feat(ci): add author verification workflow on merge to main

[migmartri]

Summary

• Add a dedicated GitHub Actions workflow and Chainloop contract for commit author and signature verification on every merge to main
• The workflow performs a lightweight attestation with no build steps, enforcing the source-commit policy with check_signature and check_author_verified enabled
• Contract is automatically synced by the existing sync_contracts.yml workflow

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name=".github/workflows/author_verification.yml">

<violation number="1" location=".github/workflows/author_verification.yml:7">
P2: Avoid `id-token: write` at workflow scope. Keep workflow permissions empty (or read-only defaults) and grant OIDC only at the `verify` job level.

(Based on your team's feedback about GitHub Actions permission scoping.) [FEEDBACK_USED]</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}