From 80ce62b02b47f0e1c3cc012ecf1a3666f082d8bd Mon Sep 17 00:00:00 2001
From: libops-agent <115990865+libops-agent@users.noreply.github.com>
Date: Sat, 18 Jul 2026 23:56:43 +0000
Subject: [PATCH] [patch] Align publisher with applied identity

---
 .github/workflows/lint-test-build-push.yml | 4 ++--
 ci/publication_contract_test.go            | 9 ++++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/lint-test-build-push.yml b/.github/workflows/lint-test-build-push.yml
index fb6e540..30bfdbd 100644
--- a/.github/workflows/lint-test-build-push.yml
+++ b/.github/workflows/lint-test-build-push.yml
@@ -109,14 +109,14 @@ jobs:
   publish:
     if: github.event_name != 'pull_request'
     needs: test
-    uses: libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587
+    uses: libops/.github/.github/workflows/build-push.yaml@8e27d95846671a9e319f1900e86a488a1d4f39b3
     with:
       ref: ${{ github.sha }}
       expected-main-sha: ${{ github.ref == 'refs/heads/main' && github.sha || '' }}
       additional-gar-registry: us-docker.pkg.dev/libops-images/public
       scan: true
       sign: true
-      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@d5a29840172a53729c5999832534de65b7ba9587
+      certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@8e27d95846671a9e319f1900e86a488a1d4f39b3
     permissions:
       contents: read
       id-token: write
diff --git a/ci/publication_contract_test.go b/ci/publication_contract_test.go
index 3688111..f49d211 100644
--- a/ci/publication_contract_test.go
+++ b/ci/publication_contract_test.go
@@ -8,7 +8,10 @@ import (
 	"testing"
 )
 
-const sharedWorkflowSHA = "d5a29840172a53729c5999832534de65b7ba9587"
+const (
+	sharedPublisherSHA = "8e27d95846671a9e319f1900e86a488a1d4f39b3"
+	sharedWorkflowSHA  = "d5a29840172a53729c5999832534de65b7ba9587"
+)
 
 func repositoryRoot(t *testing.T) string {
 	t.Helper()
@@ -31,7 +34,7 @@ func readFile(t *testing.T, path ...string) string {
 func TestPublicationUsesSharedGHCRAndGARContract(t *testing.T) {
 	workflow := readFile(t, ".github", "workflows", "lint-test-build-push.yml")
 	for _, required := range []string{
-		"libops/.github/.github/workflows/build-push.yaml@" + sharedWorkflowSHA,
+		"libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"libops/.github/.github/workflows/pr-status.yaml@" + sharedWorkflowSHA,
 		"\n  build-push:\n",
 		"image-check:",
@@ -48,7 +51,7 @@ func TestPublicationUsesSharedGHCRAndGARContract(t *testing.T) {
 		"expected-main-sha:",
 		"scan: true",
 		"sign: true",
-		"certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@" + sharedWorkflowSHA,
+		"certificate-identity: https://github.com/libops/.github/.github/workflows/build-push.yaml@" + sharedPublisherSHA,
 		"GCLOUD_OIDC_POOL: ${{ secrets.GCLOUD_OIDC_POOL }}",
 		"GSA: ${{ secrets.GSA }}",
 	} {