🤖 Generated by the Daily AI Assistant
Problem. The tenant ResourceGraphDefinition (k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml) templates each tenant's OCIRepository with a single matchOIDCIdentity subject pinned to the reusable-workflows publish-app.yaml path. When an RGD-instantiated tenant's repo repoints its cd workflow to devantler-tech/actions (the actions#425 train), that tenant's artifact verification will fail — and the fix must NOT be a second identity entry: cosign's keyless attestation verification rejects multiple identities outright (unsupported: multiple identities are not supported at this time), which is exactly how #2399 froze the apps layer (root-cause fix: #2404).
Proposed direction. Apply the same single regex-alternated subject as #2404 — devantler-tech/(reusable-workflows|actions) — to the RGD template, and narrow it to actions-only together with the #2404 cleanup once all consumers have shipped an actions-signed artifact. Relates to the #2402 matcher hardening.
Size. Small (one templated subject line + validate).
Problem. The tenant ResourceGraphDefinition (
k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml) templates each tenant's OCIRepository with a singlematchOIDCIdentitysubject pinned to the reusable-workflowspublish-app.yamlpath. When an RGD-instantiated tenant's repo repoints its cd workflow todevantler-tech/actions(the actions#425 train), that tenant's artifact verification will fail — and the fix must NOT be a second identity entry: cosign's keyless attestation verification rejects multiple identities outright (unsupported: multiple identities are not supported at this time), which is exactly how #2399 froze the apps layer (root-cause fix: #2404).Proposed direction. Apply the same single regex-alternated subject as #2404 —
devantler-tech/(reusable-workflows|actions)— to the RGD template, and narrow it to actions-only together with the #2404 cleanup once all consumers have shipped an actions-signed artifact. Relates to the #2402 matcher hardening.Size. Small (one templated subject line + validate).