verify-app-images: accept the cosign identity of provider-upjet-unifi packages (companion to provider signing) #2383

🤖 Generated by the Daily AI Assistant

Problem

The verify-app-images ImageValidatingPolicy denies unsigned ghcr.io/devantler-tech/* images — correct — but our own provider-upjet-unifi xpkg is published unsigned (crossplane-contrib publish-provider.yml = plain crane copy), so on prod its ReplicaSet hits FailedCreate, the ProviderRevision reports RUNTIME=False, and the merged UniFi Crossplane migration (unifi#9 / platform#2332) cannot reconcile its MRs.

Proposed direction

Signing is fixed at the source: provider-upjet-unifi#13 adds keyless cosign signing to the publish workflow. This issue tracks the platform half: extend the policy's attestor subjectRegExp to accept that repo's workflow OIDC identity. Do not resolve by excluding the image from verification (weakens the supply-chain gate).

Rough size

S — one regexp change in the IVP, after #13 lands; verify the ProviderRevision goes RUNTIME=True on prod.