From 5fd9fe9b809990d888036c472a574f04cee142c4 Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Sun, 19 Jul 2026 00:29:14 +0000
Subject: [PATCH] [patch] Restore applied publisher contract

---
 .github/workflows/lint-test-build-push.yaml | 4 ++--
 publication_contract_test.go                | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/lint-test-build-push.yaml b/.github/workflows/lint-test-build-push.yaml
index 510eae1..5ca9c48 100644
--- a/.github/workflows/lint-test-build-push.yaml
+++ b/.github/workflows/lint-test-build-push.yaml
@@ -119,14 +119,14 @@ jobs:
   publish:
     if: github.event_name != 'pull_request'
     needs: [lint-test]
-    uses: libops/.github/.github/workflows/build-push.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed # guarded-signed-image-publisher
+    uses: libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587 # guarded-signed-image-publisher
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
       additional-gar-registry: us-docker.pkg.dev/libops-images/public
       scan: true
       sign: true
-      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@578137212ead4ab4059e95df17fa30e9b7ac4aed
+      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587
     permissions:
       contents: read
       packages: write
diff --git a/publication_contract_test.go b/publication_contract_test.go
index 3beb9df..65d92e3 100644
--- a/publication_contract_test.go
+++ b/publication_contract_test.go
@@ -7,7 +7,7 @@ import (
 )
 
 const (
-	sharedPublisherSHA = "578137212ead4ab4059e95df17fa30e9b7ac4aed"
+	sharedPublisherSHA = "d5a29840172a53729c5999832534de65b7ba9587"
 	sharedWorkflowSHA  = "d5a29840172a53729c5999832534de65b7ba9587"
 )