fix(rgd): single regex-alternated cosign identity for tenant artifact verification#2408
Merged
Merged
Conversation
…ted cosign identity Same single-entry alternation as #2404 — cosign keyless attestation verification rejects multiple matchOIDCIdentity entries, so the RGD template must carry the alternation before any RGD tenant repoints its cd workflow to devantler-tech/actions. Fixes #2405 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe tenant ResourceGraphDefinition's cosign ChangesOIDC Identity Matcher Update
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
|
🎉 This PR is included in version 1.95.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
RGD-instantiated tenants pin artifact verification to the reusable-workflows signing identity. When those tenants repoint their cd workflows to devantler-tech/actions (the actions#425 train), verification would fail — and adding a second identity entry is exactly what froze the apps layer yesterday (#2399 → #2404), since cosign rejects multiple identities outright.
What
The RGD template now uses the same single regex-alternated subject as the merged #2404, accepting both repos in one entry. Narrow to actions-only later with the #2404 cleanup.
Fixes #2405 · Relates to #2402
Note: local-overlay validation green (492 files); prod-overlay
ksail workload validatehit the known kubeconform#363 render race repeatedly this session (shifting corruption lines in untouched helm-rendered CRDs) — kustomize builds of the affected layers pass.