fix(apps): express the cosign transition as one identity — Flux rejects multiple

[devantler]

🤖 Generated by the Daily AI Assistant

Why

All three tenant artifact sources (wedding-app, ascoachingogvaner, github-config) stopped verifying on prod right after #2399: Flux's cosign verifier accepts exactly one signing identity, so the transitional second entry broke verification outright (unsupported: multiple identities are not supported at this time). The apps layer can no longer pull tenant updates, and this is failing merge-queue deploys (evicted #2400's first run).

What

Collapses each pair of identities into one entry whose subject pattern accepts both the old and the new signing workflow — the same trust set #2399 intended, in a form Flux supports. The narrowing step (drop the old path once actions-signed artifacts verify) stays as planned; tightening the ref matcher stays tracked in #2402.

Merge-order note: land ASAP — the merge queue keeps evicting PRs on the failed apps health check until this applies.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e5ee569c-37e6-44a2-a538-c62f82aab306

📥 Commits

Reviewing files that changed from the base of the PR and between efa0e84 and 10e8f0b.

📒 Files selected for processing (3)

• k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
• k8s/bases/apps/github-config/oci-repository.yaml
• k8s/bases/apps/wedding-app/oci-repository.yaml

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (3)

k8s/bases/**/*.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Do not modify resources under k8s/bases/ directly from overlays; use Kustomize patches: in overlays instead.

Files:

• k8s/bases/apps/github-config/oci-repository.yaml
• k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
• k8s/bases/apps/wedding-app/oci-repository.yaml

k8s/**/*.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Use one Kubernetes resource per file, except for the explicitly whitelisted vendored operator bundles.

Files:

• k8s/bases/apps/github-config/oci-repository.yaml
• k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
• k8s/bases/apps/wedding-app/oci-repository.yaml

k8s/**/*.{yaml,yml}

📄 CodeRabbit inference engine (AGENTS.md)

Name component-folder files after the resource Kind in kebab-case, and use ‹kind›-‹purpose›.yaml when a folder contains more than one resource of the same Kind.

Files:

• k8s/bases/apps/github-config/oci-repository.yaml
• k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
• k8s/bases/apps/wedding-app/oci-repository.yaml

🧠 Learnings (2)

📚 Learning: 2026-07-01T21:13:36.950Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 2359
File: k8s/bases/apps/actual-budget/helm-release.yaml:62-111
Timestamp: 2026-07-01T21:13:36.950Z
Learning: When reviewing Kustomize/Helm YAML in this repo, keep the base vs provider overlay split: `k8s/bases/apps/**` and `k8s/bases/infrastructure/**` should contain each app’s full, environment-agnostic configuration (including base-level postRenderer Kustomize patches such as deployment strategy, topology spread, probes, and env injection). `k8s/providers/{docker,hetzner}/**` should only add small provider-specific deltas (e.g., `interval`, `persistence.size`) via patch files (like `k8s/providers/<provider>/apps/<app>/patches/helm-release-patch.yaml`). If configuration is identical across providers (e.g., OIDC/OAuth env vars where `${domain}` is resolved per cluster via envsubst), it belongs in the base and must not be duplicated into provider overlays.

Applied to files:

• k8s/bases/apps/github-config/oci-repository.yaml
• k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
• k8s/bases/apps/wedding-app/oci-repository.yaml

📚 Learning: 2026-07-03T03:44:11.507Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 2399
File: k8s/bases/apps/ascoachingogvaner/oci-repository.yaml:25-26
Timestamp: 2026-07-03T03:44:11.507Z
Learning: In Flux `OCIRepository` manifests under `k8s/bases/**/oci-repository.yaml`, keep the existing house convention for `spec.serviceAccountRef.verify.matchOIDCIdentity` subject regexes to use an `@.+` ref suffix (i.e., match any ref) rather than tightening it to a specific SHA/tag pattern.

If a PR adds a transitional dual-subject entry for an ongoing migration (e.g., moving from `devantler-tech/reusable-workflows` to `devantler-tech/actions`), do not request tightening the ref matcher in that PR. Defer any ref-matcher tightening to a separate, focused follow-up PR that consistently tightens `matchOIDCIdentity` subject rules once each file returns to a single subject after migration cleanup.

Applied to files:

• k8s/bases/apps/github-config/oci-repository.yaml
• k8s/bases/apps/ascoachingogvaner/oci-repository.yaml
• k8s/bases/apps/wedding-app/oci-repository.yaml

🔇 Additional comments (3)

k8s/bases/apps/ascoachingogvaner/oci-repository.yaml (1)

19-26: LGTM!

k8s/bases/apps/github-config/oci-repository.yaml (1)

31-38: LGTM!

k8s/bases/apps/wedding-app/oci-repository.yaml (1)

19-26: LGTM!

---

📝 Walkthrough

Walkthrough

Three Flux OCIRepository manifests had their cosign matchOIDCIdentity configuration changed from two separate subject entries (reusable-workflows and actions paths) to a single entry using an alternation regex matching either path, with comments updated accordingly.

Changes

Cosign OIDC identity consolidation

Layer / File(s)	Summary
Consolidate matchOIDCIdentity subject regex k8s/bases/apps/ascoachingogvaner/oci-repository.yaml, k8s/bases/apps/github-config/oci-repository.yaml, k8s/bases/apps/wedding-app/oci-repository.yaml	Two separate subject entries for reusable-workflows and actions paths are replaced with a single subject regex alternation, keeping the same issuer, and comments are updated to document the single-identity limitation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• Tighten cosign OIDC subject ref matchers (@.+) on OCIRepository verify rules #2402: Both address the transitional matchOIDCIdentity subject-regex cleanup across the same OCIRepository manifests.

Possibly related PRs

• devantler-tech/platform#2319: Also modifies the matchOIDCIdentity subject matcher regex/alternation for GitHub Actions OIDC verification.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: collapsing multiple cosign identities into a single Flux-compatible identity.
Description check	✅ Passed	The description directly matches the changeset and explains the Flux cosign identity transition and its impact.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/cosign-single-identity-hotfix

---

_{Comment @coderabbitai help to get the list of available commands.}

[devantler]

🤖 Generated by the Daily AI Assistant

Closing as a duplicate of #2404 — a parallel session root-caused the same breakage and shipped the identical fix (one alternation-regex identity per tenant OCIRepository) minutes earlier; #2404 is already CR-approved, promoted, and queued. Parallel-race rule: the first PR wins, the duplicate closes.