[dependabot]

Bumps devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.12 to 20.1.17.

Release notes

Sourced from devantler-tech/.github/.github/workflows/publish-manifests.yaml's releases.

v20.1.17

20.1.17 (2026-11-09)

Bug Fixes

• deps: bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.6 to 20.1.12 (#884) (1a0eb6f)

v20.1.16

20.1.16 (2026-11-09)

Bug Fixes

• deps: bump oxsecurity/megalinter/flavors/go from 10.1.0 to 10.2.0 (#886) (f5e8988)

v20.1.15

20.1.15 (2026-11-09)

Bug Fixes

• deps: bump devantler-tech/.github/.github/workflows/apply-signed-fixes.yaml (#883) (81925e4)
• deps: bump zizmorcore/zizmor-action from 0.8.0 to 0.8.1 (#882) (cbff2c5)

v20.1.14

20.1.14 (2026-11-09)

Bug Fixes

• deps: bump actions/setup-dotnet in /actions/run-dotnet-tests (#885) (53ee68f)

v20.1.13

20.1.13 (2026-11-09)

Bug Fixes

• deps: bump actions/setup-dotnet from 6.0.0 to 6.1.0 (#881) (61a9821)

Commits

• 1a0eb6f fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.ya...
• f5e8988 fix(deps): bump oxsecurity/megalinter/flavors/go from 10.1.0 to 10.2.0 (#886)
• cbff2c5 fix(deps): bump zizmorcore/zizmor-action from 0.8.0 to 0.8.1 (#882)
• 81925e4 fix(deps): bump devantler-tech/.github/.github/workflows/apply-signed-fixes.y...
• 53ee68f fix(deps): bump actions/setup-dotnet in /actions/run-dotnet-tests (#885)
• 61a9821 fix(deps): bump actions/setup-dotnet from 6.0.0 to 6.1.0 (#881)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-code-quality]

Code coverage overview

Languages: Go

Go / code-coverage/test

main 9ba5734	dependabot/github_ac... 50e0886	+/-
50%	50%	0%

Go / code-coverage/go

main 9ba5734	dependabot/github_ac... 50e0886	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 10, 2026 15:42 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: none

Cleared 2026-11-10: Platform #6004 merged and Flux reports the deployed signer approval reconciled and verified. The signed caller update passed the local publication contract tests. GitHub checks are due on the new draft head.

Previous record (historical):

> 🤖 Generated by the Agentic Engineer

<!-- pr-blocker-record -->

**Blocker:** devantler-tech/platform#6004 | upstream | last-verified 2026-11-10: `test-publish-contracts` refuses this bump on purpose. The publisher's signer revision moves from `e6db1a4e` (v20.1.12) to `1a0eb6f1` (v20.1.17), and no consumer approves that revision yet. The content-review half of the guard passes: the publishing workflow and its two helper scripts are byte-identical between the two revisions, so only the signer identity moves. platform#6004 approves `1a0eb6f1` next to `e6db1a4e`.

Re-entry: once platform#6004 has merged and the live `github-config` source still reads Ready, convert this PR to draft, disable auto-merge, record `1a0eb6f1` as `approved_publisher_revision` in `check-manifests-caller.sh`, run the caller check and `test-publish-manifests-promotion.sh`, get a review at that head, and promote.

[devantler]

🤖 Generated by the Agentic Engineer

@codex review

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-10T17:18:19.683853Z	50e0886	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 50e0886e23

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 50e0886e23c6d883155e25d23408af542dd46ff7

• Upstream release review (v20.1.12 → v20.1.17). The range is 6 commits, all dependency bumps (setup-dotnet, zizmor-action, megalinter, apply-signed-fixes, an earlier publish-manifests bump). .github/workflows/publish-manifests.yaml is byte-identical at both revisions (blob ce6ed49062b44b56379c408c8c785a542cff533f, which matches the pinned reviewed_workflow_blob). So nothing new needs adopting or adapting in this repository. The only effective change is the signer identity, because the revision is part of the certificate identity.
• Adaptation. The signer approval was deployed and read back on the consumer side first (platform#6004, recorded in the blocker record above). After that, approved_publisher_revision moved to the new revision, as the caller-check comment requires.
• Checks. Every check at this head is green, including CI - Required Checks, the publish contract tests, zizmor, CodeQL and dependency review.
• Review. Codex review is clean at this head (50e0886e23). CodeRabbit does not review bot-authored PRs. There are no unresolved threads.
• Tried as a user. The thing a user would hit is the CD publication step. It now calls the same workflow bytes under a signer that the consumer already trusts and has deployed. The caller guard (check-manifests-caller.sh) passes at this head.

Promoting and merging at this exact head.