cd.yaml

name: 🚀 CD

# Publishes the org's declarative GitHub state (deploy/) as a cosign-signed OCI
# artifact consumed by the platform cluster's `github-config` tenant. There is
# NO container image here — only manifests — so it delegates to the shared
# manifests-only publish workflow in devantler-tech/actions (the
# manifests-only sibling of publish-app.yaml).
#
# The OCI path is `github-config` (not the repo name) because `.github` is an
# invalid OCI path component (leading dot) — hence the oci-name override.
#
# Because signing runs INSIDE the reusable workflow, the cosign certificate
# identity (OIDC subject) is that workflow's path —
# https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref>
# — NOT this repo's cd.yaml. The platform `github-config` OCIRepository's
# verify.matchOIDCIdentity.subject must match that (see
# k8s/bases/apps/github-config/oci-repository.yaml in devantler-tech/platform),
# so this repo's workflow-source swap MUST land only after the platform
# verifier accepts the devantler-tech/actions subject.

on:
  push:
    tags:
      - "v*"

permissions: {}

jobs:
  publish-manifests:
    name: 🗳️ Publish manifests
    permissions:
      contents: read # checkout
      packages: write # push the OCI artifact to GHCR
      id-token: write # keyless cosign signing (Fulcio + Rekor via GitHub OIDC)
    # Pinned to the released commit SHA (zizmor blanket policy requires a hash;
    # the SHA must be reachable from a tag, or zizmor flags it as an impostor).
    # Dependabot manages this pin (.github/dependabot.yml, github-actions
    # ecosystem, no cooldown for devantler-tech/*).
    # Keep the ref a 40-hex commit: it is part of the cosign subject the platform
    # verifies, so its shape is load-bearing here.
    uses: devantler-tech/actions/.github/workflows/publish-manifests.yaml@3c3a6348b3e7aacc995ae49fc60032f95f70a779 # v13.6.5
    with:
      oci-name: devantler-tech/github-config
      # Without this, a ref the platform verifier does not accept fails nothing
      # here: the artifact still publishes, signed under an identity the
      # platform rejects, and the `github-config` tenant silently stops
      # reconciling until the ref is put back. Enabling the guard turns that
      # into a loud pre-signing failure in this workflow instead — the publish
      # refuses before the artifact exists, and the error names the fix.
      enable-caller-pin: true