From 26b1885a3cd9373213f8a0a08f1bcf6a482a9260 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 30 Oct 2026 08:16:58 +0000 Subject: [PATCH 1/2] fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml Bumps [devantler-tech/.github/.github/workflows/publish-manifests.yaml](https://github.com/devantler-tech/.github) from 10.0.3 to 19.0.0. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](https://github.com/devantler-tech/.github/compare/0f390329b590404c02565b27a263ee841fa02bce...2082a0ac4616cf809fadc0ce737a91641358eb07) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/publish-manifests.yaml dependency-version: 19.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 82cad8db..07628501 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -39,7 +39,7 @@ jobs: # Keep the exact consumer-approved revision, not merely a 40-hex shape or # byte-identical publisher. CI requires separate signer and content approval; # deploy and read back consumer approval BEFORE changing this identity. - uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@0f390329b590404c02565b27a263ee841fa02bce # v10.0.3 + uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@2082a0ac4616cf809fadc0ce737a91641358eb07 # v19.0.0 with: oci-name: devantler-tech/github-config # The publisher refuses mutable signing refs. Consumer approval of the exact From 8c381c3851383aa25d779863abec58b2f007c93a Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sat, 31 Oct 2026 17:38:42 +0100 Subject: [PATCH 2/2] fix(deps): pin the consumer-approved v19.0.3 manifests publisher The platform deployed approval for this exact signer in platform#5620 and the live OCIRepository subject reads it back. The workflow gains only a job timeout and two newer pinned actions; its two helper scripts are byte-identical. Co-Authored-By: Claude Opus 5.5 --- .github/scripts/check-manifests-caller.sh | 4 ++-- .github/workflows/cd.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/scripts/check-manifests-caller.sh b/.github/scripts/check-manifests-caller.sh index 78c57712..442f431f 100644 --- a/.github/scripts/check-manifests-caller.sh +++ b/.github/scripts/check-manifests-caller.sh @@ -24,8 +24,8 @@ yq -e ' # Byte equivalence is not signer equivalence: the revision is part of the certificate # identity. Update this revision only AFTER consumer approval has been deployed and # read back. Content and file-mode review remain independently required. -approved_publisher_revision='0f390329b590404c02565b27a263ee841fa02bce' -reviewed_workflow_blob='ce9a9897b154486218478734a02c61e5ac3ea479' +approved_publisher_revision='bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b' +reviewed_workflow_blob='a035ba3dc4713178219a9cc7faf523989eb7b684' reviewed_absence_blob='3566e4067e953a1d9cb34e6a50a0f9b72a5d8bc8' reviewed_recovery_blob='48dc38f60ddebf90b0976758df9f1983bbb86bfd' source_remote='https://github.com/devantler-tech/.github.git' diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 07628501..781b9304 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -39,7 +39,7 @@ jobs: # Keep the exact consumer-approved revision, not merely a 40-hex shape or # byte-identical publisher. CI requires separate signer and content approval; # deploy and read back consumer approval BEFORE changing this identity. - uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@2082a0ac4616cf809fadc0ce737a91641358eb07 # v19.0.0 + uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b # v19.0.3 with: oci-name: devantler-tech/github-config # The publisher refuses mutable signing refs. Consumer approval of the exact