[dependabot]

Bumps devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.1.6 to 20.1.12.

Release notes

Sourced from devantler-tech/.github/.github/workflows/publish-manifests.yaml's releases.

v20.1.12

20.1.12 (2026-11-08)

Bug Fixes

• todo-guard: serve push diffs above the 16 MiB JSON bound (#879) (e6db1a4)

v20.1.11

20.1.11 (2026-11-07)

Bug Fixes

• deps: bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.0.3 to 20.1.6 (#877) (ea4d0d8)

v20.1.10

20.1.10 (2026-11-07)

Bug Fixes

• supply-chain: census every version pin and run stale-repos by digest (#873) (15372ea), closes #627

v20.1.9

20.1.9 (2026-11-07)

Bug Fixes

• go: route the go command's work directory to the runner disk (#871) (ced8fbc), closes #838

v20.1.8

20.1.8 (2026-11-07)

Bug Fixes

• auto-merge: retain pending evaluations on every run (#872) (6aa4884), closes #741 #277

v20.1.7

20.1.7 (2026-11-06)

Bug Fixes

• deps: bump devantler-tech/.github/.github/workflows/apply-signed-fixes.yaml (#878) (66b5246)

Commits

• e6db1a4 fix(todo-guard): serve push diffs above the 16 MiB JSON bound (#879)
• ea4d0d8 fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.ya...
• 15372ea fix(supply-chain): census every version pin and run stale-repos by digest (#873)
• ced8fbc fix(go): route the go command's work directory to the runner disk (#871)
• 6aa4884 fix(auto-merge): retain pending evaluations on every run (#872)
• 66b5246 fix(deps): bump devantler-tech/.github/.github/workflows/apply-signed-fixes.y...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-code-quality]

Code coverage overview

Languages: Go

Go / code-coverage/test

main f5e8988	dependabot/github_ac... 4796e5d	+/-
50%	50%	0%

Go / code-coverage/go

main f5e8988	dependabot/github_ac... 4796e5d	+/-
50%	50%	0%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 09, 2026 12:32 UTC}

[devantler]

🤖 Generated by the Agentic Engineer

Blocker: devantler-tech/platform#5951 | upstream | last-verified 2026-11-09: test-publish-contracts refuses this bump on purpose. The publisher's signer revision moves from 56ceec67 (v20.1.6) to e6db1a4e (v20.1.12), and no consumer approves that revision yet. Between the two revisions the publishing workflow and its helper scripts are unchanged; only the signer identity moves. platform#5951 approves e6db1a4e next to 56ceec67.

Re-entry: once #5951 has merged and the live github-config source still reads Ready, adapt this branch by recording e6db1a4e as approved_publisher_revision in check-manifests-caller.sh. Then run the caller check and test-publish-manifests-promotion.sh, get a review at that head, and promote.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

Action not completed

Review skipped.

[coderabbitai]

Important

Review skipped

This PR was authored by a bot without an assigned CodeRabbit review seat. Ask an organization administrator to assign a seat to the bot. See the seat-assignment guide. After the seat is assigned, request a review again.

Run configuration

• Source mode: Auto
• Repository: devantler-tech/.github
• Branch: main
• File: .coderabbit.yaml
• Commit: f5e8988
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 4656db41-1eab-4f6d-b751-8011c62034ac

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 4796e5d1b0e2d34b2989bfa7590676a93993e131

• CodeRabbit: skipped this request at 2026-11-09T12:29Z ("authored by a bot without an assigned CodeRabbit review seat").
• Codex: usage-limited since 2026-11-09T06:06Z.
• Cursor Bugbot: usage-limited since 2026-11-09T06:09Z.

What I checked

• The diff against main is two lines: cd.yaml moves the publisher pin from 56ceec67 (v20.1.6) to e6db1a4e (v20.1.12), and check-manifests-caller.sh records e6db1a4e as the approved signer revision.
• Approval came first, as the check's own comment requires: platform#5951 (merged 11:45Z) approves e6db1a4e next to 56ceec67, and the live github-config source reads Ready.
• The content gate is unchanged and still enforced: the three reviewed blob hashes are untouched, and check-manifests-caller.sh .github/workflows/cd.yaml passes at this head, so the workflow and both helper scripts at e6db1a4e are byte-identical to the reviewed ones.
• test-publish-manifests-promotion.sh passes locally, so the check still refuses a missing control, a moving ref and the wrong workflow family.
• No permission, trigger or secret handling changes.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 4796e5d1b0e2d34b2989bfa7590676a93993e131

• Upstream release review (v20.1.6 → v20.1.12): the earlier comment on this PR covers it; between the two revisions the publishing workflow and its two helper scripts are byte-identical, and only the signer identity moves.
• Adaptation: the one-line approval of e6db1a4e in check-manifests-caller.sh, made only after platform#5951 (consumer approval) merged and the live github-config source read Ready.
• Tested: check-manifests-caller.sh .github/workflows/cd.yaml and test-publish-manifests-promotion.sh pass locally; in CI, test-publish-contracts (the guard that refused this bump before) now passes, and every required check is green.
• Tried as a user: the user here is the CD caller. Its gate, run against this head's cd.yaml, accepts the new pin with reviewed contents and verified promotion, and still refuses a missing control, a moving ref and the wrong workflow family.
• Review: local review round 5826097799 is clean at this head (CodeRabbit skipped a bot-authored PR; Codex and Bugbot are usage-limited).
• After merge: the next release run publishes github-config under the new signer; confirm the live source stays Ready.