Repository navigation
fix(cd): publish the manifests from the canonical devantler-tech/.github workflow - #54
Conversation
…hub workflow Repoint the publisher at devantler-tech/.github's publish-manifests.yaml, pinned to the commit the platform's aws tenant already accepts, so this repository no longer depends on the frozen devantler-tech/actions copy. Fixes #53 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@coderabbitai review |
✅ Action performedReview finished.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📜 Recent review details
📝 Walkthrough
Priority: ⬇️ Low Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Linked Issues check |  |
The supplied PR evidence shows that .github/workflows/cd.yaml now uses devantler-tech/.github publish-manifests.yaml at full revision 2fa404276b0ce5c0527683b080e39045045c4e42. It retains the e… |
| Out of Scope Changes check | |
The changed workflow comments and documentation directly implement issue #53. They explain the new signer, the Dependabot pin, and the platform trust requirement. No unrelated change is shown in the s… |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Title check | |
The title clearly and concisely describes the main change: switching CD publication to the canonical devantler-tech/.github workflow. |
| Description check | |
The description directly explains the workflow migration, signing identity, platform trust requirement, documentation updates, and post-release verification. |
Full details: Linked Issues check
-
Explanation
The supplied PR evidence shows that
.github/workflows/cd.yamlnow usesdevantler-tech/.githubpublish-manifests.yamlat full revision2fa404276b0ce5c0527683b080e39045045c4e42. It retains the existing inputs and caller-pin enforcement.AGENTS.md,README.md, and workflow comments identify the new signing workflow and the platform trust requirement. The PR uses the releasing typefix(cd). The post-release artifact and tenant health checks are operational follow-up items, not coding requirements for this review.
Full details: Out of Scope Changes check
-
Explanation
The changed workflow comments and documentation directly implement issue
#53. They explain the new signer, the Dependabot pin, and the platform trust requirement. No unrelated change is shown in the supplied PR summary.
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Readiness record @ 0a5cabe
Promoting and merging pinned to this head. |
1 participant
Why
This repository still publishes its signed AWS desired state through the frozen copy of the shared automation. That keeps it on the list of consumers blocking the old copy's archive, and every week it stays there brings another update of a pin nobody maintains.
What
The release now publishes and signs through the shared workflow in the organisation's shared automation repository, at the one revision the platform already trusts for this tenant, so the next release keeps deploying without interruption. The docs now name the new signer, and say that a future pin update must be trusted by the platform before a release ships with it.
Fixes #53
👉 After merge/promotion: the first release under the new signer needs a read-only check that the platform pulled it and the tenant stayed healthy, recorded on the issue.