From 85188abf7dd1ca59f91f7021686d39eadc42872d Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 19 Oct 2026 11:31:27 +0200 Subject: [PATCH 1/2] fix(github-config): accept the reviewed replacement publisher Prepare the documented two-revision transition from the current canonical publisher to v7.16.2. Regenerate only the github-config subject, retaining the deployed signer and legacy compatibility revisions. Review of e1681322..8d2203af found identical publisher workflow bytes and unchanged immutable publication/recovery helpers. The exact new identity is still a separate approval because its certificate SAN includes the ref. The approved renderer reports exactly one changed authorization entry: OCIRepository github-config/github-config. Record that new digest; no other consumer matcher or authorization entry changes. Part of #5092. Deploy before devantler-tech/.github#649; retain the old approval until a real publication under the replacement identity verifies. --- k8s/bases/apps/github-config/oci-repository.yaml | 2 +- scripts/publish-workflow-canonical-approvals.tsv | 1 + scripts/validate-eks-ci-role-policy/approved-surface.txt | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml index dcc6c9c70..63f6fc64f 100644 --- a/k8s/bases/apps/github-config/oci-repository.yaml +++ b/k8s/bases/apps/github-config/oci-repository.yaml @@ -29,4 +29,4 @@ spec: # signer and this consumer's current publish-workflow pin in one identity. # Regeneration updates the pair and the approved set in the same PR. - issuer: '^https://token\.actions\.githubusercontent\.com$' - subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@e1681322e671f8e277c5e230a57fe66cdf1a612d)$' + subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(e1681322e671f8e277c5e230a57fe66cdf1a612d|8d2203af130a8c27b8b98b3d7146f76b5ade7a98))$' diff --git a/scripts/publish-workflow-canonical-approvals.tsv b/scripts/publish-workflow-canonical-approvals.tsv index e4762e6b7..42d231140 100644 --- a/scripts/publish-workflow-canonical-approvals.tsv +++ b/scripts/publish-workflow-canonical-approvals.tsv @@ -1,3 +1,4 @@ consumer workflow repository commit aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42 .github publish-manifests devantler-tech/.github e1681322e671f8e277c5e230a57fe66cdf1a612d +.github publish-manifests devantler-tech/.github 8d2203af130a8c27b8b98b3d7146f76b5ade7a98 diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 2dcc84519..2f0e03750 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -414,7 +414,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771 -source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 4f6bdc88a1f7996fbbb8bd141db306ff0875c4e4818f0bf34e6a18cbd322ddc6 +source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config d26055f2d4b80751c249d58fa2a1062d5d504842b3ac1afd4feb9d5812ef1a9b source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38 From 9237f6b59d2c7e9bd005aeb2f28b8714918666ff Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 19 Oct 2026 14:11:08 +0200 Subject: [PATCH 2/2] docs(github-config): record reviewed publisher authorization evidence --- .../approved-surface-history.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/scripts/validate-eks-ci-role-policy/approved-surface-history.md b/scripts/validate-eks-ci-role-policy/approved-surface-history.md index 1de784158..f70884e5f 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface-history.md +++ b/scripts/validate-eks-ci-role-policy/approved-surface-history.md @@ -3609,3 +3609,36 @@ to `e1681322e671f8e277c5e230a57fe66cdf1a612d`. The retained legacy `devantler-tech/actions` revisions are unchanged. No issuer, artifact URL, RBAC, IAM policy, credential or permission grant changes. The set of accepted identities shrinks by one. + +## 2026-10-19 — Accept the reviewed v7.16.2 github-config publisher + +For #5092, PR #5093 adds the canonical manifest publisher at +`devantler-tech/.github@8d2203af130a8c27b8b98b3d7146f76b5ade7a98` +(v7.16.2) alongside the current +`e1681322e671f8e277c5e230a57fe66cdf1a612d` signer. The publishing workflow +at both revisions is byte-identical, with SHA-256 +`2858f387b7b7587d871940af0ac26ff88e6a73c6242e39e38f8e9919b601ca1e`. +This source parity does not make the new revision the same certificate +identity; it requires its own explicit consumer approval. + +Against base `77e6916022ecc65de1ec094c9af6dedc1271f5fc`, the authorization +ledger changes exactly one entry, with nothing added or removed: + +- OCIRepository github-config/github-config moves from + `4f6bdc88a1f7996fbbb8bd141db306ff0875c4e4818f0bf34e6a18cbd322ddc6` to + `d26055f2d4b80751c249d58fa2a1062d5d504842b3ac1afd4feb9d5812ef1a9b`. + +At source `85188abf7dd1ca59f91f7021686d39eadc42872d`, the +[production-authorization job](https://github.com/devantler-tech/platform/actions/runs/39230855625/job/117988481227) +verified the kubectl download checksum, reported kubectl v1.36.2 / Kustomize +v5.8.1, and passed both the Go authorization regressions and the rendered +authorization contract. The matcher retains the current signer and both +legacy `devantler-tech/actions` revisions; only the reviewed replacement +identity is added. No issuer, artifact URL, RBAC, IAM policy, credential or +permission grant changes. + +Deploy this acceptance before advancing the publisher caller in +devantler-tech/.github#649. Retain the current signer until the first +publication by the replacement is independently verified. Offline checks and +this historical evidence do not establish deployed acceptance or successful +publication by the new signer.