Deploy changes can merge without publishing a new OCI artifact

[devantler]

🤖 Generated by the Agentic Engineer

Description

A behavior-changing edit under deploy/ can merge with a no-bump Conventional Commit type and never publish the corrected OCI artifact. PR #129 renamed gitops-tenant-template to platform-tenant-template on main, but its refactor(deploy): squash commit produced no semantic release. Production therefore remains pinned to the stale v1.21.4 artifact.

Steps to Reproduce

1. Inspect signed main at 1f6f6a1fc601ee7e37c7d84e088138281229986b; the renamed manifests are present.
2. Inspect Release run 30755682269; semantic-release reports that the commit should not trigger a release and publishes nothing.
3. Inspect the live github-config Flux Kustomization: it still applies 1.21.4@sha256:8fddda7bd40f30c3020b1a814b347c321a6632215b9ee82c75a43f2756689c45, where both old TeamRepository objects retry 404s and keep the Kustomization unhealthy.

Expected Behavior

Any merged deploy/ change that alters the published artifact produces an intentional SemVer release, and CI prevents a no-bump PR title from silently leaving production on stale desired state.

Actual Behavior

The merge and Release workflow are green, but no tag or OCI artifact is published. Platform apps is blocked on the stale github-config tenant, including merge-group run 30760329199 for platform#2876.

Environment

• Repository head: 1f6f6a1fc601ee7e37c7d84e088138281229986b
• Last released version: v1.21.4
• Observed: 2026-08-02, admin@prod

Acceptance Criteria

• A patch release publishes the already-merged rename as a cosign-signed OCI artifact.
• Production Flux applies that exact artifact and github-config becomes Ready.
• A test/CI guard rejects no-bump PR types for behavior-changing deploy/ changes.
• The Platform merge queue is retried only after the root cause is healthy.

[coderabbitai]

🔗 Related PRs

#76 - fix(ci): release revert commits so reverts reach the cluster [merged]
#80 - ci: repoint reusable workflows to devantler-tech/actions v8.0.0 [merged]
#82 - feat: declare the devantler-tech/aws config-tenant repo [merged]
#86 - fix: gate repository-permissions/ until provider-upjet-github supports shaPinningRequired [merged]
#127 - fix(repositories): keep org-enforced signoff out of update payloads [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!