Skip to content

fix(rgd): single regex-alternated cosign identity for tenant artifact verification #2408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 1 commit into from
Jul 3, 2026
Merged

fix(rgd): single regex-alternated cosign identity for tenant artifact verification #2408

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion k8s/bases/infrastructure/resource-graph-definitions/tenant/resource-graph-definition.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,8 +167,15 @@ spec:
verify:
provider: cosign
matchOIDCIdentity:
# publish-app.yaml is moving from devantler-tech/reusable-workflows into
# devantler-tech/actions (actions#425 consumer repoint); both repo
# subjects are accepted via ONE regex-alternated entry — cosign's keyless
# attestation verification rejects MULTIPLE identity entries outright
# ("unsupported: multiple identities are not supported at this time").
# Narrow the alternation to actions-only once the first actions-signed
# artifact has been published and verified.
- issuer: '^https://token\.actions\.githubusercontent\.com$'
subject: '^https://github\.com/devantler-tech/reusable-workflows/\.github/workflows/publish-app\.yaml@.+$'
subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-app\.yaml@.+$'
# --- Flux Kustomization (one of two variants by `sops`) ---------------
# The impersonating Kustomization that reconciles the tenant's own artifact
# under its namespaced `edit` SA. Two variants because the SOPS `decryption`
Expand Down