From 9803cb0fbddb9a78ece7721a30d60430592ac68e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 9 Nov 2026 08:24:09 +0000 Subject: [PATCH 1/2] fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml Bumps [devantler-tech/.github/.github/workflows/publish-manifests.yaml](https://github.com/devantler-tech/.github) from 20.1.6 to 20.1.12. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](https://github.com/devantler-tech/.github/compare/56ceec6717a1faa0686d865424cd2d1d45f18a0a...e6db1a4ed5b23ce6f69e755deeddd6649313e9dc) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/publish-manifests.yaml dependency-version: 20.1.12 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- .github/workflows/cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 121790b0..12ed6b51 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -39,7 +39,7 @@ jobs: # Keep the exact consumer-approved revision, not merely a 40-hex shape or # byte-identical publisher. CI requires separate signer and content approval; # deploy and read back consumer approval BEFORE changing this identity. - uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a # v20.1.6 + uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc # v20.1.12 with: oci-name: devantler-tech/github-config # The publisher refuses mutable signing refs. Consumer approval of the exact From 4796e5d1b0e2d34b2989bfa7590676a93993e131 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 9 Nov 2026 13:28:16 +0100 Subject: [PATCH 2/2] fix(ci): approve the v20.1.12 publisher signer revision Platform now approves e6db1a4e alongside 56ceec67 (platform#5951, deployed, github-config Ready), so the caller check may record it. Co-Authored-By: Claude Opus 5.5 --- .github/scripts/check-manifests-caller.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/scripts/check-manifests-caller.sh b/.github/scripts/check-manifests-caller.sh index b4142d82..880a0683 100644 --- a/.github/scripts/check-manifests-caller.sh +++ b/.github/scripts/check-manifests-caller.sh @@ -24,7 +24,7 @@ yq -e ' # Byte equivalence is not signer equivalence: the revision is part of the certificate # identity. Update this revision only AFTER consumer approval has been deployed and # read back. Content and file-mode review remain independently required. -approved_publisher_revision='56ceec6717a1faa0686d865424cd2d1d45f18a0a' +approved_publisher_revision='e6db1a4ed5b23ce6f69e755deeddd6649313e9dc' reviewed_workflow_blob='ce6ed49062b44b56379c408c8c785a542cff533f' reviewed_absence_blob='3566e4067e953a1d9cb34e6a50a0f9b72a5d8bc8' reviewed_recovery_blob='48dc38f60ddebf90b0976758df9f1983bbb86bfd'