fix(rgd): single regex-alternated cosign identity for tenant artifact verification

[devantler]

🤖 Generated by the Daily AI Assistant

Why

RGD-instantiated tenants pin artifact verification to the reusable-workflows signing identity. When those tenants repoint their cd workflows to devantler-tech/actions (the actions#425 train), verification would fail — and adding a second identity entry is exactly what froze the apps layer yesterday (#2399 → #2404), since cosign rejects multiple identities outright.

What

The RGD template now uses the same single regex-alternated subject as the merged #2404, accepting both repos in one entry. Narrow to actions-only later with the #2404 cleanup.

Fixes #2405 · Relates to #2402

Note: local-overlay validation green (492 files); prod-overlay ksail workload validate hit the known kubeconform#363 render race repeatedly this session (shifting corruption lines in untouched helm-rendered CRDs) — kustomize builds of the affected layers pass.

[coderabbitai]

📝 Walkthrough

Walkthrough

The tenant ResourceGraphDefinition's cosign matchOIDCIdentity.subject regex was updated to accept OIDC identities from both reusable-workflows and actions workflow paths via regex alternation, replacing the previous single-path pattern. Inline comments were expanded to document this behavior.

Changes

OIDC Identity Matcher Update

Layer / File(s)	Summary
Update subject regex alternation k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml	Replaced single reusable-workflows-only subject pattern with a regex alternation accepting reusable-workflows or actions paths, and expanded comments explaining the identity-acceptance behavior and planned narrowing.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• devantler-tech/platform#2319: Both PRs modify the same cosign verify.matchOIDCIdentity.subject regex in a tenant/platform OCIRepository configuration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change satisfies #2405 by updating the tenant RGD to use one alternated subject matching reusable-workflows and actions.
Out of Scope Changes check	✅ Passed	The PR stays within scope; the only changes are the required matcher update and clarifying comments.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title clearly summarizes the main change: using a single regex-alternated cosign identity for tenant artifact verification.
Description check	✅ Passed	The description directly explains the cosign identity change and its purpose in the tenant RGD template.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/rgd-cosign-single-identity

---

_{Comment @coderabbitai help to get the list of available commands.}

[botantler-1]

🎉 This PR is included in version 1.95.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀