cd.yaml

name: 🚀 CD

# Publishes the desired AWS state (deploy/) as a cosign-signed OCI manifests
# artifact consumed by the platform cluster's `aws` tenant. There is NO
# container image here — only manifests — so it delegates to the shared
# manifests-only publish workflow in devantler-tech/actions (the
# manifests-only sibling of publish-app.yaml). The OCI name defaults to this
# repository (devantler-tech/aws), so the artifact lands at
# oci://ghcr.io/devantler-tech/aws/manifests.
#
# Because signing runs INSIDE the reusable workflow, the cosign certificate
# identity (OIDC subject) is that workflow's path —
# https://github.com/devantler-tech/actions/.github/workflows/publish-manifests.yaml@<ref>
# — NOT this repo's cd.yaml. The platform `aws` OCIRepository's
# verify.matchOIDCIdentity.subject must match that (mirror the
# github-config tenant's verify block in devantler-tech/platform).

on:
  push:
    tags:
      - "v*"

permissions: {}

jobs:
  publish-manifests:
    name: 🗳️ Publish manifests
    permissions:
      contents: read # checkout
      packages: write # push the OCI artifact to GHCR
      id-token: write # keyless cosign signing (Fulcio + Rekor via GitHub OIDC)
    # Pinned to the released commit SHA (zizmor blanket policy requires a hash;
    # the SHA must be reachable from a tag, or zizmor flags it as an impostor).
    # Dependabot's github-actions ecosystem manages this pin.
    # Keep the ref a 40-hex commit: it is part of the cosign subject the platform
    # verifies, so its shape is load-bearing here. A ref the verifier does not
    # accept fails nothing in this repo — the artifact still publishes, signed
    # under an identity the platform rejects, and the `aws` tenant stops
    # reconciling until the ref is put back.
    uses: devantler-tech/actions/.github/workflows/publish-manifests.yaml@ea4df9004d4ab43b6c9af5b0c5f55712f7211328 # v13.10.12
    with:
      enable-caller-pin: true