From 4cd2d794f331599f0deb71fdd48d3f82e7fcf653 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 9 Nov 2026 10:23:48 +0100 Subject: [PATCH 1/2] fix(publish): approve the v20.1.12 publisher for organization settings Co-Authored-By: Claude Opus 5.5 --- .../apps/github-config/oci-repository.yaml | 2 +- .../publish-workflow-canonical-approvals.tsv | 2 +- ...test-publish-workflow-canonical-approvals.sh | 17 +++++++++-------- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml index 62158d067b..6aea11dd92 100644 --- a/k8s/bases/apps/github-config/oci-repository.yaml +++ b/k8s/bases/apps/github-config/oci-repository.yaml @@ -29,4 +29,4 @@ spec: # signer and this consumer's current publish-workflow pin in one identity. # Regeneration updates the pair and the approved set in the same PR. - issuer: '^https://token\.actions\.githubusercontent\.com$' - subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(57310dc609dcc8f9205f53c674ff17c5dc979b73|56ceec6717a1faa0686d865424cd2d1d45f18a0a))$' + subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(56ceec6717a1faa0686d865424cd2d1d45f18a0a|e6db1a4ed5b23ce6f69e755deeddd6649313e9dc))$' diff --git a/scripts/publish-workflow-canonical-approvals.tsv b/scripts/publish-workflow-canonical-approvals.tsv index 46d01363c5..863de76d12 100644 --- a/scripts/publish-workflow-canonical-approvals.tsv +++ b/scripts/publish-workflow-canonical-approvals.tsv @@ -1,8 +1,8 @@ consumer workflow repository commit aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42 aws publish-manifests devantler-tech/.github bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b -.github publish-manifests devantler-tech/.github 57310dc609dcc8f9205f53c674ff17c5dc979b73 .github publish-manifests devantler-tech/.github 56ceec6717a1faa0686d865424cd2d1d45f18a0a +.github publish-manifests devantler-tech/.github e6db1a4ed5b23ce6f69e755deeddd6649313e9dc ascoachingogvaner publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0 ascoachingogvaner publish-app devantler-tech/.github af042c540ce8db4d64add98c34b5c57691e0e812 business-site publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0 diff --git a/scripts/tests/test-publish-workflow-canonical-approvals.sh b/scripts/tests/test-publish-workflow-canonical-approvals.sh index ec78e5a96a..79d5aa4770 100755 --- a/scripts/tests/test-publish-workflow-canonical-approvals.sh +++ b/scripts/tests/test-publish-workflow-canonical-approvals.sh @@ -678,8 +678,9 @@ while IFS=$'\t' read -r expected issuer identity; do fail "github-config transition: expected $expected for $issuer $identity, got $result" fi done <<'IDENTITIES' -accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 +accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@e6db1a4ed5b23ce6f69e755deeddd6649313e9dc reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550 reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0f390329b590404c02565b27a263ee841fa02bce @@ -687,16 +688,16 @@ reject https://token.actions.githubusercontent.com https://github.com/devantler- reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@1d726483facb9340655489913f609082677be8f5 accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 -reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 -reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 -reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 -reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 -reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73 +reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a +reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a +reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@v12.0.1 reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@main -reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc -reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73-extra +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6 +reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a-extra IDENTITIES aws_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$REPO_ROOT/k8s/providers/hetzner/apps/aws/oci-repository.yaml")" From 57cf9defdbb3a47c842c64b4b62c18a4a567b645 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Mon, 9 Nov 2026 10:27:37 +0100 Subject: [PATCH 2/2] fix(publish): approve the rendered github-config source surface Co-Authored-By: Claude Opus 5.5 --- scripts/validate-eks-ci-role-policy/approved-surface.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/validate-eks-ci-role-policy/approved-surface.txt b/scripts/validate-eks-ci-role-policy/approved-surface.txt index 1ae0fa9b2c..555b63e4c1 100644 --- a/scripts/validate-eks-ci-role-policy/approved-surface.txt +++ b/scripts/validate-eks-ci-role-policy/approved-surface.txt @@ -452,7 +452,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771 -source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 58aab6e4ce4181956f2216193807c06a352921d001dbaa211fb99e33412ca250 +source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 4710e7bd62612c6e554e9ec7fc673465a6ef0442d8ff85d360eb3da20ecbbf70 source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38