fix: tenant artifact verification rejects the dual signing identities from #2399

k8s/bases/apps/ascoachingogvaner/oci-repository.yaml

@@ -16,11 +16,12 @@ spec:
   verify:
     provider: cosign
     matchOIDCIdentity:
-      - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
       # publish-app.yaml is moving from devantler-tech/reusable-workflows into
-      # devantler-tech/actions (actions#425 consumer repoint); both subjects are
-      # accepted during the transition — drop the reusable-workflows entry once
-      # the first actions-signed artifact has been published and verified.
+      # devantler-tech/actions (actions#425 consumer repoint); both repo
+      # subjects are accepted via ONE regex-alternated entry — cosign's keyless
+      # attestation verification rejects MULTIPLE identity entries outright
+      # ("unsupported: multiple identities are not supported at this time").
+      # Narrow the alternation to actions-only once the first actions-signed
+      # artifact has been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'
+        subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$'

k8s/bases/apps/github-config/oci-repository.yaml

@@ -29,11 +29,12 @@ spec:
       # the cosign OIDC subject is the reusable workflow's path, NOT .github's
       # own cd.yaml — same convention as the publish-app.yaml-signed app
       # artifacts. The workflow is moving from devantler-tech/reusable-workflows
-      # into devantler-tech/actions (actions#425 consumer repoint); both
-      # subjects are accepted during the transition — drop the
-      # reusable-workflows entry once the first actions-signed artifact has
-      # been published and verified.
+      # into devantler-tech/actions (actions#425 consumer repoint); both repo
+      # subjects are accepted via ONE regex-alternated entry — cosign's keyless
+      # attestation verification rejects MULTIPLE identity entries outright
+      # ("unsupported: multiple identities are not supported at this time"), so
+      # the transition must be expressed inside a single subject regex. Narrow
+      # the alternation to actions-only once the first actions-signed artifact
+      # has been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-manifests\.yaml@.+$'
-      - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-manifests\.yaml@.+$'
+        subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-manifests\.yaml@.+$'

k8s/bases/apps/wedding-app/oci-repository.yaml

@@ -16,11 +16,12 @@ spec:
   verify:
     provider: cosign
     matchOIDCIdentity:
-      - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
       # publish-app.yaml is moving from devantler-tech/reusable-workflows into
-      # devantler-tech/actions (actions#425 consumer repoint); both subjects are
-      # accepted during the transition — drop the reusable-workflows entry once
-      # the first actions-signed artifact has been published and verified.
+      # devantler-tech/actions (actions#425 consumer repoint); both repo
+      # subjects are accepted via ONE regex-alternated entry — cosign's keyless
+      # attestation verification rejects MULTIPLE identity entries outright
+      # ("unsupported: multiple identities are not supported at this time").
+      # Narrow the alternation to actions-only once the first actions-signed
+      # artifact has been published and verified.
       - issuer: '^https://token\.actions\.githubusercontent\.com$'
-        subject: '^https://github\.com/devantler-tech/actions/\.github/workflows/publish-app\.yaml@.+$'
+        subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$'