
           GH_TOKEN: ${{ github.token }}
+          BPFCOMPAT_EXPECTED_SOURCE_SHA: ${{ github.sha }}
+          BPFCOMPAT_EXPECTED_SOURCE_REF: ${{ github.ref }}
         run: >
           bash scripts/verify-release-assets.sh
           dist Kernel-Guard/bpfcompat
@@ -427,6 +437,8 @@ jobs:
       - name: Verify ARM64 candidate attestation
         env:
           GH_TOKEN: ${{ github.token }}
+          BPFCOMPAT_EXPECTED_SOURCE_SHA: ${{ github.sha }}
+          BPFCOMPAT_EXPECTED_SOURCE_REF: ${{ github.ref }}
         run: >
           bash scripts/verify-release-assets.sh
           dist Kernel-Guard/bpfcompat