docs(release): record immutable GitHub signing identity

[SunkenInTime]

The signing credential expects GitHub owner and repository IDs in the OIDC subject. Document the repository setting and exact subject after correcting the mismatch that caused AADSTS700213. Azure login now succeeds in unpublished release run 35534131893. Validation: git diff --check and live GitHub OIDC settings readback.

[coderabbitai]

Warning

Review limit reached

Next included review available in 47 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 65208e2a-b9f4-46fc-91f3-34ac6dd0f895

📥 Commits

Reviewing files that changed from the base of the PR and between 87ec577 and 47e3f1e.

📒 Files selected for processing (1)

• docs/release_process.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

Safe to merge: the release-signing guidance matches the repository's active immutable OIDC configuration and the desktop release workflow.

What we checked:

• Immutable OIDC subject rejects release authentication: GitHub reports the documented numeric owner and repository IDs, immutable subject prefix, and main default branch. The desktop workflow grants an ID token, rejects non-main runs before Azure login, and uses the documented Azure audience contract.
• Compared the legacy OIDC subject with the immutable-subject guidance and validated the key identifiers by querying GitHub's live repository metadata and the OIDC customization endpoint.
• Verified that the Release Desktop workflow’s identity matches the documented subject and that all focused assertions passed.
• Reviewed repository, documentation, and workflow evidence to confirm the exact subject construction and the validation results; the evidence excerpts and the check outcomes are summarized in the artifacts.

Summary

This update documents the immutable GitHub Actions OIDC identity required for Azure Artifact Signing on desktop releases. The recorded owner ID, repository ID, branch subject, issuer, and audience match the live GitHub repository settings and the Release Desktop workflow.

_{Reviews (1) · Last reviewed commit: "docs(release): record immutable GitHub s..."}