From d44be28a13a782564dd00e1bc491c42c89dcfc65 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 11 Nov 2026 08:15:37 +0000 Subject: [PATCH 1/2] fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml Bumps [devantler-tech/.github/.github/workflows/publish-manifests.yaml](https://github.com/devantler-tech/.github) from 20.1.17 to 21.0.1. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](https://github.com/devantler-tech/.github/compare/1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123...933b53600c15fe7a67189756307cb19e23090c99) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/publish-manifests.yaml dependency-version: 21.0.1 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 9fda26f6..7457525a 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -39,7 +39,7 @@ jobs: # Keep the exact consumer-approved revision, not merely a 40-hex shape or # byte-identical publisher. CI requires separate signer and content approval; # deploy and read back consumer approval BEFORE changing this identity. - uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123 # v20.1.17 + uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@933b53600c15fe7a67189756307cb19e23090c99 # v21.0.1 with: oci-name: devantler-tech/github-config # The publisher refuses mutable signing refs. Consumer approval of the exact From 419a0dbb2d5e71d8782e76a6ca257c07e0f0dce5 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Wed, 11 Nov 2026 13:21:46 +0100 Subject: [PATCH 2/2] fix(cd): approve the v21.0.1 manifests publisher signer revision The platform github-config OCIRepository already accepts the 933b536 publish-manifests identity (read back live), and the publisher workflow and helper blobs are unchanged, so only the approved revision moves. Co-Authored-By: Claude Opus 5.5 --- .github/scripts/check-manifests-caller.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/check-manifests-caller.sh b/.github/scripts/check-manifests-caller.sh index a0f04881..fb754932 100644 --- a/.github/scripts/check-manifests-caller.sh +++ b/.github/scripts/check-manifests-caller.sh @@ -24,7 +24,7 @@ yq -e ' # Byte equivalence is not signer equivalence: the revision is part of the certificate # identity. Update this revision only AFTER consumer approval has been deployed and # read back. Content and file-mode review remain independently required. -approved_publisher_revision='1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123' +approved_publisher_revision='933b53600c15fe7a67189756307cb19e23090c99' reviewed_workflow_blob='ce6ed49062b44b56379c408c8c785a542cff533f' reviewed_absence_blob='3566e4067e953a1d9cb34e6a50a0f9b72a5d8bc8' reviewed_recovery_blob='48dc38f60ddebf90b0976758df9f1983bbb86bfd'