Scope qualification preview to an explicitly reviewed workflow commit

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/runner-full-stack-e2e.yml

@@ -1,4 +1,4 @@
-name: Runner Full-Stack E2E
+name: Runner Full-Stack E2E (reviewed work-folders preview)
 
 on:
   schedule:
@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       target_branch:
-        description: "Branch in paperclipai/paperclip to test; the trusted workflow still runs from master"
+        description: "Must be codex/work-folders-final-readiness at the reviewed target commit"
         type: string
         required: false
       all:
@@ -64,11 +64,15 @@ jobs:
       target_sha: ${{ steps.target.outputs.sha }}
       target_ref: ${{ steps.target.outputs.ref }}
     steps:
-      - name: Require default branch and allowlisted numeric actor IDs
+      - name: Require exact reviewed preview workflow and allowlisted numeric actor IDs
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           REF: ${{ github.ref }}
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_SHA: ${{ github.sha }}
+          WORKFLOW_REF: ${{ github.workflow_ref }}
+          REVIEWED_PREVIEW_SHA: ${{ vars.RUNNER_E2E_REVIEWED_PREVIEW_WORKFLOW_SHA }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           ACTOR: ${{ github.actor }}
           ACTOR_ID: ${{ github.actor_id }}
@@ -76,10 +80,16 @@ jobs:
           ALLOWED_ACTOR_IDS: ${{ vars.RUNNER_E2E_ALLOWED_ACTOR_IDS }}
         run: |
           set -euo pipefail
-          if [ "$REF" != "refs/heads/$DEFAULT_BRANCH" ]; then
-            echo "Paid runner E2E campaigns may run only from the default branch." >&2
-            exit 1
-          fi
+          # Temporary preview only. An operator must review this exact workflow
+          # commit before setting the repository variable; it is not a target ref.
+          test "$REPOSITORY" = paperclipai/paperclip
+          test "$EVENT_NAME" = workflow_dispatch
+          test "$REF" = refs/heads/codex/work-folders-qualification-preview-r125
+          test "$WORKFLOW_REF" = paperclipai/paperclip/.github/workflows/runner-full-stack-e2e.yml@refs/heads/codex/work-folders-qualification-preview-r125
+          [[ "$REVIEWED_PREVIEW_SHA" =~ ^[0-9a-f]{40}$ ]]
+          test "$WORKFLOW_SHA" = "$REVIEWED_PREVIEW_SHA"
+          reviewed_branch_sha="$(gh api repos/paperclipai/paperclip/branches/codex%2Fwork-folders-qualification-preview-r125 --jq .commit.sha)"
+          test "$reviewed_branch_sha" = "$WORKFLOW_SHA"
           if ! jq -e 'type == "array" and length > 0 and all(.[]; type == "number" and . > 0 and floor == .)' <<< "${ALLOWED_ACTOR_IDS:-}" >/dev/null; then
             echo "RUNNER_E2E_ALLOWED_ACTOR_IDS must be a non-empty JSON array of numeric GitHub user IDs." >&2
             exit 1
@@ -105,6 +115,7 @@ jobs:
           TARGET_BRANCH: ${{ inputs.target_branch || github.event.repository.default_branch }}
         run: |
           set -euo pipefail
+          test "$TARGET_BRANCH" = codex/work-folders-final-readiness
           if [ -z "$TARGET_BRANCH" ] || [[ "$TARGET_BRANCH" == refs/* ]]; then
             echo "target_branch must name a branch in this repository without a refs/ prefix." >&2
             exit 1
@@ -115,6 +126,7 @@ jobs:
             echo "The requested repository branch did not resolve to a commit." >&2
             exit 1
           fi
+          test "$target_sha" = 378f1aec81481fe9ef387cabe9a60c16d4babdef
           echo "sha=$target_sha" >> "$GITHUB_OUTPUT"
           echo "ref=refs/heads/$TARGET_BRANCH" >> "$GITHUB_OUTPUT"
           echo "Resolved the requested repository branch to $target_sha."
@@ -424,7 +436,7 @@ jobs:
             exit 0
           fi
           [[ "$IMAGE_CONTENT_ID" =~ ^[0-9a-f]{64}$ ]]
-          identity="^https://github.com/${GITHUB_REPOSITORY}/.github/workflows/runner-full-stack-e2e.yml@"
+          identity="https://github.com/${GITHUB_WORKFLOW_REF}"
           if docker buildx imagetools inspect "$IMAGE_TAG" >/dev/null 2>&1; then
             digest="$(docker buildx imagetools inspect "$IMAGE_TAG" --format '{{json .Manifest.Digest}}' | tr -d '"')"
           else
@@ -452,7 +464,7 @@ jobs:
             cosign sign --yes "$IMAGE_TAG@$digest"
           fi
           cosign verify \
-            --certificate-identity-regexp "$identity" \
+            --certificate-identity "$identity" \
             --certificate-oidc-issuer https://token.actions.githubusercontent.com \
             "$IMAGE_TAG@$digest" >/dev/null
           immutable="${IMAGE_TAG%:*}@$digest"
@@ -769,15 +781,31 @@ jobs:
     steps:
       - name: Reauthorize paid execution before provider access
         env:
+          REPOSITORY: ${{ github.repository }}
+          TARGET_SHA: ${{ needs.authorize.outputs.target_sha }}
           GH_TOKEN: ${{ github.token }}
           REF: ${{ github.ref }}
+          EVENT_NAME: ${{ github.event_name }}
+          WORKFLOW_SHA: ${{ github.sha }}
+          WORKFLOW_REF: ${{ github.workflow_ref }}
+          REVIEWED_PREVIEW_SHA: ${{ vars.RUNNER_E2E_REVIEWED_PREVIEW_WORKFLOW_SHA }}
           DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           ACTOR_ID: ${{ github.actor_id }}
           TRIGGERING_ACTOR: ${{ github.triggering_actor }}
           ALLOWED_ACTOR_IDS: ${{ vars.RUNNER_E2E_ALLOWED_ACTOR_IDS }}
         run: |
           set -euo pipefail
-          test "$REF" = "refs/heads/$DEFAULT_BRANCH"
+          # Temporary preview only. An operator must review this exact workflow
+          # commit before setting the repository variable; it is not a target ref.
+          test "$REPOSITORY" = paperclipai/paperclip
+          test "$EVENT_NAME" = workflow_dispatch
+          test "$REF" = refs/heads/codex/work-folders-qualification-preview-r125
+          test "$WORKFLOW_REF" = paperclipai/paperclip/.github/workflows/runner-full-stack-e2e.yml@refs/heads/codex/work-folders-qualification-preview-r125
+          [[ "$REVIEWED_PREVIEW_SHA" =~ ^[0-9a-f]{40}$ ]]
+          test "$WORKFLOW_SHA" = "$REVIEWED_PREVIEW_SHA"
+          reviewed_branch_sha="$(gh api repos/paperclipai/paperclip/branches/codex%2Fwork-folders-qualification-preview-r125 --jq .commit.sha)"
+          test "$reviewed_branch_sha" = "$WORKFLOW_SHA"
+          test "$TARGET_SHA" = 378f1aec81481fe9ef387cabe9a60c16d4babdef
           jq -e 'type == "array" and length > 0 and all(.[]; type == "number" and . > 0 and floor == .)' <<< "${ALLOWED_ACTOR_IDS:-}" >/dev/null
           triggering_actor_id="$(gh api "users/$TRIGGERING_ACTOR" --jq .id)"
           jq -e --argjson candidate "$triggering_actor_id" 'index($candidate) != null' <<< "$ALLOWED_ACTOR_IDS" >/dev/null
@@ -1040,7 +1068,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Reporting and sanitization are part of the trusted workflow boundary.
-          ref: ${{ github.sha }}
+          ref: 422287eecdaacac8579cf2aea32acd457b3cb0dd
           persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
@@ -1198,7 +1226,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # Never execute target-controlled publication code with AWS credentials.
-          ref: ${{ github.sha }}
+          ref: 422287eecdaacac8579cf2aea32acd457b3cb0dd
           persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7