From 647a0c5c1d75435596c4fc79c75a77a541d3659f Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Fri, 3 Jul 2026 08:55:40 +0200 Subject: [PATCH] fix(rgd): accept both publish-app repo subjects via one regex-alternated cosign identity MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Same single-entry alternation as #2404 — cosign keyless attestation verification rejects multiple matchOIDCIdentity entries, so the RGD template must carry the alternation before any RGD tenant repoints its cd workflow to devantler-tech/actions. Fixes #2405 Co-Authored-By: Claude Fable 5 --- .../tenant/resource-graph-definition.yaml | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml b/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml index 0b1fcfee7..a6aff95b8 100644 --- a/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml +++ b/k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml @@ -167,8 +167,15 @@ spec: verify: provider: cosign matchOIDCIdentity: + # publish-app.yaml is moving from devantler-tech/reusable-workflows into + # devantler-tech/actions (actions#425 consumer repoint); both repo + # subjects are accepted via ONE regex-alternated entry — cosign's keyless + # attestation verification rejects MULTIPLE identity entries outright + # ("unsupported: multiple identities are not supported at this time"). + # Narrow the alternation to actions-only once the first actions-signed + # artifact has been published and verified. - issuer: '^https://token\.actions\.githubusercontent\.com$' - subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$' + subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$' # --- Flux Kustomization (one of two variants by `sops`) --------------- # The impersonating Kustomization that reconciles the tenant's own artifact # under its namespaced `edit` SA. Two variants because the SOPS `decryption`