From 2f6d7b46076ed2b8af5127e4d76ff69bbf267a90 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sat, 18 Jul 2026 22:33:22 +0200 Subject: [PATCH] fix(github): restrict config artifact signer refs --- k8s/bases/apps/github-config/oci-repository.yaml | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/k8s/bases/apps/github-config/oci-repository.yaml b/k8s/bases/apps/github-config/oci-repository.yaml index 9125017e11..dd7e0d7733 100644 --- a/k8s/bases/apps/github-config/oci-repository.yaml +++ b/k8s/bases/apps/github-config/oci-repository.yaml @@ -33,8 +33,10 @@ spec: # subjects are accepted via ONE regex-alternated entry — cosign's keyless # attestation verification rejects MULTIPLE identity entries outright # ("unsupported: multiple identities are not supported at this time"), so - # the transition must be expressed inside a single subject regex. Narrow - # the alternation to actions-only once the first actions-signed artifact - # has been published and verified. + # the transition must be expressed inside a single subject regex. Accept only + # protected release-tag invocations of the reusable signer; do not allow + # arbitrary branch or pull-request refs to publish higher-semver GitHub + # org-management artifacts. Narrow the alternation to actions-only once + # the first actions-signed artifact has been published and verified. - issuer: '^https://token\.actions\.githubusercontent\.com$' - subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-manifests\.yaml@.+$' + subject: '^https://github\.com/devantler-tech/(reusable-workflows|actions)/\.github/workflows/publish-manifests\.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$'