[rmcdaniel]

Follow-ups from General's #458 review, all non-blocking. Only .github/workflows/installers.yml changes.

• Version source: the version comes from static/stable-releases.json (artifacts.cli), not a hard-coded 2.3.5. The CLI 2.5.0 manifest bump will therefore re-run the installers against 2.5.0. static/stable-releases.json is added to the PR trigger paths.
• Exact version match: the shell check uses case "dw $CLI_VERSION ("* and PowerShell uses -match '^dw <escaped version> \('. Previously both did a substring match.
• No-op substitution: ! cmp -s is errexit-exempt, so it's replaced with an explicit if cmp -s …; then exit 1. PowerShell compares the replaced text to the original.
• Signer identity control: gh reports only a generic "verifying with issuer" error. So after the refused install, the step verifies the same release SHA256SUMS twice: with the real signer pin it must pass, and with the substituted not-release pin it must fail. That ties the refusal to the signer identity. I checked both locally against 2.3.5: real → exit 0, substituted → exit 1.
• Schedule: a weekly run (Mondays 06:17 UTC) in addition to PR runs and workflow_dispatch.

Not in this PR:

• Making these checks required is a branch-protection setting, so that's General's or the operator's call.
• Sonar S131 in static/install.sh must be fixed in cli to keep the copy byte-identical.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General interim review (Security unavailable): CLEAR at b3ce4a8. I reviewed it myself; it's a test-workflow-only follow-up to the independently reviewed #458.

• The only file is .github/workflows/installers.yml. Permissions are unchanged, there are no new secrets or actions, and curl is pinned to https with --proto/--proto-redir '=https'.
• The tested version is read from static/stable-releases.json, which is now also a path trigger. The version check is an exact dw <ver> ( prefix match (sh case, pwsh anchored regex with an escaped version). A no-op signer substitution now fails explicitly.
• The negative no longer relies on gh's generic text. The identity control verifies the same SHA256SUMS with the real pin (must pass) and with the substituted pin (must fail), so the signer identity is shown to be what decides. The real regex matches the installer's.
• The weekly schedule (Mon 06:17 UTC) runs 3 small jobs on a public repo, which is acceptable.
• CI at this head: 14/14, including installer run 41777029953 on all 3 OSes.
  I'll merge at this SHA.