[devantler]

🤖 Generated by the Agentic Engineer

Why

The latest organization settings publication is blocked because its publisher changed before the platform approved the transition.

What

Restores verified delivery by accepting the reviewed new publisher alongside the currently verified publisher and retiring the obsolete approval. Other publishers and security boundaries stay unchanged.

Fixes #5265

[devantler]

🤖 Generated by the Agentic Engineer

Review evidence for 1634dddd44b423fc52ba82080b114f0efaa8e12f.

The producer moved its caller in devantler-tech/.github#725. The previously applied v12.0.2 publication was produced by run 39943939010 using the exact 0f390329b590404c02565b27a263ee841fa02bce publisher. The new v12.0.3 publication requests 6f1dee9557a939cc24ca2c562ea775d05e01564d.

Both complete GitHub trees were read independently. The executable publisher surface is identical at those two commits:

Surface	Mode	Git blob
publish-manifests workflow	100644	ce9a9897b154486218478734a02c61e5ac3ea479
require-unpublished-version helper	100644	3566e4067e953a1d9cb34e6a50a0f9b72a5d8bc8
recover-manifests-version helper	100644	48dc38f60ddebf90b0976758df9f1983bbb86bfd

The regression first failed on the committed matcher: the new publisher was rejected and the obsolete 8d2203af publisher remained accepted. After the transition, the retained and new exact revisions pass, the retired revision fails, legacy approvals still pass, and unrelated issuers, repositories, workflows, mutable refs, shortened/suffixed revisions and the unrelated AWS consumer remain rejected.

The pinned authorization renderer changes exactly the organization settings source entry; the proposed fingerprint is b5ab7e893cffdb3eaa01de448e1daa4ec95e6d9e9a72d4f47ab8439ad7e558e6. No issuer/repository pattern or other consumer approval changes.

Actual Cosign checks verified the old v12.0.2 artifact to the retained publisher and the new v12.0.3 artifact to the proposed exact publisher, using GitHub's exact OIDC issuer. An impossible forty-character signer failed explicitly on certificate identity. Signed payloads bind the artifact versions, source revisions and publication runs.

The canonical suite passed 201 controls; both canonical regeneration fixture families, all five consumer guards, Bash syntax, ShellCheck and the focused authorization Go package passed. The canonical matcher writer ran again with zero changes. Authorization rendering used checksum-verified kubectl 1.36.2 / Kustomize 5.8.1, matching the repository's required renderer.

The genuine global observation refresh through the working production context failed closed because AWS and the data-product-controller/Khoist caller have unrelated unapproved publisher pins: two of five consumers unresolved, no files written. Observed TSVs remain unchanged. This PR changes only the canonical approval, its generated matcher, the reviewed authorization ledger and the real predicate regression. It does not claim a fresh global observation set.

Hosted validation is running on the exact head; the PR remains a draft pending its outcome and independent review.

The protected rollout must still demonstrate a verified new publication and healthy live platform status. Dashboard activation remains pending on that outcome.

[devantler]

🤖 Generated by the Agentic Engineer

The separate global observation refresh blocker is tracked in #5267. This repair preserves the existing observation files and other consumers' approvals; its exact publisher and artifact verification evidence is recorded above.

[devantler]

🤖 Generated by the Agentic Engineer

Evaluation at 1634dddd44b423fc52ba82080b114f0efaa8e12f: full hosted CI passed, including complete Go regressions, production authorization, real Cosign matcher efficacy, both manifest overlays and cluster-policy evaluation. All other current-head checks are green and there are no review threads.

The command-line evaluation used the actual previously applied and newly published organization settings artifacts. Their exact retained/new certificate identities verified successfully, and the impossible identity was rejected. The committed predicate separately passed its retired-publisher and unrelated-consumer/issuer/repository/workflow controls. Source, provenance and ledger evidence are in the earlier comment.

This establishes the proposed acceptance behavior. Protected deployment and the live verified-publication/health readback remain required before closure.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: codex/restore-github-config-publisher-5265
• File: .coderabbit.yaml
• Commit: 1634ddd
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 79cc8585-4821-4503-a89b-e440569846ec

📥 Commits

Reviewing files that changed from the base of the PR and between 2987b57 and 1634ddd.

⛔ Files ignored due to path filters: 1

• scripts/publish-workflow-canonical-approvals.tsv is excluded by !**/*.tsv

📒 Files selected for processing: 3

• k8s/bases/apps/github-config/oci-repository.yaml
• scripts/tests/test-publish-workflow-canonical-approvals.sh
• scripts/validate-eks-ci-role-policy/approved-surface.txt

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

📚 Code guidelines: 2

docs/github-management.md — auto-discovered
AGENTS.md — auto-discovered

📓 Path-based instructions: 3

Applicability reference: AGENTS.md: # AGENTS.md **Flux dependency order** — `bootstrap` → `flux-instance` → `infrastructure-controllers` → `infrastructure` → `apps`.

📄 CodeRabbit inference engine (docs/github-management.md)

Files:

• k8s/bases/apps/github-config/oci-repository.yaml

Source excerpt: A CR is split out into its own **plural-Kind folder** only when it cannot live with its component: **Dependency split** — the CRD ships with the controller's HelmRelease, so the CR must reconcile a layer later to avoid the C...

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/apps/github-config/oci-repository.yaml

Source excerpt: **Put a change in the layer that matches its scope** — edit `k8s/bases/` when it should hold for **every consumer of that resource**; add an overlay `patches/` fragment only for a genuine per-consumer difference.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• k8s/bases/apps/github-config/oci-repository.yaml

🧠 Learnings: 1

📚 Learning: 2026-08-10T13:01:12.782Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 3057
File: .github/workflows/ci.yaml:622-659
Timestamp: 2026-08-10T13:01:12.782Z
Learning: Repository shell tests and scripts must remain compatible with macOS Bash 3.2. Do not use Bash 4+ features such as `mapfile`; use portable constructs, such as a `while IFS= read -r` loop, instead.

Applied to files:

• scripts/tests/test-publish-workflow-canonical-approvals.sh

🔇 Additional comments: 3

k8s/bases/apps/github-config/oci-repository.yaml: 1

32-32: LGTM!

scripts/tests/test-publish-workflow-canonical-approvals.sh: 1

607-649: LGTM!

scripts/validate-eks-ci-role-policy/approved-surface.txt: 1

425-425: LGTM!

📝 Walkthrough

The github-config cosign identity matcher now accepts workflow revision 6f1dee9557a939cc24ca2c562ea775d05e01564 instead of 8d2203af130a8c27b8b98b3d7146f76b5ade7a98. Tests cover accepted identities, rejected issuers and subjects, and separation from the AWS consumer predicate. The approved-surface digest for the OCIRepository is updated.

Possibly related issues

• Promotion caller test rejects tracked publisher pin updates .github#727 — Reports the publisher revision transition addressed by the downstream approval update.
• Retire the v7.16.2 github-config publisher approval #5240 — Requests retirement of the obsolete publisher approval, which this change replaces.

Priority: ➖ Normal

Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to 1634d

No actionable code issue remains in this review. Protected deployment and live readback are still pending before publication is complete.

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

Failed checks: 1 inconclusive

Check name	Status	Explanation	Resolution
Linked Issues check		The PR updates the github-config matcher to accept new exact revision 6f1dee9557a939cc24ca2c562ea775d05e01564d and retire 8d2203af130a8c27b8b98b3d7146f76b5ade7a98. The added tests cover the reta…	Provide reviewable evidence that scripts/publish-workflow-canonical-approvals.tsv contains the required retained and new exact approvals and that the new shared workflow source was reviewed. Non-coding delivery, independent-review, and li…

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: restoring verified organization settings publication through a security fix.
Description check		The description directly explains why publication was blocked and what the change restores, including retirement of the obsolete approval.
Out of Scope Changes check		The matcher update, authorization tests, and approved rendered-surface digest all support issue #5265. The tests validate exact revision boundaries and consumer separation. No unrelated change is esta…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Out of Scope Changes check

Explanation

The matcher update, authorization tests, and approved rendered-surface digest all support issue #5265. The tests validate exact revision boundaries and consumer separation. No unrelated change is established by the supplied whole-PR summary.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

Full details: Linked Issues check

Explanation

The PR updates the github-config matcher to accept new exact revision 6f1dee9557a939cc24ca2c562ea775d05e01564d and retire 8d2203af130a8c27b8b98b3d7146f76b5ade7a98. The added tests cover the retained and new revisions, retired revision, unrelated identities, malformed revisions, and consumer separation. The canonical approval source scripts/publish-workflow-canonical-approvals.tsv is excluded from review, so the required canonical approval update cannot be verified. The supplied evidence also does not establish the new workflow-source review.

Resolution

Provide reviewable evidence that scripts/publish-workflow-canonical-approvals.tsv contains the required retained and new exact approvals and that the new shared workflow source was reviewed. Non-coding delivery, independent-review, and live-readback criteria are not assessed as coding requirements.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Agentic Engineer

Resolved the Linked Issues check: canonical approval TSV excluded / new workflow-source review not established evidence request in the exact-head review.

The published canonical source at this head contains exactly these organization-settings approvals:

.github  publish-manifests  devantler-tech/.github  0f390329b590404c02565b27a263ee841fa02bce
.github  publish-manifests  devantler-tech/.github  6f1dee9557a939cc24ca2c562ea775d05e01564d

The obsolete 8d2203af entry is removed. The current-head membership guard and canonical writer validate the source-to-matcher relationship, and the 201 regression controls verify the accepted and rejected identities.

The source review compared the complete, non-truncated Git trees of the previously approved publisher and the proposed publisher. The workflow and both executable helpers have identical mode and blob identities: workflow ce9a9897b154486218478734a02c61e5ac3ea479, unpublished-version helper 3566e4067e953a1d9cb34e6a50a0f9b72a5d8bc8, recovery helper 48dc38f60ddebf90b0976758df9f1983bbb86bfd. This comparison was performed independently twice. Actual old/new artifact signatures and the impossible-identity refusal are recorded in the preceding evaluation evidence.

This supplies the requested source and review evidence. The substantive review is green for 1634dddd44b423fc52ba82080b114f0efaa8e12f; all three additional comments are LGTM and there are no review threads. No source or check configuration changed after review. body_findings=0-resolved@1634dddd44b423fc52ba82080b114f0efaa8e12f.

Protected deployment and live publication readback remain delivery requirements.

[devantler]

🤖 Generated by the Agentic Engineer

The reviewed repair is first in the protected merge queue at head 1634dddd44b423fc52ba82080b114f0efaa8e12f. All merge-group validation has passed; production deployment is waiting for the automatic recovery in run 39954440955 to release its deployment lock.

Next action: collect the waiting deployment result, then verify the restored publication and live platform health. The recovery is already applying production state, so it is being allowed to finish. Dashboard activation remains dependent on this repair and will not be promoted until that live verification passes.