[cosmin-staicu]

Summary

The publish job added a firewall rule for the runner's IP (from an IP lookup service), but the signing vault kept refusing it for all 20 tries. Runners inside Azure can reach the vault under another address than the one the lookup returns, and the check hid the vault's error, so the log could not show it.

 open firewall
   allow(detected IP)
   loop 20 tries
-    certificate show >/dev/null 2>&1 || wait
+    certificate show, keep stderr
+    print the error code and "Client address" from the reply
+    client address not allowed yet -> allow it too, retry now
+    else wait
 close firewall
-  remove the detected IP
+  remove every IP this job added (also after a failure)

Evidence

• Before: run 42079028014: Adding IP rule <runner ip>/32 then not reachable yet for 12+ tries with no reason shown.
• After: the step script, run under bash -eo pipefail with stubbed az/curl: a vault that reports another client address gets a second rule and is reachable on the next try; a vault that sees the detected IP is reachable after one wait; the close step removes both rules. The log shows only the error code and the client address, never the token or the caller identity.

Merge Danger

Door: two-way

Blast Radius: release publish job only. It may add one more /32 rule to the signing vault for the duration of the job; the close step runs with always() and removes every rule the job added.

[github-actions]

🔎 Maintainer heads-up: automated triage flagged this PR as potentially material, so it may need a signed CLA in addition to the DCO sign-off.

Strong signals

• changes governance/security files: .github/workflows/release.yml

This is advisory only — the bot does not decide. Please judge against the CLA criteria (material, product-critical, patent-sensitive, corporate contributor, broad commercial use). Note that thresholds can be gamed by splitting PRs, so use your judgement.

• If a CLA is needed → add the cla-required label (a contributor comment with signing steps is posted automatically).
• If it is not needed → replace needs-cla-review with cla-not-required so later pushes don't re-flag it.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud