[devantler]

🤖 Generated by the Agentic Engineer

Why

A pending dependency update moves the organization settings publisher to a newer version. The platform only accepts settings releases signed by publisher versions it has approved, so the next settings release would be refused in production until this approval is deployed.

What

Approve the newer publisher alongside the one that signed the settings release running today, and retire an older approval that nothing running still depends on. The only change in the publisher between the approved version and the new one is a newer pinned runner-hardening tool.

Fixes #5872

⚠️ Merge order: land this and confirm the live settings source still reads Ready before the organization settings repository switches to the new publisher.

[devantler]

🤖 Generated by the Agentic Engineer

Self-review (fallback — CodeRabbit, Codex and Cursor Bugbot unavailable)

Reviewed commit: 5edb078fdee5b6f0299c5f39ccc5cf0cc26c0812

• CodeRabbit: rate limited (portfolio rate-limit refusal 2026-11-07T13:25Z; no review delivered since).
• Codex: usage limit reached since 2026-11-04T19:23Z (maintainer-only to lift).
• Cursor Bugbot: usage limit reached since 2026-11-07T12:01Z (maintainer-only to lift).

Checked:

• The admitted pair is now 57310dc6 (v20.0.3, which signed the release .github serves today; its cd.yaml still pins it) and 56ceec67 (v20.1.6, the commit .github#877 pins). The approvals table and the source subject regex name exactly that pair, in both places.
• The published workflow differs between 57310dc6 and 56ceec67 by one line only: the harden-runner pin moves from v2.22.2 to v2.22.3. Both helper-script blobs are unchanged, so nothing that signs, pushes or chooses what is published changes.
• Retiring 0966f4b0 (v19.0.8) is safe: nothing running was published by it. The identity fixtures now reject it, and they reject the old bd24a3e1 too.
• The negative identity fixtures (wrong issuer, look-alike issuer, other org, look-alike repo, wrong workflow, short SHA, suffix) now run against an approved commit, so each one proves only its own mutation.
• The approved-surface ledger changes only the github-config OCIRepository line. That matches the single rendered object this PR changes. The validator passed locally with the pinned renderer, and CI is green.

Verdict: no P0/P1 findings

[devantler]

🤖 Generated by the Agentic Engineer

Readiness at 5edb078fdee5b6f0299c5f39ccc5cf0cc26c0812:

• Every check passes, and the PR is CLEAN.
• Evaluated as the consumer would see it: the identity fixtures run the real source subject from the rendered manifest against real publisher identities. They accept v20.0.3 and v20.1.6 and reject the retired v19.0.8, older commits and every look-alike. The authorization-surface validator passed with the pinned renderer.
• Review: a fallback self-review is green at this head. All three review lanes are unavailable.
• After merge and deploy, read back the live github-config source and confirm it still reads Ready on the current release. Only then adapt fix(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml from 20.0.3 to 20.1.6 .github#877.

Entering the merge queue.