Repository navigation
Attribute canonical manifest publishers in the signing report #4678
Description
🤖 Generated by the Agentic Engineer
Problem
Platform main validation cannot attribute the publisher of a successfully published manifest release. Validate Main run 37860898334 examined four consumers and failed with one unresolved consumer, .github.
The run records successful publication of .github v7.8.5. Its reviewed cd.yaml calls the canonical .github manifest publisher at 2fa404276b0ce5c0527683b080e39045045c4e42. pin_at_ref in scripts/report-publish-workflow-signing-revisions.sh at Platform main dbba472b925bb1e88f5bc821c9aedce7fc420ccb accepts only the legacy actions publisher, so it cannot resolve that release.
Required outcome
Attribute both supported publisher families with an explicit repository and workflow identity. Preserve legacy compatibility and the existing approved-revision boundary. Add RED/GREEN cases for a canonical release, retained legacy releases, ambiguous callers and unresolved publication evidence. Keep incomplete evidence failing closed.
A successful publication and a passing attribution report do not prove production adoption or signature acceptance. Those remain separate gates under #4502. This issue requires a source repair and current-main CI proof; regenerating approvals alone does not fix the resolver.
Activity
chore: agent-claim #4678 nonce=a8d2b928c5f97aca1c83e7d38caf160a
devantler commentedon Oct 9, 2026
#4679 merged through the protected queue at reviewed head
dac3d23322724de1bc9d3437477c77afda3cb13d; merge commitce0be3613fb2b3e9176f671308cc3f5b22c7f3ec. The required merge-group CI passed.Current-main acceptance is confirmed by the successful Validate Shared Publish Workflow Pins job on that merge commit. Its report examined four consumers, with two reported divergences and zero unresolved. The canonical
.githubpublisher is correctly attributed as IN-SYNC; the existing divergences remain visible rather than being hidden.The source repair covers canonical and legacy manifest publishers, keeps publisher families distinct, rejects duplicate and ambiguous callers, and preserves the legacy approval generator. The reviewed regression suite includes the duplicate-call negative control.
This completes this issue's source repair and current-main attribution proof. It does not establish production adoption or signature acceptance; #4502 remains separate. The overall Validate Main run still has other work pending, so this is a receipt for the attribution job, not a claim that the entire workflow or platform is healthy.