Skip to content

fix(github-config): accept the reviewed replacement publisher #5093

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 2 commits into from
Oct 19, 2026
Merged

fix(github-config): accept the reviewed replacement publisher #5093

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
85188ab
fix(github-config): accept the reviewed replacement publisher
devantler Oct 19, 2026
9237f6b
docs(github-config): record reviewed publisher authorization evidence
devantler Oct 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion k8s/bases/apps/github-config/oci-repository.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,4 @@ spec:
# signer and this consumer's current publish-workflow pin in one identity.
# Regeneration updates the pair and the approved set in the same PR.
- issuer: '^https://token\.actions\.githubusercontent\.com$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@e1681322e671f8e277c5e230a57fe66cdf1a612d)$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(e1681322e671f8e277c5e230a57fe66cdf1a612d|8d2203af130a8c27b8b98b3d7146f76b5ade7a98))$'
1 change: 1 addition & 0 deletions scripts/publish-workflow-canonical-approvals.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,4 @@
consumer workflow repository commit
aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42
.github publish-manifests devantler-tech/.github e1681322e671f8e277c5e230a57fe66cdf1a612d
.github publish-manifests devantler-tech/.github 8d2203af130a8c27b8b98b3d7146f76b5ade7a98
33 changes: 33 additions & 0 deletions scripts/validate-eks-ci-role-policy/approved-surface-history.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3609,3 +3609,36 @@ to `e1681322e671f8e277c5e230a57fe66cdf1a612d`. The retained legacy
`devantler-tech/actions` revisions are unchanged. No issuer, artifact URL,
RBAC, IAM policy, credential or permission grant changes. The set of accepted
identities shrinks by one.

## 2026-10-19 — Accept the reviewed v7.16.2 github-config publisher

For #5092, PR #5093 adds the canonical manifest publisher at
`devantler-tech/.github@8d2203af130a8c27b8b98b3d7146f76b5ade7a98`
(v7.16.2) alongside the current
`e1681322e671f8e277c5e230a57fe66cdf1a612d` signer. The publishing workflow
at both revisions is byte-identical, with SHA-256
`2858f387b7b7587d871940af0ac26ff88e6a73c6242e39e38f8e9919b601ca1e`.
This source parity does not make the new revision the same certificate
identity; it requires its own explicit consumer approval.

Against base `77e6916022ecc65de1ec094c9af6dedc1271f5fc`, the authorization
ledger changes exactly one entry, with nothing added or removed:

- OCIRepository github-config/github-config moves from
`4f6bdc88a1f7996fbbb8bd141db306ff0875c4e4818f0bf34e6a18cbd322ddc6` to
`d26055f2d4b80751c249d58fa2a1062d5d504842b3ac1afd4feb9d5812ef1a9b`.

At source `85188abf7dd1ca59f91f7021686d39eadc42872d`, the
[production-authorization job](https://github.com/devantler-tech/platform/actions/runs/39230855625/job/117988481227)
verified the kubectl download checksum, reported kubectl v1.36.2 / Kustomize
v5.8.1, and passed both the Go authorization regressions and the rendered
authorization contract. The matcher retains the current signer and both
legacy `devantler-tech/actions` revisions; only the reviewed replacement
identity is added. No issuer, artifact URL, RBAC, IAM policy, credential or
permission grant changes.

Deploy this acceptance before advancing the publisher caller in
devantler-tech/.github#649. Retain the current signer until the first
publication by the replacement is independently verified. Offline checks and
this historical evidence do not establish deployed acceptance or successful
publication by the new signer.
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -414,7 +414,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen

source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771

source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 4f6bdc88a1f7996fbbb8bd141db306ff0875c4e4818f0bf34e6a18cbd322ddc6
source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config d26055f2d4b80751c249d58fa2a1062d5d504842b3ac1afd4feb9d5812ef1a9b
Comment thread
devantler marked this conversation as resolved.

source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38

Expand Down
Loading