[devantler]

🤖 Generated by the Daily AI Assistant

Companion to devantler-tech/provider-upjet-unifi#12 — together they unblock the provider on prod.

Problem

verify-app-images only accepts the reusable-workflows/publish-app.yaml cosign identity for all non-ksail ghcr.io/devantler-tech/* images. Crossplane provider packages are published by the crossplane-contrib reusable workflow (crane copy, no signing), so provider-upjet-unifi:v0.1.0 is unsigned and its package-runtime pods are denied at admission — the provider Deployment has been 0/1 since 2026-07-01 22:00Z, the ProviderRevision is RUNTIME: False, and the UniFi Crossplane migration is stalled (PolicyViolation/FailedCreate warning stream on prod, 2026-07-02).

Fix

provider-upjet-unifi#12 adds a keyless cosign signing job to the provider's own publish-provider-package.yml; the Fulcio identity that produces is that workflow's ref. This PR accepts it as a second OR'd identity in the existing publishapp attestor:

^https://github\.com/devantler-tech/provider-upjet-[a-z0-9-]+/\.github/workflows/publish-provider-package\.yml@.+$

Scoped to devantler-tech provider-upjet-* repos and the fixed workflow filename — the trust gate for app images is unchanged; nothing is excluded from verification.

Rollout order

1. Merge provider-upjet-unifi#12, re-dispatch Publish Provider Package with version: v0.1.0 (idempotent push + signs the digest).
2. Merge this (note: lands in the infrastructure layer, so it only applies once fix(policies): split restrict-storage-to-baseline-workers so Kyverno admits it (unfreezes infrastructure) #2378 unfreezes that Kustomization).
3. The pending provider ReplicaSet admits on its own.

Validation

ksail --config ksail.prod.yaml workload validate --skip-helm-render: 489 files validated.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8dec33ff-3e33-42f0-a886-021f5b5425de

📥 Commits

Reviewing files that changed from the base of the PR and between 306df68 and d56812e.

📒 Files selected for processing (1)

• k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml

---

📝 Walkthrough

Walkthrough

This PR updates a Kyverno policy description and validation rules to verify provider-upjet-* images with a new keyless attestor while continuing to verify non-provider app images with the existing attestor.

Changes

Provider Signature Acceptance Update

Layer / File(s)	Summary
Policy description and validation update k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml	Description updated to name both signature sources, and validation rules now separate provider-upjet-* images from non-provider app images with distinct keyless attestors.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• verify-app-images: accept the cosign identity of provider-upjet-unifi packages (companion to provider signing) #2383 — Updates the same policy to trust provider-upjet-* provider package signatures via a new attestor and subject match.
• Published provider package is unsigned — verify-app-images denies it on prod (provider dead on the platform) provider-upjet-unifi#13 — Matches the platform-side policy change needed to accept signed provider-upjet-* package images.

Suggested labels

• kubernetes, security, policy

Suggested reviewers

• devantler

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding support for the provider publish-workflow Cosign identity in verify-app-images.
Description check	✅ Passed	The description is directly related to the policy change and accurately explains the provider image signing update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/verify-app-images-provider-identity

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml`:
- Around line 54-66: The provider workflow identity under attestors.publishapp
is currently too broad because it is reused by verify-app-images for all
non-ksail ghcr.io/devantler-tech/* images, allowing provider-upjet signatures to
verify unrelated app images. Tighten the matching in verify-app-images so this
issuer/subjectRegExp only applies to provider-upjet image references, and keep
the existing attestor separate from non-provider app verification paths. Use the
attestors.publishapp and verify-app-images rules to locate the matching logic
and restrict the OR scope accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e5cae975-69e7-47a7-a4aa-a6c9ce461d1e

📥 Commits

Reviewing files that changed from the base of the PR and between 2ccb535 and 306df68.

📒 Files selected for processing (1)

• k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml

[botantler-1]

🎉 This PR is included in version 1.93.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀