test(release): require tagged acceptance evidence

[seonghobae]

Objective

Advance release/provenance readiness without publishing a release or requiring write-scoped workflow authority. Protected main has successful push CI but no GitHub Releases and only CI/fuzz repository-local workflows, so a buyer-visible tagged build currently has no repository-owned acceptance bundle tying the exact Git source revision to the packaged JAR, CycloneDX SBOM and license-policy result.

Test-first state

Protected main was directly resolved at exact 55d7ae8647208e301f282350f076eeddaba61d11. This Draft starts intentionally RED at exact test-only head 5cf2420fcb93f6318c52de5ba5723b9641ea589e, directly based on that baseline.

scripts/test_release_acceptance_workflow.py requires a tag-scoped, read-only workflow with checksum-pinned checkout/upload actions, exact-revision verification, Maven verify, exact Maven-version/tag binding, CycloneDX 2.9.1 generation, buyer-release license-policy enforcement, byte-level SHA-256 manifest generation and durable Actions artifact upload. Protected main has no .github/workflows/release-acceptance.yml, so the buyer-readiness script suite is expected to fail at that missing workflow boundary.

Scope

This slice creates deterministic tagged release-acceptance evidence only. It does not create tags, GitHub Releases, deploy artifacts, sign binaries, modify source/runtime behavior, grant contents: write, or consume secrets. It does not duplicate #391's OpenAPI-byte provenance helper; schema provenance remains a separate active lane to consume after integration.

Acceptance

Observe exact-head RED -> add the smallest read-only tagged acceptance workflow -> exact-head buyer-readiness/full CI and emitted security evidence -> review/thread/live-base refetch. Keep Draft until the unchanged implementation head is GREEN. Independent non-author formal approval remains a separate protected-merge gate.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 11 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c20fcf8a-8ae0-4ecd-b885-0d2f5af26a70

📥 Commits

Reviewing files that changed from the base of the PR and between 55d7ae8 and 6293fa5.

📒 Files selected for processing (2)

• .github/workflows/release-acceptance.yml
• scripts/test_release_acceptance_workflow.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}