chore(ci): move the updater key check to the main gate

[FSM1]

What changes

The Updater Key drift check moves out of the pull-request path.

• .github/workflows/updater-key.yml is new. It runs the check on a push to main and on workflow_dispatch, and the job is guarded by if: github.ref == 'refs/heads/main', so a dispatch cannot aim the signing secret at an unreviewed branch. The check itself is unchanged: it unwraps the committed plugins.updater.pubkey, signs a payload with tauri signer sign, and verifies that signature with minisign -V.
• .github/workflows/ci-repo.yml loses the updater-key job and the workflow_call secret declarations.
• .github/workflows/ci.yml no longer forwards TAURI_SIGNING_PRIVATE_KEY or TAURI_SIGNING_PRIVATE_KEY_PASSWORD to the repo area.
• blueprint/testing.md moves the check from the PR gate row to the main gate row and states why it lives there.

Why

The job ran on every pull request. It checked out the pull request's own tree, ran pnpm install --frozen-lockfile, and then ran tauri signer sign with both secrets in the step environment. An author of a same-repository pull request therefore controlled code that executed beside the release signing key. The job also hard-failed when the secret was absent, so a fork pull request failed this gate.

A push to main carries reviewed code, so the executed tree is no longer author-controlled. The accepted cost is that a drifting pubkey is reported after the merge, not before it.

Branch protection

Updater Key was not a required status context. Branch protection on main requires only the area result contexts plus the standalone contexts, per ADR 0018: Repo Result, API Result, Rust Result, Web Result, Desktop Result, Contract Suite Result, Web E2E Smoke Result, Detect Changes, lint-pr-title and zizmor static audit. No branch protection change is needed, and the Repo Result context still reports the same way.

Verification

• zizmor --no-online-audits .github/workflows/ .github/actions/ reports no finding.
• pnpm lint:md and pnpm lint:tracker-refs pass.
• The change touches no Rust and no TypeScript source.

Body checks / follow-ups filed

• Issue Keep the Tauri signing key out of the pull-request updater check #1778 received a dated body check. It records that option 3 of the issue cannot close it: the repository commits the public key, but no comparison proves that this public key matches the signing key without the signing key. Option 3 works only if the release workflow also commits a signature it produced, and a secret rotation would then be caught at the next release rather than on the pull request.
• No new issue was filed.

Closes #1778.

Note

Move updater-key check from PR ci-repo workflow to standalone updater-key.yml

• Removes the updater-key job and its Tauri signing inputs from the reusable ci-repo.yml and the forwarding call in ci.yml
• Adds updater-key.yml as a standalone workflow that signs a temporary payload with the configured signing secret and verifies it against the committed public key using minisign
• Updates testing.md to move the check from the merge-blocking Repo tier to the main-gate tier
• Behavioral Change: the updater-key validation no longer runs on pull requests; it runs only for pushes to main or manual dispatch on main, and fails when the signing secret is unavailable

^{Macroscope summarized 34e3f98.}

Summary by CodeRabbit

• CI and Security
  • Added automated verification of the updater signing key on pushes to the main branch or through manual runs.
  • Signing validation now confirms that release signatures match the committed updater public key.
  • Removed updater-key validation from pull-request checks, so it runs only in the main-branch workflow.
  • Updated repository automation to use read-only contents access and no longer pass signing secrets through the reusable workflow.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: d8a64ba7-d87a-49b4-b62b-caaf3a9f2846

📥 Commits

Reviewing files that changed from the base of the PR and between df9f10e and 6c9c19d.

📒 Files selected for processing (4)

• .github/workflows/ci-repo.yml
• .github/workflows/ci.yml
• .github/workflows/updater-key.yml
• blueprint/testing.md

💤 Files with no reviewable changes (2)

• .github/workflows/ci.yml
• .github/workflows/ci-repo.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pull-request workflow no longer receives Tauri signing secrets or runs the updater-key check. A separate workflow runs the check on main, and the CI-gates documentation moves the check from the PR gate to the Main gate.

Changes

Updater key verification

Layer / File(s)	Summary
Remove signing secrets from pull-request CI .github/workflows/ci-repo.yml, .github/workflows/ci.yml	The reusable workflow no longer declares the Tauri signing secrets. The caller no longer forwards them. The previous updater-key job was removed.
Add main-branch updater key check .github/workflows/updater-key.yml, blueprint/testing.md	A dedicated workflow signs and verifies a test payload on main. The CI-gates documentation places Updater Key under the Main gate instead of the PR gate.

Priority: ⬆️ High

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Other · Severity of issue fixed: High

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant UpdaterKeyWorkflow
  participant Minisign
  GitHubActions->>UpdaterKeyWorkflow: Run on push to main or manual dispatch
  UpdaterKeyWorkflow->>Minisign: Sign test payload with TAURI_SIGNING_PRIVATE_KEY
  UpdaterKeyWorkflow->>Minisign: Verify signature with extracted updater public key
  Minisign-->>GitHubActions: Return verification result

Loading

Merge Risk: ⚪ Minimal · up to 6c9c1

The updater-key check is moved to main while pull-request workflows no longer receive signing secrets. No current merge-blocking risk was identified.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the primary change: moving the updater key check from the pull-request path to the main gate.
Linked Issues check	✅ Passed	Issue #1778 requires that pull-request code cannot access the Tauri signing secrets. The PR removes the updater-key job from ci-repo.yml and removes both secrets from the ci.yml reusable-workflow …
Out of Scope Changes check	✅ Passed	The changed workflow files and blueprint/testing.md directly implement issue #1778. Removing secret forwarding supports the security objective. Moving the existing check and updating gate documentat…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/1778-updater-key-push-to-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[FSM1]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.