[devantler]

🤖 Generated by the Agentic Engineer

Why

.github#831 moves the organization settings publisher to v19.0.8, and the platform only accepts releases signed by versions it has approved. The approval has to deploy first, otherwise the next settings release is refused in production.

What

The platform accepts the v19.0.8 commit (0966f4b015e85ef14be37411d424a7028a858550) for the .github consumer.

• v19.0.3 (bd24a3e1) stays accepted, because it signed the current 19.0.8 release.
• v10.0.3 (0f390329) is retired, because a consumer accepts at most two canonical commits. The test now refuses it.

What changes in the publisher

Nothing that signs or publishes. These files have the same git blob at v19.0.3 and v19.0.8:

File	Blob
.github/workflows/publish-manifests.yaml	a035ba3d
.github/scripts/require-unpublished-version.sh	3566e406
.github/scripts/recover-manifests-version.sh	48dc38f6

Authorization ledger

One entry changes, and nothing is added or removed. OCIRepository github-config/github-config moves from 4e833587…731a0 to 5e2570ec…7406. No artifact URL, RBAC, IAM policy, credential or permission grant changes. I took the new hash from a local render, so the required CI job is what confirms it with the approved tools.

Validation

• go test ./scripts/validate-eks-ci-role-policy passes.
• test-publish-workflow-canonical-approvals.sh passes, with v19.0.8 and v19.0.3 accepted, and v10.0.3 and the older commits refused.
• The rendered Hetzner apps layer names the new commit.

Not proven yet: deployed acceptance, or a publication by the new signer. After this deploys, read back that the live source still serves the current release, then update .github#831.

Fixes #5740

🤖 Generated with Claude Code

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

Action not completed

Review rate limited.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: devantler-tech/platform
• Branch: claude/approve-publisher-v19-0-8-5740
• File: .coderabbit.yaml
• Commit: ffeb25f
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3d17c784-127c-4460-a6dd-4e45f81fbc88

Commits

Reviewing files that changed from the base of the PR and between 3e6fffb and ffeb25f.

Files ignored due to path filters: 1

• scripts/publish-workflow-canonical-approvals.tsv is excluded by !**/*.tsv

Files selected for processing: 3

• k8s/bases/apps/github-config/oci-repository.yaml
• scripts/tests/test-publish-workflow-canonical-approvals.sh
• scripts/validate-eks-ci-role-policy/approved-surface.txt

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[devantler]

🤖 Generated by the Agentic Engineer

@codex review for The cluster signer allow-list: confirm only the v19.0.8 commit is added, v19.0.3 stays accepted, and the retired commit is refused.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T09:06:42.209329Z	ffeb25f	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

Reviewed commit: ffeb25f8de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[devantler]

🤖 Generated by the Agentic Engineer

Static evaluation at ffeb25f8de80def9a9b7d6c3bec94cc6aef825b3. This cannot be exercised until it deploys, because the source only reads the identity when a release is fetched.

Check	Expected	Actual
v19.0.8 identity against the rendered subject	Accepted	Accepted (test-publish-workflow-canonical-approvals.sh)
v19.0.3 identity, the signer of the current release	Accepted	Accepted
v10.0.3, the retired commit, and older commits	Refused	Refused
Authorization ledger	One changed entry, with the hash confirmed by the approved tools	The required CI job passed at this head
Publisher blobs at v19.0.3 and v19.0.8	The same	The same for all three files

Review: CodeRabbit refused on its limit, and Codex found no major issues at this head.

Still owed after deployment: read back that the live github-config source still serves 19.0.8 and names the new commit, then update .github#831.