From f507fdaf9ebdf931f00f301f954ebb62924268f8 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 3 Jul 2026 04:11:19 +0200 Subject: [PATCH] feat: accept devantler-tech/actions signing subjects during the publish-workflow repoint The publish-manifests/publish-app reusable workflows are moving from reusable-workflows into actions (actions#425); cosign OIDC subjects are the signing workflow's path, so each artifact verifier must accept the new path BEFORE its producer repoints, or verification breaks at the next tag. Both subjects accepted during the transition; drop the old entries once actions-signed artifacts have shipped. Co-Authored-By: Claude Fable 5 --- k8s/bases/apps/ascoachingogvaner/oci-repository.yaml | 6 ++++++ k8s/bases/apps/github-config/oci-repository.yaml | 12 +++++++++--- k8s/bases/apps/wedding-app/oci-repository.yaml | 6 ++++++ 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml b/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml index 557938f58..d90dcc5e4 100644 --- a/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml +++ b/k8s/bases/apps/ascoachingogvaner/oci-repository.yaml @@ -18,3 +18,9 @@ spec: matchOIDCIdentity: - issuer: '^https://token\.actions\.githubusercontent\.com$' subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$' + # publish-app.yaml is moving from devantler-tech/reusable-workflows into + # devantler-tech/actions (actions#425 consumer repoint); both subjects are + # accepted during the transition — drop the reusable-workflows entry once + # the first actions-signed artifact has been published and verified. + - issuer: '^https://token\.actions\.githubusercontent\.com$' + subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$' diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml index 1a54baf85..03834f342 100644 --- a/k8s/bases/apps/github-config/oci-repository.yaml +++ b/k8s/bases/apps/github-config/oci-repository.yaml @@ -26,8 +26,14 @@ spec: matchOIDCIdentity: # Keyless-signed by the shared publish-manifests reusable workflow that # .github's cd.yaml calls. Signing runs INSIDE that reusable workflow, so - # the cosign OIDC subject is the reusable workflow's path (devantler-tech/ - # reusable-workflows), NOT .github's own cd.yaml — same convention as the - # publish-app.yaml-signed app artifacts. + # the cosign OIDC subject is the reusable workflow's path, NOT .github's + # own cd.yaml — same convention as the publish-app.yaml-signed app + # artifacts. The workflow is moving from devantler-tech/reusable-workflows + # into devantler-tech/actions (actions#425 consumer repoint); both + # subjects are accepted during the transition — drop the + # reusable-workflows entry once the first actions-signed artifact has + # been published and verified. - issuer: '^https://token\.actions\.githubusercontent\.com$' subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-manifests\.yaml@.+$' + - issuer: '^https://token\.actions\.githubusercontent\.com$' + subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-manifests\.yaml@.+$' diff --git a/k8s/bases/apps/wedding-app/oci-repository.yaml b/k8s/bases/apps/wedding-app/oci-repository.yaml index 4267ad745..224e79cc3 100644 --- a/k8s/bases/apps/wedding-app/oci-repository.yaml +++ b/k8s/bases/apps/wedding-app/oci-repository.yaml @@ -18,3 +18,9 @@ spec: matchOIDCIdentity: - issuer: '^https://token\.actions\.githubusercontent\.com$' subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$' + # publish-app.yaml is moving from devantler-tech/reusable-workflows into + # devantler-tech/actions (actions#425 consumer repoint); both subjects are + # accepted during the transition — drop the reusable-workflows entry once + # the first actions-signed artifact has been published and verified. + - issuer: '^https://token\.actions\.githubusercontent\.com$' + subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'