Repository navigation
chore(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 7.12.0 to 7.16.2 - #649
Conversation
…nifests.yaml Bumps [devantler-tech/.github/.github/workflows/publish-manifests.yaml](https://github.com/devantler-tech/.github) from 7.12.0 to 7.16.2. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](e168132...8d2203a) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/publish-manifests.yaml dependency-version: 7.16.2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
![botantler-1[bot]](https://avatars.githubusercontent.com/in/1025824?s=60&v=4){kind=small}
Code coverage overviewLanguages: Go Go / code-coverage/test
Go / code-coverage/go
ℹ️ Calculations represent line coverage. Results may change as calculations are updated. Updated |
Signed-off-by: Nikolai Emil Damm <nikolaiemildamm@icloud.com>
Pull request was converted to draft
The failed publication regression still required the v7.12.0 caller SHA after this PR advanced it to v7.16.2. I reproduced the failure, changed only the guard's expected immutable SHA, and reran the real publication-step fixture successfully, including signed-claim mismatches, signing/verification/push failures, late version conflicts, stable/prerelease behavior and unsafe-caller mutations. Caller pinning and signed promotion remain mandatory. Upstream review covers all 11 released versions after v7.12.0 through v7.16.2, using their release notes and the local immutable-source comparison. This source tree publishes no separate changelog or upgrade guide:
The publisher workflow itself is byte-identical between The repair includes the current base through a signed merge and remains draft pending new-head hosted checks and semantic review. The disposable offline registry proves the changed assertion and publication refusal paths; it does not claim a new production publication. |
devantler
left a comment
devantler
left a comment
There was a problem hiding this comment.
🤖 Generated by the Agentic Engineer
[P1] Deploy acceptance of the new publisher identity before merging
At 3868e643b9b9ab131ca17801b528bdd1b07351f9, this changes the called publisher from e1681322e671f8e277c5e230a57fe66cdf1a612d to 8d2203af130a8c27b8b98b3d7146f76b5ade7a98, while the Platform's fixed canonical approvals and configuration-source matcher still accept only the former canonical revision for this consumer. The enabled caller-pin guard therefore refuses the next configuration publication before signing. Byte-identical workflow contents do not preserve its OIDC certificate identity: the called revision is part of that identity.
The new expected SHA makes the offline assertion pass, but does not complete that production prerequisite. Follow the existing publisher transition procedure: review and add the new fixed approval alongside the current one, regenerate and deploy the matcher with its authorization record, then merge this caller update. Retain the current approval through the first verified publication from the new revision. No guard needs to be disabled or generalized.
I independently confirmed the current source's successful signature verification and the exact matcher accepting the current revision and refusing this proposed revision. This is a review finding for the active repair; no branch was changed.
The publisher-identity prerequisite is now tracked by Platform #5092, with the tested transition in draft #5093. Its generated matcher retains the current publisher and adds only this PR's exact replacement revision. Offline identity checks and both manifest validations passed; hosted CI, review, deployment and live readback remain pending. At |
No longer parked (2026-10-19 15:30 UTC). The blocker, a deployed acceptance of both exact publisher identities (platform#5092), now holds: the live configuration source accepts the current and the replacement revision and still verifies the current signer (readback). The P1 finding is resolved in this reply. Next: a fresh review of head |
Resolving the P1 review finding at The finding asked for three things before this caller update merges. All three now hold:
This PR's diff is unchanged. It moves the caller pin and the matching test expectation, and no guard was disabled or widened. The finding is cleared at this head. The next step is a fresh review of this head. |
@codex review for the caller pin move to the v7.16.2 publisher and its test expectation |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Readiness at
|
1 participant
Bumps devantler-tech/.github/.github/workflows/publish-manifests.yaml from 7.12.0 to 7.16.2.
Release notes
Sourced from devantler-tech/.github/.github/workflows/publish-manifests.yaml's releases.
... (truncated)
Commits
8d2203afix(ci): use the maintained required Go workflow (#646)e038a2efix(gitops): observe the required Go workflow policy (#644)e39b2bdfeat(cleanup): report the read and delete requests a cleanup sent (#642)bc07d20feat(governance): require CodeQL findings on metadata repositories (#640)f15658cfeat(governance): observe the existing organization CodeQL rule (#637)423d900feat(labels): declare the maintainer digest labels for the monorepo (#633)40936d1perf(cleanup): split the latest day off a capped run history first (#624)1d05d53docs(security): say what happens after a private vulnerability report (#630)a0a678bfix(docs): keep catalogue instructions within the read budget (#632)22ae86efix(ci): adopt patched release and Go tools (#631)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)