[Bug]: v0.2.0 artifacts are signed as refs/heads/main, not refs/tags/v0.2.0

[Marukome0743]

Bug Description

The v0.2.0 artifacts are signed with the identity

https://github.com/santosr2/TerraTidy/.github/workflows/release.yml@refs/heads/main

instead of @refs/tags/v0.2.0. Verification that pins the identity to the tag therefore fails for v0.2.0, while it succeeds for v0.2.0-alpha.4.

The documented verification command in docs/site/docs/getting-started/verification.md uses --certificate-identity-regexp 'https://github.com/santosr2/TerraTidy', which matches any ref, so this doesn't show up there.

Steps to Reproduce

$ gh release download v0.2.0 --repo santosr2/TerraTidy -p 'checksums.txt*'
$ cosign verify-blob checksums.txt \
    --bundle checksums.txt.bundle \
    --certificate-identity-regexp '^https://github\.com/santosr2/TerraTidy/\.github/workflows/.+\.ya?ml@refs/tags/\Qv0.2.0\E$' \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com

Reading the identity straight out of the bundle for both releases:

$ # v0.2.0-alpha.4
URI:https://github.com/santosr2/TerraTidy/.github/workflows/release.yml@refs/tags/v0.2.0-alpha.4

$ # v0.2.0
URI:https://github.com/santosr2/TerraTidy/.github/workflows/release.yml@refs/heads/main

Expected Behavior

Artifacts for tag vX.Y.Z are signed as .../release.yml@refs/tags/vX.Y.Z, whichever path published them.

Actual Behavior

v0.2.0 is signed as @refs/heads/main.

Why it happened

The v0.2.0 tag-triggered run failed:

$ gh api repos/santosr2/TerraTidy/actions/runs/29880216820 -q '"\(.head_branch) \(.event) \(.conclusion)"'
v0.2.0 push failure

goreleaser failed at "Run GoReleaser" — the cosign v3 / goreleaser v2.15.0 bundle problem that #250 fixed. The release was then published from the workflow_dispatch path added in that same PR:

$ gh run list --repo santosr2/TerraTidy --workflow release.yml -L 8 \
    --json createdAt,event,headBranch,conclusion \
    -q '.[]|"\(.createdAt) \(.event) ref=\(.headBranch) -> \(.conclusion)"'
2026-07-22T01:50:14Z workflow_dispatch ref=main -> failure
2026-07-22T01:39:42Z workflow_dispatch ref=main -> failure
2026-07-22T01:14:53Z workflow_dispatch ref=main -> failure
2026-07-22T01:11:16Z workflow_dispatch ref=main -> failure
2026-07-22T00:26:00Z push ref=v0.2.0 -> failure
2026-04-04T06:09:59Z push ref=v0.2.0-alpha.4 -> success

The dispatch path does check out the tag's own commit:

ref: ${{ github.event.inputs.tag || github.ref }}

so GoReleaser built the right code. But cosign sign-blob and actions/attest-build-provenance both use the ambient GitHub OIDC token, and the ref in that token is the ref the run is on — refs/heads/main for a dispatch from a branch. actions/checkout cannot change it. So the build follows the tag and the signature follows the branch, and they silently disagree.

This also affects the provenance attestation, which records the same workflow ref.

Suggested fix

Dispatch the workflow with the tag as the ref rather than passing it as an input:

gh workflow run release.yml --ref v0.2.0

Then github.ref is refs/tags/v0.2.0 for both the push and the dispatch path, the checkout is already correct without the input, and the signing identity matches the tag. A guard on github.ref_type != 'tag' keeps a branch dispatch from publishing mis-signed artifacts again.

I've opened a PR for this.

Note on existing releases: because the OIDC identity is baked into the certificate, v0.2.0's bundle can't be corrected without re-signing that release.

Where I ran into it

santosr2/TerraTidy is packaged in aqua-registry, whose config pins the identity to the tag. The automated bump to v0.2.0 fails there:

ERR install the package env=linux/amd64 package_name=santosr2/TerraTidy package_version=v0.2.0
    cosign_opts="--certificate-identity-regexp, ^https://github\.com/santosr2/TerraTidy/\.github/workflows/.+\.ya?ml@refs/tags/\Qv0.2.0\E$, ..."
    error="verify with Cosign"

_{Investigated with Claude Code; every command and its output above is from a run I actually made. I reviewed the findings and own them.}

[santosr2]

Confirmed on my side, thanks for the thorough investigation.

One detail to add to the record: the certificate also claims source commit bc6433c (main's head at dispatch time), while the v0.2.0 tag points at 3b68f9b. So the attestation doesn't just carry the wrong ref, it claims the wrong build commit entirely. The binaries were in fact built from the tag's commit, but nothing in the published attestation proves that. For anyone who needs independent confirmation: builds are reproducible (-trimpath, checked in CI), so rebuilding from the v0.2.0 tag and comparing against checksums.txt will match.

I also checked whether v0.2.0 could be re-signed correctly and every path is closed: the workflow at the tag's commit has no workflow_dispatch trigger, re-pushing the tag would re-run the broken GoReleaser v2.15.0 pinned at that commit, and re-pointing the tag would break the module proxy entry.

So the plan is: merge #280, cut v0.2.1 with a correct refs/tags/v0.2.1 identity, and add a note to the v0.2.0 release about the mislabeled certificate. That should unblock the aqua-registry bump once it picks up v0.2.1. I'll also tighten our documented verification command to pin the exact workflow and tag identity alongside the v0.2.1 release, since the strict command would (correctly) fail against v0.2.0 while it's still the latest release.

[santosr2]

Follow-up on the plan above: this is going out as v0.3.0, not v0.2.1.

#258 landed before that comment and renamed public rule IDs — style.block-label-case split into style.resource-name-convention and style.data-name-convention, style.{variable,output,local}-naming gained -name-convention suffixes, and lint.terraform-naming-convention was removed. Those IDs are config keys, terratidy:ignore targets, and SARIF rule IDs, and unrecognized keys are ignored rather than rejected, so a stale config loads fine and silently drops its overrides. git-cliff already groups that commit under Breaking Changes, so v0.2.1 would have shipped a Breaking Changes section under a patch heading.

The rest of the plan is unchanged. With #280 merged, v0.3.0 signs as .../release.yml@refs/tags/v0.3.0. #284 carries the tightened verification command (exact release.yml identity plus tag ref, and --signer-workflow / --source-ref for gh attestation verify) and an upgrade-guide entry for the rule renames. This release now carries a note about the mislabeled certificate. aqua-registry should pick up v0.3.0.