Repository navigation
Retire the v7.16.2 github-config publisher approval #5240
Description
🤖 Generated by the Agentic Engineer
Objective
Retire the v7.16.2 (8d2203af) approval for the organization settings publisher, now that the v10.0.3 (0f390329) publisher signs and production accepts its releases.
Details
#5235 approved 0f390329 beside 8d2203af for the transition. devantler-tech/.github#714 moved the caller to 0f390329. Its first release, v10.0.4 (sha256:93c7a292…), verifies against the new identity and is SourceVerified=True in production (readback on that PR). Nothing should need 8d2203af any more.
Checklist
- Re-read the caller pin, the latest release's signature identity and the live acceptance rule. Confirm no current publication depends on
8d2203af. - Remove only that canonical entry through the existing approval and generation procedures. Keep the legacy
actionsfamily entries. - Prove
0f390329stays accepted and8d2203afis rejected, with negative controls for other issuers, repositories and revisions. - Review at the exact head, deliver through the protected path, and read back the deployed rule and a healthy artifact.
Metadata
Metadata
Assignees
Labels
No labels
Type
Fields
Priority
None yet
Projects
- Status
Activity
chore: agent-claim #5240 nonce=da2abd6a6bb0a3abcab79731ecb6ce04
devantler commentedon Oct 23, 2026
Delivered through #5266 at reviewed head
1634dddd44b423fc52ba82080b114f0efaa8e12f; the protected merge-group run 39961170965 passed and merged as9003ce4c8b1c17916d5db085a2c3bd3312296824at 14:29:23 UTC.Read-only production verification at 14:29 UTC:
0f390329…and6f1dee95…), with the legacy family unchanged and retired8d2203af…absent.v12.0.4, digestsha256:4d386cdbcad81774308ff517da208f4bea9afc0d57d817cbc660ecbf83793b3c. Ready and SourceVerified are both True at the current observed generation, 33.0f390329b590404c02565b27a263ee841fa02bce. The earlier exactv12.0.3proof binds the new publisher, and the retained/new positive and retired/unrelated negative controls passed.PLATFORM-HEALTH=OK.The four retirement criteria in this issue are met; the current caller still pins the retained publisher. #5267 remains the separately tracked complete-observation refresh work; this receipt does not claim that broader task is resolved. The publication blocker on dashboard activation #5260 is cleared.