Repository navigation
fix(ci): restore the approved manifests publisher - #61
Conversation
Current signed head Reviewed every catalogue release from v7.2.11 through v12.0.2 and the complete publisher/helper source comparison. Catalogue governance, repository management, cleanup, Go/.NET validation, reusable-export retirement and release-recovery interface changes do not execute in this caller. The manifests publisher itself differs only in harden-runner 2.21.1→2.22.1 and Flux 2.9.5→2.9.6 pins; both copied publication helpers are unchanged. Restoring the approved signer therefore deliberately retains those older tools until separate signer approval. The harden-runner releases add ARM64, GHES and non-Linux block-mode support/fixes, outside this hosted Linux amd64 audit-mode caller. Flux 2.9.6 fixes controllers; this job uses only its CLI to package/push manifests. No identified lost fix affects this caller; no signature, issuer or version check is relaxed. Sources: catalogue releases, harden-runner 2.22.0, 2.22.1, Flux 2.9.6. The real deployment package renders successfully. Current-head CI has completed successfully, including Crossplane schema checks, documentation-link negative controls, Actions analysis and workflow security checks. Focused correctness/security and scope review found no additional issue in the four-line diff. This source-only caller configuration has no local service surface; its actual effect is to select the already approved immutable publisher. Actual release/signing and complete observation regeneration will be checked after protected delivery. This does not approve a newer signer or claim publication has happened. |
@coderabbitai full review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the main change: restoring the approved manifests publisher in CI. |
| Description check | |
The description explains why the approved publisher must be restored and states that newer-publisher approval remains part of the platform migration. |
| Linked Issues check | |
Issue #60 requires restoring the approved manifests publisher reference in the CD caller. The reviewed head sets .github/workflows/cd.yaml to `devantler-tech/.github/.github/workflows/publish-manife… |
| Out of Scope Changes check | |
The PR summary reports one changed file, .github/workflows/cd.yaml, with +3/-1 lines. The change replaces the reusable publish-manifests pin and adds a comment that explains the retained signer. The… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
Full details: Linked Issues check
-
Explanation
Issue
#60requires restoring the approved manifests publisher reference in the CD caller. The reviewed head sets.github/workflows/cd.yamltodevantler-tech/.github/.github/workflows/publish-manifests.yaml@2fa404276b0ce5c0527683b080e39045045c4e42 # v7.2.10. The adjacent comment records the reason: keep the consumer-approved signer until platform#5267 verifies its replacement. The PR summary says the previous pin was v12.0.2 and that caller inputs and permissions are unchanged. This meets the 'restore only the CD publisher reference, with the reason recorded beside it' criterion and the 'preserve safeguards' expectation, as far as the summary and head file show. Coding-related criteria are covered: the publisher and helper comparison is documented in the PR comment, and the package render and current-head CI are reported as successful. Release, signed publication, and genuine platform observation are post-merge operational checks, not coding requirements for this PR. Limitation: the base blob for cd.yaml could not be read, so the previous pin was confirmed only from the PR summary.
Full details: Out of Scope Changes check
-
Explanation
The PR summary reports one changed file,
.github/workflows/cd.yaml, with +3/-1 lines. The change replaces the reusable publish-manifests pin and adds a comment that explains the retained signer. The head file contents match this description and contain no other edits to the job. No unrelated workflow, dependency, or permission change is reported. Limitation: the whole-PR text diff could not be read because the base blob forcd.yamlis unavailable in the checkout, so the scope check relies on the PR summary and the head file.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Ready at signed head The required-gate reader retains configured native |
Protected merge confirmed: reviewed source head Independently verified the released manifests digest with Cosign, the exact approved workflow identity and GitHub’s OIDC issuer. Read-only runtime observation shows the same 1.1.5 artifact applied. No platform approval or verification rule changed. The AWS caller recovery is observed; complete five-consumer regeneration and its stable repeat still await the Khoist recovery under platform#5267. |
Why
The publishing workflow moved ahead of the platform’s approved signing identities, preventing complete release observations.
What
Restore the previously approved publisher so release observations can complete. Approval of a newer publisher stays with the platform migration.
Related: devantler-tech/platform#5267
Fixes #60