Repository navigation
Complete the reviewed v19.0.5 application-publisher migration #5404
Description
🤖 Generated by the Agentic Engineer
Current migration
Complete the application-publisher migration to the reviewed v19.0.5 revision af042c540ce8db4d64add98c34b5c57691e0e812. This is the selected replacement recorded in the range review below and merged Platform #5422. The separate v12/v13 request #5275 and v17.1.1 request #5595 are superseded by this one migration; those abandoned revisions do not each need a new approval.
The protected-source change is not the complete rollout. Keep this issue open until the deployed approval and actual consumer results are verified. #5424 retains signer-retirement and applied-identity evidence, including the inventory refresh #5687.
Remaining acceptance
- Preserve the complete publisher/helper range review and migration analysis already recorded in this thread.
- Verify protected delivery and the deployed approval for the selected immutable revision. Retain the two-revision bound and rejection controls for unapproved revisions, tags, branches and unrelated sources.
- Finish Retire the v7.23.0 app publisher signer so the generic boundaries can admit v13.2.15 #5424's applied-signer inventory and verified-consumer evidence.
- Revalidate the starter's actual Platform Admissibility job and AS Coaching's actual Publish Pin Approved job at the consumer head that adopts the selected revision. Current updates are ci(deps): bump the devantler-tech-actions group across 1 directory with 5 updates platform-tenant-template#272 and ci(deps): bump the devantler-tech-actions group across 1 directory with 4 updates ascoachingogvaner#354; both currently propose v19.0.3, so they do not inherit v19.0.5 approval.
- Complete remaining native CI, substantive review and protected merge for the adopting consumer updates. Verify their resulting publication and deployed source instead of treating an approval-list edit as delivery.
- Reconcile the older build(deps): adopt the approved application publisher 19.0.5 business-site#370 proposal with the selected revision and verify the adopted business-site release reaches Ready and SourceVerified.
- When KHoist adopts the selected publisher, move its pin and remove the temporary publisher-update ignore introduced by fix(ci): restore the approved application publisher again khoist#500 in the same change; preserve its required validation and publication proof.
This consolidates tracking and preserves the outstanding work. It grants no additional publisher identity, permission or merge exception.
Original request and historical target
Evidence
- Dependabot is moving application consumers to the shared application publisher v13.2.15 (
devantler-tech/.github/.github/workflows/publish-app.yaml@f5d078cc4b04ecb15432ed4e34cba1142a6279d4). Open updates: build(deps): adopt the approved application publisher 19.0.5 business-site#370 and ci(deps): bump the devantler-tech-actions group across 1 directory with 5 updates platform-tenant-template#264. wedding-app, ascoachingogvaner and data-product-controller will get the same update. - Platform accepts only the earlier revisions. The
business-siterow inscripts/publish-workflow-canonical-approvals.tsvnames467f07582436a26b62cf4aa756423512f85ba0c0(v8.0.0), and so does the business-site tenant'spublisherRevision. On platform-tenant-template#264, the requiredPlatform Admissibilitycheck fails with "Platform KRO Tenant does not accept the starter's exact pinned publisher". - Measured in the range
467f0758…f5d078cc(52 commits):publish-app.yamlchanges, and so do its checked-outprepare-prebuilt-webapp.shhelper and that helper's test. Between v13.2.13 (2df24600…, the revision Approve KHoist's current immutable application publisher #5377 reviewed for KHoist) and v13.2.15, the only change topublish-app.yamladdstimeout-minutes: 60to the publish job.
Audience / problem
Tenant owners, plus the site and apps that publish through this workflow. Until Platform approves the exact revision, each update has to be held. Merging one anyway means its next release is signed by a workflow the cluster refuses to verify, and the app silently stops updating.
Hypothesis
If Platform reviews the publisher range and approves f5d078cc… through the existing approval path, the held updates can merge. That path is the approvals table, the generated consumer matchers, the tenant publisherRevision, and the admission and node-pull rules. Any other commit stays refused.
Success signal
The Platform Admissibility check on platform-tenant-template#264 passes after a re-run. A business-site release published from f5d078cc reaches Ready/SourceVerified on its live Flux source.
Smallest useful change
- Review the publisher range from the approved revisions to
f5d078cc. That covers the workflow and the prebuilt-WebApp helper it checks out. Reuse Approve KHoist's current immutable application publisher #5377's review of v13.2.13 where it already covers the same files. - Add
f5d078cc…to the approvals for each consumer that is moving, then regenerate the derived matchers.
Acceptance criteria
- Range review recorded on this issue.
- The approval tests accept
f5d078cc…and still reject unapproved, tag and branch identities. - platform-tenant-template#264
Platform Admissibilityis green; business-site#370 can be promoted.
Rough size: S–M (same shape as #5214).
Activity
devantler commentedon Oct 27, 2026
Range review: publisher
467f0758…f5d078cc(v8.0.0 → v13.2.15)The comparison covers 52 commits and 194 files. The list is complete, because GitHub's compare API stops at 300 files and this range has fewer.
publish-app.yamlchecks out the workflow repository atjob.workflow_shaand copies three helpers from it:require-unpublished-version.sh,recover-app-version.shandprepare-prebuilt-webapp.sh. Within this range, only the following run as part of publishing:publish-app.yaml: the publish job getstimeout-minutes: 60(chore(deps): update helm release open-webui to v5 #771), andstep-security/harden-runnermoves from v2.22.1 to v2.22.2, still pinned to a full commit (chore(deps): update helm release ollama to v1 #768). Permissions, the signing identity, inputs and outputs are unchanged.prepare-prebuilt-webapp.sh(chore(deps): update all non-major dependencies #766): the CI-run read stays credential-free. It now retries a 403 or 429 rate-limit refusal up to three times, within 120 seconds in total. It honoursretry-afterandx-ratelimit-reset, rejects duplicated headers, and still validates the complete original CI identity afterwards. Any other failure still fails closed.require-unpublished-version.shandrecover-app-version.share unchanged.None of the other 191 files is executed by the publisher.
Verdict: safe to admit. Nothing in the range widens what the publisher may do or what it signs.
First slice: the generic Tenant, admission and node-pull boundaries now accept
f5d078cc(draft PR to follow). Per-consumer approval rows and the business-site tenant pin will move when each consumer adopts this revision.chore: agent-claim #5404 nonce=da6b5b9d69a361a03ab480af251ca42a
devantler commentedon Oct 27, 2026
Draft #5422 adds
f5d078ccat the generic boundaries, but the repository guard refused it: those boundaries admit at most two exact maintained publisher revisions, and both current ones still sign deployed artifacts (v7.23.0 for wedding-app and ascoachingogvaner, v8.0.0 for business-site). The prerequisite is tracked in #5424. Once v7.23.0 no longer signs anything deployed, #5422 will replace it rather than add a third revision. The guard stays as it is. #5422 is parked on #5424.devantler commentedon Oct 27, 2026
Fresh read-only range review for
f5d078cc4b04ecb15432ed4e34cba1142a6279d4, while the existing business-site deliveries complete their final checks:467f07582436a26b62cf4aa756423512f85ba0c0…f5d078cc4b04ecb15432ed4e34cba1142a6279d4returns all 52 commits and 194 changed files, below the comparison file bound. The executable publisher closure remains the workflow plus its three literal, same-revision checked-out helpers.require-unpublished-version.shandrecover-app-version.share unchanged. The changed closure ispublish-app.yaml,prepare-prebuilt-webapp.shand its maintained test.job.workflow_repository/job.workflow_shafor the helper checkout and copies only those three helpers before removing the checkout. The approved-base workflow delta is the immutable harden-runner v2.22.2 pin and a 60-minute publish-job timeout. Permissions, signing, caller pinning, public/private build paths, other action pins and publication concurrency are unchanged.2df24600b1113e291b87e300b91e59c160446134…f5d078cc4b04ecb15432ed4e34cba1142a6279d4comparison returns two commits / 22 changed files; its only publisher-closure change addstimeout-minutes: 60. Thus Approve KHoist's current immutable application publisher #5377's recorded range analysis applies to the same helper/action change. Approve KHoist's current immutable application publisher #5377 was closed not planned after its original caller withdrew the update; it did not deliver this approval.No approval row, generated matcher, tenant revision, admission rule or node-pull rule was changed. #5404 remains open for the normal owned implementation, refusal controls, substantive review, protected deployment and actual consumer acceptance. Business-site #370 remains held; this note is not permission to merge it first.
devantler commentedon Nov 1, 2026
Range review for
f5d078cc…af042c54(v19.0.5), on top of the earlier467f0758…f5d078ccreview. The comparison returned all 31 commits and 181 files, and only two files in the publisher's closure changed:publish-app.yaml:docker/login-actionmoves from v4.6.0 to v4.7.0 by digest. No permission, signing or output change.prepare-prebuilt-webapp.sh: adds an explicitjob-tokenmode for reading public CI evidence. The default stays anonymous, and an anonymous run carrying a credential is refused. Runs on private repositories are now refused.publish-app.yamldoes not set this mode.I read those two diffs. The other two helpers were not touched in this range. Using v19.0.5 instead of v13.2.15, because it is the revision the pending consumer updates are moving to: #5422 now carries it.
[-]Approve the v13.2.15 application publisher before consumers move to it[/-][+]Complete the reviewed v19.0.5 application-publisher migration[/+]devantler commentedon Nov 2, 2026
Consolidated the superseded version-specific requests #5275 and #5595 into this migration and updated the current-plan section to the already selected v19.0.5 revision
af042c540ce8db4d64add98c34b5c57691e0e812. Their complete-range review, bounded exact-identity approval, native consumer checks, protected delivery and actual publication/deployment criteria are retained. The earlier request remains collapsed for historical context.The current devantler-tech/ascoachingogvaner#354 and devantler-tech/platform-tenant-template#272 heads still propose v19.0.3; this update does not make them approved. Signer-inventory work #5424/#5687 and the consumer cutovers remain open. No source, running workload, approval set or dependency-bot branch changed.
ci(deps): hold the publisher at the approved v19.0.5
ci(deps): bump the devantler-tech-actions group across 1 directory wi…
ci(deps): hold the publisher at the approved v19.0.5
ci(deps): bump the devantler-tech-actions group across 1 directory wi…
devantler commentedon Nov 2, 2026
Consumer adoption, 2 November about 04:20Z. Dependabot now proposes v19.0.8, which is not approved, so
publish-app.yamlwas held at v19.0.5 by one signed commit on each update. Other pins were left where Dependabot put them.a29e8d7358e4658111Not done or not verified.