fix: tenant artifact verification rejects the dual signing identities from #2399

[devantler]

🤖 Generated by the Daily AI Assistant

Why

Prod's app-delivery layer has been frozen since #2399 deployed (~03:46Z): the signature verifier refuses configurations with more than one accepted identity, so all three tenant apps (github-config, wedding-app, ascoachingogvaner) stopped pulling their artifacts, and every platform merge is now blocked because the queue's prod deploy fails on the stuck apps layer (#2400 was evicted; Heal-Prod fails the same way).

What

Keeps both the old and new signing workflows trusted during the actions#425 transition, but expresses them as a single identity rule the verifier accepts. What is trusted does not change.

Operational

Land this before re-queuing anything on platform — merges stay blocked until it deploys. Fixes the regression introduced by #2399.

[coderabbitai]

📝 Walkthrough

Walkthrough

Three OCIRepository manifests (ascoachingogvaner, github-config, wedding-app) had their cosign verify.matchOIDCIdentity configuration consolidated from two separate subject entries (reusable-workflows and actions) into a single subject regex using alternation (reusable-workflows|actions), with updated explanatory comments.

Changes

Cosign OIDC identity consolidation

Layer / File(s)	Summary
ascoachingogvaner identity update k8s/bases/apps/ascoachingogvaner/oci-repository.yaml	Merges two subject entries into one alternation regex (reusable-workflows|actions) with updated comments.
github-config identity update k8s/bases/apps/github-config/oci-repository.yaml	Merges two subject entries for publish-manifests.yaml into one alternation regex, keeping the same issuer.
wedding-app identity update k8s/bases/apps/wedding-app/oci-repository.yaml	Merges two subject entries into one alternation regex, keeping the same issuer and updating transition comments.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Tighten cosign OIDC subject ref matchers (@.+) on OCIRepository verify rules #2402: Touches the same OCIRepository cosign matchOIDCIdentity verify rules, modifying a related regex portion.

Possibly related PRs

• devantler-tech/platform#2319: Also adjusts Cosign keyless OCIRepository matchOIDCIdentity subject/ref matchers using workflow-path regexes.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the fix to tenant artifact verification rejecting dual signing identities.
Description check	✅ Passed	The description matches the change and explains the regression, the single-regex identity fix, and the rollout impact.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/apps-cosign-single-identity

---

_{Comment @coderabbitai help to get the list of available commands.}

[botantler-1]

🎉 This PR is included in version 1.95.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀