Repository navigation
Conversation
Signed head The new publisher is approved only for the exact KHoist consumer and image repository. Its dedicated admission attestor covers ordinary, init and ephemeral containers; its first matching node rule precedes the unchanged shared app catch-all. The prior maintained publisher and original full-commit compatibility remain accepted. The obsolete maintained revision is retired for this consumer only, after independent signature verification of both its actual deployed image and current source manifest succeeded using the retained alternatives. Other consumers and the Tenant constructor retain their original authority. The new complete-policy CEL/first-match controls were RED before implementation and pass after it; wrong issuer/owner, mutable/unapproved revisions, retired revision, lookalikes and child repositories refuse the new authority. Full affected Go race tests and vet, inventory regressions, canonical-approval and approved-revision guards, source-upgrade, generator-output and publisher-regeneration controls pass. Both static manifest validations exited zero and include the changed policy and KHoist layer. Their existing offline namespace-label and chart-render limitations remain explicit; they are not a live rollout or universal Helm proof. No check configuration or threshold was relaxed. The genuine unchanged observation generator and writer completed for all six consumers, then repeated with byte-identical outputs. They observe #5364's already verified business-site source and convert its pending upgrade into the existing published-binding form; application reconciliation remains disabled. This PR does not activate a portal, replace running applications or change public routing. Fresh hosted CI and substantive exact-head review remain required. |
Signed correction CI 40352688501 at the earlier head remains FAILED. Its complete read found five failed jobs from three underlying omissions: the reviewed source matcher's authorization-ledger fingerprint, the two genuine additional shared-publisher matcher entries, and verifier fixtures that still modeled nine routes/attestors. No substantive provider review was requested on that failed head. The approval ledger now changes only KHoist's exact OCIRepository fingerprint, with the observed before/after edit documented beside earlier approvals. The matcher inventory requires both the unchanged shared matcher and the new dedicated one. The credential-refresh fixture requires all ten attestors plus KHoist's exact issuer, signer and repository routing; the liveness fixture requires all ten ordered routes and adds explicit missing-KHoist/wrong-signer refusals. No validator, scan scope, required job or threshold is disabled. The complete credential-refresh Go race suite passes (235 seconds), as does the full authorization race suite (147 seconds), vet, the actual pinned-renderer authorization validator, the complete liveness regression and all 112 shared-matcher guard controls. Earlier complete-policy CEL, source-upgrade and genuine six-consumer generation evidence remains scoped to the unchanged implementation. Fresh hosted CI and substantive exact-head review are still required. This remains deployment preparation, not portal activation. |
@coderabbitai review |
✅ Action performed
|
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Linked Issues check |  |
Issue #5377 is the only active direct target, so its coding requirements apply. #5267 is parent context for observation follow-through and was not needed for this verdict. This assessment uses the sup… |
Restrict the KHoist rule in talos/cluster/verify-first-party-images.yaml to exact revisions. Use the same two approved publish-app.yaml revisions as the publishkhoist attestor. Remove the any-40-hex actions-repository pattern. If an actions… |
| Docstring Coverage |  |
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 5 files. (6 skipped: 6… | Write docstrings for the functions missing them to satisfy the coverage threshold. |
-
Check name Status Explanation Description check The description explains that the pull request approves the KHoist publisher, refreshes publication records, and preserves approval boundaries. These goals match the changeset. Title check The title clearly identifies the KHoist publisher approval, which is the main change in the pull request. Out of Scope Changes check The visible changed files relate to the KHoist publisher approval. They cover the khoist-documentation OCIRepository identity, the k8s and Talos verification rules for ghcr.io/devantler-tech/khoist, t… Full details: Out of Scope Changes check
-
Explanation
The visible changed files relate to the KHoist publisher approval. They cover the khoist-documentation OCIRepository identity, the k8s and Talos verification rules for ghcr.io/devantler-tech/khoist, the approval record and digest, the business-site source binding status, and tests for those rules. The Talos revision wildcard is an in-scope defect under
#5377, not an unrelated change.The product-docs expectations and the node-pull selector change in test-publish-workflow-canonical-approvals.sh touch another product's test profile. They concern the shared publish-app retired and maintained revision checks. No behavior change for other products is shown in the supplied evidence, so no unrelated change is demonstrated.
Three ignored TSV files are excluded from review and their contents cannot be inspected. Their scope is inferred from file names only. No unrelated change is demonstrated from visible evidence.
-
Full details: Linked Issues check
-
Explanation
Issue
#5377is the only active direct target, so its coding requirements apply.#5267is parent context for observation follow-through and was not needed for this verdict. This assessment uses the supplied summary only. No source inspection was available.Met or partly evidenced:
- [
#5377] The OCIRepository for khoist-documentation moves its Cosign identity to publish-app.yaml@2df24600b1113e291b87e300b91e59c160446134. The approved-surface digest and ledger fingerprint change to match. - [
#5377] k8s/bases/infrastructure/cluster-policies/best-practices/verify-app-images.yaml adds a publishkhoist attestor. It accepts the shared publish-app.yaml identity only at the two specified revisions. A routing rule sends ghcr.io/devantler-tech/khoist tagged and digest references to that attestor. Other first-party images keep their existing signer paths. - [
#5377] approved-surface-history.md records acceptance of 2df24600, retention of 467f0758, retirement of 0c7b6c35, and the review controls. - [
#5377] Tests cover exact KHoist repository matching, refusal of incorrect certificate identities, refusal when the ordinary application signer is used, and first-matching node-rule behavior.
Unmet:
- [
#5377] The acceptance criteria require exact consumer/workflow/repository/revision approval with no wildcard. talos/cluster/verify-first-party-images.yaml adds a KHoist rule that accepts keyless publish-app.yaml signatures for any 40-character lowercase hexadecimal commit in the actions repository. That is a revision wildcard. It also conflicts with the k8s publishkhoist attestor, which accepts only the two specified revisions.
Not established from the supplied evidence:
- scripts/publish-workflow-approved-revisions.identities.tsv, scripts/publish-workflow-canonical-approvals.tsv, and scripts/shared-publish-workflow-matchers.tsv are excluded from review. Their approval bindings and maintained matcher generation cannot be checked.
- The executable publisher and helper review content is not in the summary. Only the approval records are described.
- The business-site binding change in canonical-tenant-source-bindings.json (published-upgrade to published-binding) needs the actual Ready/SourceVerified proof. That proof is not in the supplied evidence.
- The complete six-consumer observation refresh, stability checks, and hosted CI are reported by the author but are not shown in the code evidence.
Resolution
Restrict the KHoist rule in talos/cluster/verify-first-party-images.yaml to exact revisions. Use the same two approved publish-app.yaml revisions as the publishkhoist attestor. Remove the any-40-hex actions-repository pattern. If an actions-repository revision is required, list that exact commit. Add a refusal test for an unapproved actions-repository commit. Then provide the ignored approval and matcher TSV contents, or equivalent evidence, and the business-site Ready/SourceVerified proof for reassessment.
- [
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 5 files. (6 skipped: 6 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Superseded by verified upstream recovery; this PR will not merge. KHoist #500 merged as The added publisher approval, dedicated image matchers and related ledger/fixture changes are no longer needed for this delivery. They remain unmerged and are withdrawn with this PR, including the legacy-pattern concern raised by the selected provider's linked-issue check. The current deployed approval set remains in force. No review gate is waived, and no obsolete permission change is being promoted. Issue #5377 is superseded rather than completed as an added approval. #5361's already merged preparation and now merged observation follow-through are assessed separately against actual source acceptance. Portal identity admission and activation remain open under the business-site issues. |
Why
The current data-product publisher is not approved for this deployment, preventing the portfolio's verified publication records from updating. This also holds the portal deployment preparation open.
What
Approve the reviewed publisher for the data-product service alone and refresh the observed publication records. Preserve the existing approval boundaries for other products.
Fixes #5377
Part of #5267