Repository navigation
fix(supply-chain): replace the retired v7.23.0 publisher with v19.0.5 - #5422
Conversation
…eneric boundaries The generic Tenant source rule, the app-image admission policy and the node-pull rule accept devantler-tech/.github@f5d078cc (v13.2.15) beside v8.0.0 and the deployed v7.23.0 signer. The publisher range was reviewed on #5404. Per-consumer approvals and tenant pins are unchanged. The tenant RGD fingerprint, ledger entry and content hash move accordingly. Refs #5404 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Blocker: #5424 | upstream | last-verified 2026-10-31: The guard admits at most two exact maintained publisher revisions at the generic boundaries, and v7.23.0 still signs deployed wedding-app 1.15.23; ascoachingogvaner has moved off it (1.15.1 signed by v8.0.0). wedding-app already pins v8.0.0 but has cut no release since, and none is forced. Re-entry: once wedding-app deploys a release not signed by v7.23.0, replace 0c7b6c35 in this PR with the newest reviewed publisher (now v19.0.3, bd24a3e1) rather than adding a third revision. |
Takes main's content for every file the earlier third-revision approach changed; the replacement follows in its own commit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wedding-app 1.15.24 now runs under the v8.0.0 signer, so v7.23.0 signs nothing deployed. The generic boundaries, wedding-app and ascoachingogvaner take v19.0.5 in its place, still at most two revisions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
devantler
changed the title
@codex review |
@coderabbitai review |
Action performed
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
The two findings hash the whole nested source, which now names v19.0.5. Value reproduced by the same method that yields main's committed hash. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codex review |
|
No actionable comments were generated in the recent review.
 |
| Check name | Status | Explanation |
|---|---|---|
| Title check |  |
The title clearly and concisely identifies the main change: replacing the retired v7.23.0 publisher with v19.0.5 in supply-chain approvals. |
| Description check | |
The description directly explains the publisher revision replacement, affected policies and consumers, validation results, and post-merge actions. |
| Docstring Coverage | |
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 4 files. (9 skipped: 9 unsupported.)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
Tried at head
The new rules keep accepting what is deployed, accept the next release, and refuse the retired signer. Not exercised: a real release signed by v19.0.5, and the rules once deployed. Neither can exist before this merges, so the After merge steps in the description cover them. |
Why
The platform's generic app-image rules admit at most two exact publisher revisions, so v7.23.0 held the slot every consumer needs to move on. Wedding-app 1.15.24 was published from the v8.0.0 workflow on 1 November (CD run 41318212102's
referenced_workflowsnames467f0758…), and Flux reads that source Ready and SourceVerified. Ascoachingogvaner moved earlier, so v7.23.0 signs nothing deployed.What
0c7b6c35…(v7.23.0) withaf042c54…(v19.0.5) in the Tenant source rule, the admission policy and the node-pull rule. The set stays at exactly two revisions.0c7b6c35…to be refused at every boundary andaf042c54…to be accepted everywhere except the product documentation source.This replaces the earlier approach on this branch, which added a third revision for v13.2.15.
Range review of the publisher: #5404. Business-site keeps v8.0.0, so business-site#370 stays held. Its tenant
publisherRevisionmoves separately.Validation
scripts/tests/test-publish-workflow-canonical-approvals.sh: 0 failures.go test ./...inscripts/validate-eks-ci-role-policy: passes, after the ledger update.write-publish-workflow-matchers.shand its guard: all 6 consumers agree.After merge
Part of #5404
Part of #5424