chore(security): regenerate the approved publish-workflow revisions

[botantler-1]

🤖 Generated by the Agentic Engineer

Refresh the approved publish revisions and their consumer matchers from
the deployed artifacts and current publish-workflow pins. Every consumer
resolved on both halves, and each matcher accepts exactly its approved pair.

Part of #3308.

[devantler]

🤖 Generated by the Agentic Engineer

@coderabbitai full review

[coderabbitai]

@devantler I will perform a complete review of PR #3701.

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Advanced

Run ID: a564c240-d66a-46b3-a87d-e990d50a60b4

📥 Commits

Reviewing files that changed from the base of the PR and between a9fed81 and 21c1b6f.

⛔ Files ignored due to path filters (1)

• scripts/publish-workflow-approved-revisions.tsv is excluded by !**/*.tsv

📒 Files selected for processing (1)

• k8s/bases/apps/github-config/oci-repository.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-07-03T03:44:11.507Z

Learnt from: devantler
Repo: devantler-tech/platform PR: 2399
File: k8s/bases/apps/ascoachingogvaner/oci-repository.yaml:25-26
Timestamp: 2026-07-03T03:44:11.507Z
Learning: In Flux `OCIRepository` manifests under `k8s/bases/**/oci-repository.yaml`, keep the existing house convention for `spec.serviceAccountRef.verify.matchOIDCIdentity` subject regexes to use an `@.+` ref suffix (i.e., match any ref) rather than tightening it to a specific SHA/tag pattern.

If a PR adds a transitional dual-subject entry for an ongoing migration (e.g., moving from `devantler-tech/reusable-workflows` to `devantler-tech/actions`), do not request tightening the ref matcher in that PR. Defer any ref-matcher tightening to a separate, focused follow-up PR that consistently tightens `matchOIDCIdentity` subject rules once each file returns to a single subject after migration cleanup.

Applied to files:

• k8s/bases/apps/github-config/oci-repository.yaml

🔇 Additional comments (1)

k8s/bases/apps/github-config/oci-repository.yaml (1)

32-32: 🩺 Stability & Availability

No issue. The fixed SHA matcher is generated from the approved revision set and intentionally accepts only the deployed signer and current workflow pin. The repository validator supports this format, so the @.+ convention does not apply here.

---

📝 Walkthrough

Walkthrough

The github-config OCIRepository cosign verification regex now accepts artifacts signed by either of two publish-workflow commit revisions. The existing revision remains valid, and the new revision is added through regex alternation.

Merge Risk: 🟡 Moderate · up to 21c1b

The GitHub Config OCI verifier now accepts artifacts from two pinned workflow revisions. Future valid artifacts could be rejected by Flux if this exact pinning contract is not intentional, so the contract should be confirmed before merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the security-related regeneration of approved publish-workflow revisions. It matches the primary change.
Description check	✅ Passed	The description directly explains the refreshed publish revisions, consumer matchers, approved pairs, and related issue. It is related to the changeset.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}