From 862953520a66f3ce2749989f47bde945d74f9e6e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 9 Oct 2026 08:13:39 +0000 Subject: [PATCH 1/2] chore(deps): bump devantler-tech/.github/.github/workflows/publish-manifests.yaml Bumps [devantler-tech/.github/.github/workflows/publish-manifests.yaml](https://github.com/devantler-tech/.github) from 7.2.10 to 7.9.0. - [Release notes](https://github.com/devantler-tech/.github/releases) - [Commits](https://github.com/devantler-tech/.github/compare/2fa404276b0ce5c0527683b080e39045045c4e42...63c59062489edbee907d2a4d5d06f01c57b7d58c) --- updated-dependencies: - dependency-name: devantler-tech/.github/.github/workflows/publish-manifests.yaml dependency-version: 7.9.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/cd.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/cd.yaml b/.github/workflows/cd.yaml index 11096a3..e4854aa 100644 --- a/.github/workflows/cd.yaml +++ b/.github/workflows/cd.yaml @@ -38,7 +38,7 @@ jobs: # ecosystem, no cooldown for devantler-tech/*). # Keep the ref a 40-hex commit: it is part of the cosign subject the platform # verifies, so its shape is load-bearing here. - uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@2fa404276b0ce5c0527683b080e39045045c4e42 # v7.2.10 + uses: devantler-tech/.github/.github/workflows/publish-manifests.yaml@63c59062489edbee907d2a4d5d06f01c57b7d58c # v7.9.0 with: oci-name: devantler-tech/github-config # Without this, a ref the platform verifier does not accept fails nothing From e3f5d67a227e2ab14d92b3934761bd9bbd43c978 Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 11 Oct 2026 23:11:21 +0200 Subject: [PATCH 2/2] test(cd): move the pinned publisher revision with the caller pin The publication test pins the exact publisher revision the configuration caller uses. Move it to v7.9.0 together with cd.yaml so the two agree. Co-Authored-By: Claude Opus 5.5 --- .github/tests/test-publish-manifests-promotion.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/tests/test-publish-manifests-promotion.sh b/.github/tests/test-publish-manifests-promotion.sh index 9f2679e..a70fd93 100644 --- a/.github/tests/test-publish-manifests-promotion.sh +++ b/.github/tests/test-publish-manifests-promotion.sh @@ -6,7 +6,7 @@ set -euo pipefail validate_caller() { yq -e ' (.jobs["publish-manifests"].uses == - "devantler-tech/.github/.github/workflows/publish-manifests.yaml@2fa404276b0ce5c0527683b080e39045045c4e42") and + "devantler-tech/.github/.github/workflows/publish-manifests.yaml@63c59062489edbee907d2a4d5d06f01c57b7d58c") and (.jobs["publish-manifests"].with["enable-caller-pin"] == true) and (.jobs["publish-manifests"].with["enable-signed-promotion"] == true) and (.jobs["publish-manifests"].with["oci-name"] == "devantler-tech/github-config")