Skip to content

fix(publish): approve the v21.0.1 publisher for organization settings #6064

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 1 commit into from
Nov 11, 2026
Merged

fix(publish): approve the v21.0.1 publisher for organization settings #6064

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion k8s/bases/apps/github-config/oci-repository.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,4 @@ spec:
# signer and this consumer's current publish-workflow pin in one identity.
# Regeneration updates the pair and the approved set in the same PR.
- issuer: '^https://token\.actions\.githubusercontent\.com$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(e6db1a4ed5b23ce6f69e755deeddd6649313e9dc|1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123))$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123|933b53600c15fe7a67189756307cb19e23090c99))$'
2 changes: 1 addition & 1 deletion scripts/publish-workflow-canonical-approvals.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
consumer workflow repository commit
aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42
aws publish-manifests devantler-tech/.github bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b
.github publish-manifests devantler-tech/.github e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
.github publish-manifests devantler-tech/.github 1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
.github publish-manifests devantler-tech/.github 933b53600c15fe7a67189756307cb19e23090c99
ascoachingogvaner publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0
ascoachingogvaner publish-app devantler-tech/.github af042c540ce8db4d64add98c34b5c57691e0e812
business-site publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0
Expand Down
17 changes: 9 additions & 8 deletions scripts/tests/test-publish-workflow-canonical-approvals.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -680,25 +680,26 @@ while IFS=$'\t' read -r expected issuer identity; do
done <<'IDENTITIES'
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@933b53600c15fe7a67189756307cb19e23090c99
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0f390329b590404c02565b27a263ee841fa02bce
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@8d2203af130a8c27b8b98b3d7146f76b5ade7a98
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@1d726483facb9340655489913f609082677be8f5
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328
reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc
reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@v12.0.1
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@main
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc-extra
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@1a0eb6f
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@1a0eb6f18b88a7816b91cbf692b8ad8ea9a08123-extra
IDENTITIES

aws_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$REPO_ROOT/k8s/providers/hetzner/apps/aws/oci-repository.yaml")"
Expand Down
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -462,7 +462,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen

source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771

source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config f9bd2c474ca3b3c33c5f7c88e41d0e3157f211704d2bfc82dd537f9fc52e0910
source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config f473a2dc6febfa488f5ca59374ebeb704a82f21f39d2f7f3329215caf859c700

source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38

Expand Down
Loading