Skip to content

docs(cd): state that the workflow ref is load-bearing for cosign verification #147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devantler merged 1 commit into from
Aug 9, 2026
+5 −2
Merged

docs(cd): state that the workflow ref is load-bearing for cosign verification #147

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions .github/workflows/cd.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,8 +35,11 @@ jobs:
# Pinned to the released commit SHA (zizmor blanket policy requires a hash;
# the SHA must be reachable from a tag, or zizmor flags it as an impostor).
# Renovate manages this pin, as it does for publish-app.yaml elsewhere.
# The platform verifier matches `@.+$`, so the ref does not affect cosign
# verification.
# Keep the ref a 40-hex commit: it is part of the cosign subject the platform
# verifies, so its shape is load-bearing here. A ref the verifier does not
# accept fails nothing in this repo — the artifact still publishes, signed
# under an identity the platform rejects, and the `github-config` tenant
# stops reconciling until the ref is put back.
uses: devantler-tech/actions/.github/workflows/publish-manifests.yaml@061b345a7351b0caf23055caea63ccd08b75e20e # v8.0.0
with:
oci-name: devantler-tech/github-config
Loading