You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Approve the publish-app v20.1.7 publisher for ascoachingogvaner #5898
ascoachingogvaner#358 (Dependabot) moves the site's publisher to devantler-tech/.github/.github/workflows/publish-app.yaml@66b52462d8f6c74b95196cc3642091d05b253983 (v20.1.7). Its Publish Pin Approved check fails because scripts/publish-workflow-canonical-approvals.tsv approves only 467f0758 and af042c54 (v19.0.5, the current pin) for ascoachingogvaner.
Problem
The site's dependency updates for the shared actions group cannot merge, and if the pin moved anyway the platform would refuse the next release, so the live site would keep the older runtime.
Proposed change
Approve 66b52462 for ascoachingogvaner, keep af042c54 (it signs the current release) and retire 467f0758, with the matching verify-subject, test fixture and approved-surface updates, following the shape of #5741.
The only changes to publish-app.yaml between af042c54 and 66b52462 are two pinned-action patch/minor bumps (harden-runner v2.22.2 → v2.22.3, Flux CLI setup action v2.9.6 → v2.10.0). Nothing that signs, pushes or chooses what is published changes.
Acceptance criteria
The approvals list and its tests accept 66b52462 for ascoachingogvaner, still accept af042c54, and reject 467f0758 and an unlisted commit.
ascoachingogvaner#358's Publish Pin Approved check passes after this deploys.
Size
Small. One approvals row and the fixtures that move with it. Related: #5860 (the same gap for business-site, now also on 66b52462 since business-site#513).
#5748 - feat: support business publisher transitions [closed]
📝 Issue Planner
Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.
Create Plan
🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your .coderabbit.yaml:
issue_enrichment:
auto_enrich:
enabled: false
💬 Have feedback or questions? Drop into our discord!
A refinement note before anyone implements this. The proposal says to keep af042c54 because it "signs the current release" and to retire 467f0758. On main today (900535fe), the approved-revisions identities ledger records ascoachingogvaner 1.15.1 as published by publish-app.yaml@467f0758, not by af042c54. Before retiring either commit, confirm which publisher signed the release the live source serves. Retiring the wrong one would make the platform refuse the release that is running now.
Scope is also wider than one approvals row. 467f0758 and af042c54 appear together in the ascoachingogvaner and wedding-app source subjects, the tenant resource-graph default subject and its constructor library, the image-verification policies (Kyverno and Talos), and the bindings file. Plan the slice with those surfaces in view, and keep wedding-app's approvals unchanged.
Activity
coderabbitai commentedon Nov 7, 2026
🔗 Related PRs
#5748 - feat: support business publisher transitions [closed]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!
devantler commentedon Nov 7, 2026
A refinement note before anyone implements this. The proposal says to keep
af042c54because it "signs the current release" and to retire467f0758. Onmaintoday (900535fe), the approved-revisions identities ledger records ascoachingogvaner1.15.1as published bypublish-app.yaml@467f0758, not byaf042c54. Before retiring either commit, confirm which publisher signed the release the live source serves. Retiring the wrong one would make the platform refuse the release that is running now.Scope is also wider than one approvals row.
467f0758andaf042c54appear together in the ascoachingogvaner and wedding-app source subjects, the tenant resource-graph default subject and its constructor library, the image-verification policies (Kyverno and Talos), and the bindings file. Plan the slice with those surfaces in view, and keep wedding-app's approvals unchanged.