ci: repoint reusable workflows to devantler-tech/actions v8.0.0

[devantler]

🤖 Generated by the Daily AI Assistant

Why

Our reusable CI workflows moved to devantler-tech/actions; this repo still builds and signs its releases from the old repo, which can't be archived until everyone moves — and which now fails nightly (reusable-workflows#350).

What

Points this repo's CI and release workflows at the new home. Same workflows, no behavior change.

Part of devantler-tech/actions#425.

⚠️ Merge order: land devantler-tech/platform#2399 first — the platform must trust the new signing home, or this repo's next release is rejected and its deployment stops updating.
👉 After promotion: needs a direct merge (auto-merge can't touch workflow files).

[coderabbitai]

📝 Walkthrough

Walkthrough

Two GitHub Actions workflows now call reusable workflows from devantler-tech/actions v8.0.0 instead of devantler-tech/reusable-workflows. The CD workflow also updates related inline comments and reference paths.

Changes

Reusable workflow reference migration

Layer / File(s)	Summary
Update CD workflow references .github/workflows/cd.yaml	Inline documentation is updated, and the publish-manifests job now uses devantler-tech/actions v8.0.0.
Update release workflow reference .github/workflows/release.yaml	The release job now invokes the release-creation reusable workflow from devantler-tech/actions pinned to a v8.0.0 commit SHA.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related issues

• feat: repoint all consumers off reusable-workflows to actions v8, then archive reusable-workflows actions#425: Matches the same workflow migration from reusable-workflows to actions v8.0.0 in cd.yaml and release.yaml.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the workflow reference migration to devantler-tech/actions v8.0.0.
Description check	✅ Passed	The description is directly related to the workflow migration and notes the same no-behavior-change intent.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/ci-repoint-actions

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/cd.yaml (1)

3-17: 🗄️ Data Integrity & Integration | 🔵 Trivial | 💤 Low value

Update the OIDC path note. The signing workflow now comes from devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref>, so this comment should stop referencing devantler-tech/reusable-workflows.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cd.yaml around lines 3 - 17, Update the OIDC subject/path
note in this comment to match the actual reusable signing workflow source,
changing the reference from devantler-tech/reusable-workflows to
devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref>. Keep the
rest of the explanation intact, and make sure the guidance still points readers
to the cosign certificate identity used by the publish-manifests flow in
cd.yaml.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/cd.yaml:
- Around line 3-17: Update the OIDC subject/path note in this comment to match
the actual reusable signing workflow source, changing the reference from
devantler-tech/reusable-workflows to
devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref>. Keep the
rest of the explanation intact, and make sure the guidance still points readers
to the cosign certificate identity used by the publish-manifests flow in
cd.yaml.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6ff0a96b-8c1c-4576-8d29-3074481b1243

📥 Commits

Reviewing files that changed from the base of the PR and between c8d803e and 6ebb71c.

📒 Files selected for processing (2)

• .github/workflows/cd.yaml
• .github/workflows/release.yaml

[devantler]

🤖 Generated by the Daily AI Assistant

CodeRabbit review-body nitpick resolved (no thread exists to resolve, so this comment is the resolution record): the header comment's OIDC note now points at devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref> and at the verifier's real location (k8s/bases/apps/github-config/oci-repository.yaml — the old k8s/providers/hetzner/github/sync.yaml pointer was stale). Pushed in 27d4cbc.

The nitpick also surfaced a real sequencing issue: the platform verifier's subject is pinned to the reusable-workflows path, so this PR must land after devantler-tech/platform#2399 (which accepts both subjects during the transition) — otherwise the next v* tag's artifact fails cosign verification and the github-config tenant stops syncing. My original body claim that the verifier "matches @.+$" only covered the ref, not the repo path — corrected.