Skip to content

fix(publish): approve the v20.1.6 publisher for organization settings #5900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 1 commit into from
Nov 7, 2026
Merged

fix(publish): approve the v20.1.6 publisher for organization settings #5900

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion k8s/bases/apps/github-config/oci-repository.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,4 +29,4 @@ spec:
# signer and this consumer's current publish-workflow pin in one identity.
# Regeneration updates the pair and the approved set in the same PR.
- issuer: '^https://token\.actions\.githubusercontent\.com$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(0966f4b015e85ef14be37411d424a7028a858550|57310dc609dcc8f9205f53c674ff17c5dc979b73))$'
subject: '^https://github\.com/devantler-tech/(actions/\.github/workflows/publish-manifests\.yaml@(1d726483facb9340655489913f609082677be8f5|ea4df9004d4ab43b6c9af5b0c5f55712f7211328)|\.github/\.github/workflows/publish-manifests\.yaml@(57310dc609dcc8f9205f53c674ff17c5dc979b73|56ceec6717a1faa0686d865424cd2d1d45f18a0a))$'
2 changes: 1 addition & 1 deletion scripts/publish-workflow-canonical-approvals.tsv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
consumer workflow repository commit
aws publish-manifests devantler-tech/.github 2fa404276b0ce5c0527683b080e39045045c4e42
aws publish-manifests devantler-tech/.github bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b
.github publish-manifests devantler-tech/.github 0966f4b015e85ef14be37411d424a7028a858550
.github publish-manifests devantler-tech/.github 57310dc609dcc8f9205f53c674ff17c5dc979b73
.github publish-manifests devantler-tech/.github 56ceec6717a1faa0686d865424cd2d1d45f18a0a
ascoachingogvaner publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0
ascoachingogvaner publish-app devantler-tech/.github af042c540ce8db4d64add98c34b5c57691e0e812
business-site publish-app devantler-tech/.github 467f07582436a26b62cf4aa756423512f85ba0c0
Expand Down
17 changes: 9 additions & 8 deletions scripts/tests/test-publish-workflow-canonical-approvals.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -678,24 +678,25 @@ while IFS=$'\t' read -r expected issuer identity; do
fail "github-config transition: expected $expected for $issuer $identity, got $result"
fi
done <<'IDENTITIES'
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@56ceec6717a1faa0686d865424cd2d1d45f18a0a
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@bd24a3e1bbbf6aba2d7afd58a2fd8a3d67bebe6b
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0f390329b590404c02565b27a263ee841fa02bce
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@8d2203af130a8c27b8b98b3d7146f76b5ade7a98
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@6f1dee9557a939cc24ca2c562ea775d05e01564d
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@1d726483facb9340655489913f609082677be8f5
accept https://token.actions.githubusercontent.com https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328
reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@0966f4b015e85ef14be37411d424a7028a858550
reject https://another-issuer.invalid https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
reject https://tokenXactionsXgithubusercontentXcom https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
reject https://token.actions.githubusercontent.com https://github.com/another-org/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/xgithub/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-app.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@v12.0.1
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@main
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@0966f4b015e85ef14be37411d424a7028a858550-extra
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc
reject https://token.actions.githubusercontent.com https://github.com/devantler-tech/.github/.github/workflows/publish-manifests.yaml@57310dc609dcc8f9205f53c674ff17c5dc979b73-extra
IDENTITIES

aws_subject="$(yq -er '.spec.verify.matchOIDCIdentity[0].subject' "$REPO_ROOT/k8s/providers/hetzner/apps/aws/oci-repository.yaml")"
Expand Down
2 changes: 1 addition & 1 deletion scripts/validate-eks-ci-role-policy/approved-surface.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -426,7 +426,7 @@ source.toolkit.fluxcd.io/v1|OCIRepository|data-product-controller|khoist-documen

source.toolkit.fluxcd.io/v1|OCIRepository|flux-system|flux-operator fdc99e9413e88a5f8a99efa8b515dfbc340303dca5650d34137f1965d2788771

source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 0b308d3b5370f3492537972463ca4c2f07dbc24245ba18c4781e1379474daafc
source.toolkit.fluxcd.io/v1|OCIRepository|github-config|github-config 58aab6e4ce4181956f2216193807c06a352921d001dbaa211fb99e33412ca250

source.toolkit.fluxcd.io/v1|OCIRepository|homepage|homepage ff2c2d1aac0b2315247df9f5266eeb00f4443ea551d6e92270bdf76a243c0f38

Expand Down
Loading