Repository navigation
Approve configuration publisher v13.2.11 before moving its caller #770
Description
🤖 Generated by the Agentic Engineer
Objective
Move the shared configuration publisher to a maintained release only after its exact signing identity is reviewed, approved by its consumers, and normally deployed. Keep configuration publication working throughout the transition.
Details
Dependency PR #767 changes only the configuration caller from the approved v10.0.3 revision 0f390329b590404c02565b27a263ee841fa02bce to v13.2.11 revision c2b06a1ac224a57750cd66aec571701c4b546b30.
At PR head e607874bde9053163c608a3634a98300322ec21c, native CI 40292551914 refuses the change because the proposed signer revision lacks the recorded consumer approval. This is a correct failure of the existing publication guard, not a transient runner failure. The current main caller remains on its approved revision.
Checklist
- Review the configuration publisher and relevant helper/dependency changes between the approved revision and the proposed maintained release; record the exact candidate and applicability.
- Prepare the existing consumer approval through its owning GitOps source. Preserve exact repository/workflow/revision matching and existing signatures; do not broaden the accepted identities or hand-edit generated observations.
- Complete protected deployment and independently read back the exact consumer approval before changing the caller or its recorded approval revision.
- Update the caller and recorded approval together through normal reviewed delivery. Keep the real caller contract and unapproved/mutable/wrong-family negative controls passing.
- Verify current-head CI, exact-head review, protected merge, and successful configuration publication/reconciliation. Retire the previous identity only with separate evidence that existing artifacts no longer need it.
Dependencies
This is the prerequisite for #767. Part of #287. No runtime or security bypass is requested; the present approved publisher stays in use until the replacement is proven.
Notes
Chore; medium priority and medium effort. The normal PR queue and downstream capacity govern implementation; this issue does not start a competing consumer rollout.
Activity
devantler commentedon Oct 29, 2026
The maintained-caller candidate is now #803, which Dependabot refreshed to v17.0.1 at head
93eb0f041fcd3b3b4604c409435a5bb5682c0c3b. It supersedes the older #767 candidate described above. The shared jq and capacity-observation defects are delivered through #801, so they no longer explain its CI result.Current native CI 40871898009, publication-contract job
123441321386, correctly refuses unreviewed publisher content at source737bb3ba152ce792aec87a451628323893deb7b5. The existing recorded publisher-content and exact deployed-identity approval must be completed for the actual maintained candidate before its caller can move. Review the full approved-to-candidate release range and content/modes, use the owning GitOps approval path, independently read back deployment, then update caller and recorded approval together. The passing v17.0.1/v17.0.2 configuration publications still use the old approved publisher identity; they do not approve the proposed replacement. No guard was weakened or approval value changed.devantler commentedon Nov 1, 2026
The maintained configuration-publisher cutover is complete through #818, protected merge
56400cc9a05163b18ef330607532d24d583acbd4. It adopted the reviewed v19.0.3 publisherbd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6bafter Platform #5620 deployed its exact consumer approval. The recorded signer, reviewed publisher content and immutable caller pin agree. The earlier v13.2.11 and v17.0.1 candidates are superseded; no additional migration to either is needed.Native post-merge CI and publication succeeded. Current main
12c06e4c778e3b4aa67459db0ae50889f8790ba0also has successful CI and publication, retaining that approved publisher.Independent read-only consumer verification at 23:04 UTC confirms the exact publisher identity is accepted, the current 19.0.7 artifact is Ready and SourceVerified at the observed generation, and its unsuspended reconciliation has applied the same artifact revision. This proves consumption as well as publication. Existing historical signer acceptance is retained; its retirement still requires separate artifact evidence and is not claimed here.
Closing this completed publisher-update task.