[rossirpaulo]

Summary

• allow the pkg.boundaryml.com GitHub OIDC role to trust immutable baml-language-source-* release tags
• retain the existing canary subject for canary dry-run uploads
• add release-contract coverage tying the immutable workflow ref to the CDK trust policy

Root cause

Production releases are now dispatched from immutable source tags, but the IAM trust policy still accepted only refs/heads/canary. AWS therefore rejected the manifest publisher with sts:AssumeRoleWithWebIdentity, which correctly prevented the dependent Go publication and channel promotion.

Validation

• mise exec -- python -m unittest scripts.tests.test_release_pipeline_contract
• mise exec -- pnpm run build in tools/pkg_boundaryml_com
• mise exec -- pnpm exec cdk synth --json and exact synthesized-subject assertion
• git diff --check

Deployment note

The CDK stack must be deployed after merge to update the live IAM role before the next release reaches the manifest publisher.

Summary by CodeRabbit

• Security Enhancements

  • Restricted release permissions to approved canary branches and immutable source tags.
  • Added GitHub Actions identity validation for authorized release workflows.
  • Prevented broad wildcard reference access in production release permissions.

• Tests

  • Added coverage verifying release workflows enforce least-privilege access and identity conditions.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
beps	Ready	Preview, Comment	Jul 27, 2026 9:43pm
promptfiddle	Ready	Preview, Comment	Jul 27, 2026 9:43pm
promptfiddle2	Ready	Preview, Comment	Jul 27, 2026 9:43pm

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5f786a49-9acf-42d7-bca6-999c9cb38d78

📥 Commits

Reviewing files that changed from the base of the PR and between 5fc67e6 and 2b3c3cc.

📒 Files selected for processing (2)

• scripts/tests/test_release_pipeline_contract.py
• tools/pkg_boundaryml_com/lib/pkg-boundaryml-com-stack.ts

---

📝 Walkthrough

Walkthrough

The release role now allows GitHub OIDC subjects for the canary branch and immutable source tags. The production release contract test loads the stack and verifies these allowlists, the OIDC condition, and rejection of broad wildcard ref permissions.

Changes

Release OIDC contract

Layer / File(s)	Summary
Expand release OIDC subjects tools/pkg_boundaryml_com/lib/pkg-boundaryml-com-stack.ts	The githubReleaseRole trust policy uses canary and baml-language-source-* tag subject patterns.
Validate least-privilege release policy scripts/tests/test_release_pipeline_contract.py	The production release test reads the stack and asserts the required refs, OIDC subject mapping, and absence of ref:* permissions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• BoundaryML/baml#4179: Updates release-attestation contract checks and immutable release workflow references.

Poem

A rabbit hops where release tags gleam,
Canary trails join the trusted stream.
Wildcards vanish from the gate,
OIDC checks now guard the state.
“Least privilege!” we cheer and play.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: allowing immutable release tags to assume the role.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/fix-release-aws-oidc-tag-trust

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏭️ Performance benchmarks were skipped

Perf benchmarks (CodSpeed) are opt-in on pull requests — they no longer run on every push. They always run automatically after merge to canary/main.

To run them on this PR, do any of the following, then push a commit (or re-run CI):

• Add RUN_CODSPEED=1 to the PR description, or
• Include run-perf or /perf in the PR title or any commit message.

[github-actions]

Binary size checks passed

✅ 7 passed

	Artifact	Platform	File	Gzip	Gated on	Baseline	Delta	Status
✅	baml-cli	Linux	🔒 27.3 MB	11.6 MB	file	27.3 MB	+4.4 KB (+0.0%)	OK
✅	packed-program	Linux	🔒 17.7 MB	7.3 MB	file	17.7 MB	+4.1 KB (+0.0%)	OK
✅	baml-cli	macOS	🔒 21.2 MB	10.1 MB	file	21.2 MB	+16 B (+0.0%)	OK
✅	packed-program	macOS	🔒 13.8 MB	6.4 MB	file	13.8 MB	+0 B (+0.0%)	OK
✅	baml-cli	Windows	🔒 22.8 MB	10.3 MB	file	22.8 MB	+4.6 KB (+0.0%)	OK
✅	packed-program	Windows	🔒 14.7 MB	6.5 MB	file	14.7 MB	+7.2 KB (+0.0%)	OK
✅	bridge_wasm	WASM	16.5 MB	🔒 4.5 MB	gzip	4.5 MB	+1.6 KB (+0.0%)	OK

🔒 = the size this artifact is GATED on (ceiling + delta). Binaries gate on file size (installed binary); WASM gates on gzip (download size). The other size is shown for information only.

---

Generated by cargo size-gate · workflow run