Batch the supersession sweep's CRL re-sign #734

Workflow file for this run

	name: CI

	on:
	push:
	branches: ["main"]
	# Deliberately unfiltered by base branch. A filter of ["main"] silently
	# skipped every stacked PR — one targeting another unmerged branch rather
	# than main — while container-images.yml, which has no filter, still showed
	# a full row of green checks from image builds alone, so the checks tab read
	# as a passing build. An allowlist only narrows that trap: the next base
	# prefix nobody thought of fails the same silent way. Running on any base
	# means a stacked PR is exercised before it merges into its base, rather than
	# first being run by the downstream PR into main where the regression is
	# already buried in the stack's history. Exercised, not gated: the "Main"
	# ruleset covers the default branch only, so on a stacked PR these results
	# are the author's to read rather than a merge block.
	#
	# push stays on main: a PR already gets a pull_request run, and widening
	# push would double the load for no extra signal.
	pull_request:

	permissions:
	contents: read

	# Cancel in-flight runs for the same branch/PR so pushes don't queue up.
	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:

	# -- Format / vet / tidy ------------------------------------------------------
	check:
	name: Format / vet / tidy
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Install golangci-lint
	run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.2
	# Named for the target rather than its contents: the enumeration this
	# step used to carry went stale twice as dev:check grew checks.
	- name: Run the CI gate (mage dev:check)
	run: mage dev:check
	- name: Magefile tests
	# The magefile is build-tagged, so its Ginkgo suite is invisible to
	# the ordinary `go test ./...` run; test:magefile is the canonical
	# invocation, shared with the pre-push hook.
	run: mage test:magefile

	# -- Dockerfile lint (hadolint) ----------------------------------------------
	# Lints every Dockerfile in the repo. hadolint has no auto-fix mode (it only
	# reports), so this job fails the build on violations and the developer fixes
	# them -- the same fail-and-fix contract as `mage dev:check` above. One matrix
	# leg per Dockerfile so annotations stay attributed to the right file.
	hadolint:
	name: Dockerfile lint (${{ matrix.dockerfile }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	dockerfile:
	- Dockerfile
	- Dockerfile.alpine
	- test/Dockerfile.run
	- docker/puppet/Dockerfile
	- docker/puppet/Dockerfile.client
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: Run hadolint
	uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
	with:
	dockerfile: ${{ matrix.dockerfile }}

	# -- Markdown lint (markdownlint-cli2) ---------------------------------------
	# Lints every Markdown document against .markdownlint-cli2.yaml. Like
	# hadolint, markdownlint-cli2 fails the build on violations (though it can fix
	# most of them locally with `markdownlint-cli2 --fix`). Node is preinstalled
	# on GitHub-hosted runners, so npx runs the pinned version with no setup step.
	markdownlint:
	name: Markdown lint
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- name: Run markdownlint-cli2
	run: npx --yes markdownlint-cli2@0.23.1

	# -- Monitoring mixin --------------------------------------------------------
	# The mixin ships Prometheus alerting rules and no Go code, so nothing in the
	# unit suite would catch a malformed selector substitution, or an expression
	# that parses but silently never matches. Renders it with jsonnet, then runs
	# promtool over the result: `check rules` for syntax, `test rules` for the
	# behaviour of the rules whose expressions are not simple thresholds.
	mixin:
	name: Monitoring mixin
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install jsonnet
	run: go install github.com/google/go-jsonnet/cmd/jsonnet@v0.21.0
	# From the release tarball rather than `go install`: the prometheus module
	# carries replace directives, so installing its commands from source
	# fails. Release assets are mutable, so the download is pinned by digest
	# as well as by version — every other third-party artefact this workflow
	# pulls in is content-pinned (actions by commit SHA, Go modules by the
	# checksum database), and an unverified binary we then execute should not
	# be the exception. PROMETHEUS_SHA256 is the published sha256sums.txt
	# entry for the tarball below; bump both together.
	- name: Install promtool
	env:
	PROMETHEUS_VERSION: 3.13.2
	PROMETHEUS_SHA256: 0e8c4d46101bd025ea8265e377d2caabc57f488fc1be1c367f37db69ea41be6f
	run: \|
	set -euo pipefail
	tarball="prometheus-${PROMETHEUS_VERSION}.linux-amd64"
	curl -fsSL -o promtool.tar.gz \
	"https://github.com/prometheus/prometheus/releases/download/v${PROMETHEUS_VERSION}/${tarball}.tar.gz"
	echo "${PROMETHEUS_SHA256} promtool.tar.gz" \| sha256sum -c -
	tar -xzf promtool.tar.gz "${tarball}/promtool"
	install -m 0755 "${tarball}/promtool" "$(go env GOPATH)/bin/promtool"
	rm -rf promtool.tar.gz "${tarball}"
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Check the mixin
	run: mage test:mixin

	# -- Helm chart --------------------------------------------------------------
	# Everything the chart is gated on, in one job: its version tracks
	# internal/version, it lints under every fixture in charts/openvox-ca/ci/,
	# every manifest it renders validates against the real Kubernetes and CRD
	# schemas, the rendered values are asserted (schema validity is not
	# correctness), and it packages. The publish workflow only packages and
	# pushes, so this is where a broken chart is caught.
	chart:
	name: Helm chart (Helm ${{ matrix.helm }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	# Both supported Helm majors: the chart has to render identically for
	# users still on 3 and for those who have moved to 4. Renovate keeps
	# each leg current within its own major, one PR per major — the Helm 3
	# PR carries this leg and helm-chart.yml's packaging pin together,
	# because verifyChartPins refuses them separately. The two majors stay
	# in separate PRs on purpose: fail-fast: false above says a Helm 4
	# regression must not take the Helm 3 leg down with it, and a shared PR
	# would do exactly that.
	#
	# Major bumps are off (see renovate.json): moving a leg across a major
	# deletes the coverage that leg exists to provide, and adding or
	# retiring a major is a decision about what the chart supports rather
	# than a version bump. The cost is that nothing here will announce
	# Helm 5 — that one is on whoever is watching upstream.
	#
	# Renovate only sees an entry that carries the annotation below;
	# verifyChartPins fails the build on one that does not, because a leg
	# it cannot see is a leg that silently goes stale.
	helm:
	# renovate: datasource=github-releases depName=helm packageName=helm/helm
	- v3.21.4
	# renovate: datasource=github-releases depName=helm packageName=helm/helm
	- v4.2.4
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Install kubeconform
	run: go install github.com/yannh/kubeconform/cmd/kubeconform@v0.8.0
	# helm is preinstalled on GitHub-hosted runners, but at whatever version
	# the runner image happens to carry; pin it so the matrix means something.
	- name: Set up Helm
	uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
	with:
	version: ${{ matrix.helm }}
	- name: Check the chart version tracks internal/version
	run: mage chart:version
	- name: Lint and validate the rendered manifests
	run: mage chart:validate
	# Schema validity is not correctness: these assert what the templates
	# actually resolve to, and that each precondition really refuses what it
	# claims to.
	- name: Assert the chart renders the right values
	run: mage chart:test
	# Exercise the packaging step the publish workflow performs, so a chart
	# that renders but cannot be packaged fails here rather than on a tag.
	- name: Package the chart
	run: mage chart:package

	# -- Unit tests --------------------------------------------------------------─
	unit:
	name: Unit tests
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run unit tests
	run: mage test:unit
	- name: Coverage summary
	if: always()
	continue-on-error: true
	run: \|
	if [ ! -f coverage.out ]; then exit 0; fi
	{
	echo "## Test coverage"
	echo '```'
	go tool cover -func=coverage.out
	echo '```'
	} >> "$GITHUB_STEP_SUMMARY"

	# -- Release artefact build --------------------------------------------------
	# Builds each dist tarball exactly as the Release workflow does — one
	# variant per job, on a runner native to the target architecture (so the
	# cgo/boringcrypto FIPS variants need no cross toolchain and every built
	# binary can be executed for verification) — and discards the output.
	# Without these legs, that build path would first run when a release tag is
	# pushed, turning any breakage into a delete-tag/fix/retag cycle.
	dist:
	name: Release artefact build (${{ matrix.variant }})
	runs-on: ${{ matrix.runner }}
	strategy:
	fail-fast: false
	matrix:
	include:
	- variant: linux_amd64
	runner: ubuntu-latest
	- variant: linux_arm64
	runner: ubuntu-24.04-arm
	- variant: linux_amd64_fips
	runner: ubuntu-latest
	- variant: linux_arm64_fips
	runner: ubuntu-24.04-arm
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	# setup-go's cache is keyed only on go.sum, and that key is claimed
	# by whichever job saves it first — none of whose build caches
	# match this variant's build configuration. Use a per-variant cache
	# below instead, shared with release.yml.
	cache: false
	- name: Go caches (${{ matrix.variant }})
	uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
	with:
	path: \|
	~/go/pkg/mod
	~/.cache/go-build
	# Unique key per commit so every run saves its updated cache;
	# restore-keys fall back to the most recent cache for this variant.
	# Caches saved on main are visible to all refs, but release tags no
	# longer restore them: release.yml's build job sets cache: false and
	# links from source, so nothing that can write a cache entry here
	# reaches a published binary.
	key: dist-gocache-${{ matrix.variant }}-${{ hashFiles('go.mod', 'go.sum') }}-${{ github.sha }}
	restore-keys: \|
	dist-gocache-${{ matrix.variant }}-${{ hashFiles('go.mod', 'go.sum') }}-
	dist-gocache-${{ matrix.variant }}-
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Build release artifact
	run: mage build:distVariant ${{ matrix.variant }}
	- name: Verify artifact
	# Shared with the Release workflow's build job, so the artefacts that
	# actually get published receive the same verification as PR builds.
	uses: ./.github/actions/verify-dist-artifact
	with:
	variant: ${{ matrix.variant }}
	- name: Generate SBOMs
	# Generated but not attested: signing needs id-token: write and a tag
	# context, neither of which belongs on a PR. The point is that the
	# scan-and-validate half of the release's SBOM step runs on every pull
	# request, so a Syft upgrade or a cataloguer regression fails here
	# rather than midway through a release, when the only remedy is
	# delete-tag/fix/retag.
	uses: ./.github/actions/generate-sbom
	with:
	variant: ${{ matrix.variant }}

	# -- Puppet stack integration tests ------------------------------------------
	# Runs the full OpenVox 8 stack: Go CA (TLS) → OpenVox Server (WEBrick) →
	# OpenVoxDB. Requires docker compose and network access to pull base images
	# on first run. Same standard/FIPS matrix as the compose job.
	puppet:
	name: Puppet stack tests (${{ matrix.build }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	include:
	- build: standard
	mage_target: test:puppet
	- build: fips
	mage_target: test:puppetFIPS
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Start rngd (replenish entropy pool for FIPS crypto)
	if: matrix.build == 'fips'
	run: sudo apt-get install -y --no-install-recommends rng-tools && sudo rngd -r /dev/urandom
	- name: Run Puppet stack integration tests
	env:
	MAGE_TARGET: ${{ matrix.mage_target }}
	run: mage "$MAGE_TARGET"

	# -- Migration integration tests --------------------------------------------
	# Boots a real VoxPupuli Puppet Server, creates a genuine CA, then imports
	# it into openvox-ca and verifies the full migration path.
	migration:
	name: Migration tests
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	# Ahead of the suite it supports, and cheap: seconds on the host with no
	# container runtime. A break in the helpers' retry bound or failure
	# diagnostics would otherwise surface as a confusing migration failure,
	# or -- worse for a change whose whole point is reporting -- not surface
	# at all.
	- name: Run migration HTTP helper tests
	run: mage test:migrationHelpers
	- name: Run migration integration tests
	run: mage test:migration

	# -- Storage backend integration tests --------------------------------------
	# Runs the full Puppet stack against a Redis-backed CA topology with two
	# CA replicas sharing a single Redis prefix. Validates blob offload,
	# distributed bootstrap locking, cross-replica state visibility, and
	# concurrent CSR submissions split across replicas.
	backends-redis:
	name: Storage backend tests (Redis)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run Redis-backend integration tests
	run: mage test:backendsRedis

	# Brings up a throwaway Redis and runs the Redis-backend Go integration suite
	# (build tag redis_integration) against it. Distinct from backends-redis
	# above, which runs the full-stack bash TAP suite; this job exercises the Go
	# suite directly (Put/Get/Delete, List, concurrent AppendLine set-equality,
	# cross-replica lock serialisation) so the build-tagged Go suite is not left
	# unrun.
	backends-redis-go:
	name: Storage backend tests (Redis, Go suite)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run Redis-backend Go integration tests
	run: mage test:backendsRedisGo

	# Brings up a throwaway PostgreSQL and runs the SQL-backend Go integration
	# suite (build tag postgres_integration) against it. Validates the PostgreSQL
	# dialect: upsert, FOR UPDATE AppendLine atomicity across two backends, and
	# pg_advisory_lock mutual exclusion. (SQLite needs no dedicated job: its tests
	# run unconditionally in the unit job above.)
	backends-postgres:
	name: Storage backend tests (PostgreSQL)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run PostgreSQL-backend integration tests
	run: mage test:backendsPostgres

	# Brings up a throwaway MySQL and runs the SQL-backend Go integration suite
	# (build tag mysql_integration) against it. Validates the MySQL/MariaDB
	# dialect: LONGBLOB widening, ON DUPLICATE KEY upsert, FOR UPDATE AppendLine
	# atomicity with InnoDB deadlock retry across two backends, and GET_LOCK
	# mutual exclusion.
	backends-mysql:
	name: Storage backend tests (MySQL)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run MySQL-backend integration tests
	run: mage test:backendsMySQL

	# Runs the etcd-backend Go integration suite (build tag etcd_integration).
	# The suite boots an in-process embedded etcd, so it needs no external service
	# or compose stack.
	backends-etcd:
	name: Storage backend tests (etcd)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run etcd-backend integration tests
	run: mage test:backendsEtcd

	# Brings up a throwaway OpenBao dev server and runs the OpenBao Transit
	# signer Go integration suite (build tag openbao_integration) against it: signs
	# a digest through a real Transit key and verifies the signature, and
	# exercises the "create the key on first boot" convenience path. The mage
	# target also configures the transit engine and a scoped AppRole itself, so
	# no extra setup step is needed here.
	backends-openbao:
	name: Storage backend tests (OpenBao)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Run OpenBao-backend integration tests
	run: mage test:backendsOpenBao

	# -- Compose integration tests (docker compose) ------------------------------─
	# podman-compose is not pre-installed on GitHub runners; composeCmd() in
	# magefile.go falls back to `docker compose` (v2 plugin, always available).
	# Same standard/FIPS matrix as the unit test job above.
	compose:
	name: Compose integration tests (${{ matrix.build }})
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	include:
	- build: standard
	mage_target: test:integCompose
	- build: fips
	mage_target: test:integComposeFIPS
	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
	with:
	go-version-file: go.mod
	cache: true
	- name: Install Mage
	run: go install github.com/magefile/mage@v1.17.2
	- name: Start rngd (replenish entropy pool for FIPS crypto)
	if: matrix.build == 'fips'
	run: sudo apt-get install -y --no-install-recommends rng-tools && sudo rngd -r /dev/urandom
	- name: Run compose integration tests
	env:
	MAGE_TARGET: ${{ matrix.mage_target }}
	run: mage "$MAGE_TARGET"

	# -- Aggregate result ---------------------------------------------------------
	# Single fan-in job so branch protection only has to name one required check,
	# instead of every matrix leg above (which would also have to be updated by
	# hand each time a leg is added/renamed/removed).
	ci:
	name: CI success
	if: always()
	needs:
	- check
	- hadolint
	- markdownlint
	- mixin
	- chart
	- unit
	- dist
	- puppet
	- migration
	- backends-redis
	- backends-redis-go
	- backends-postgres
	- backends-mysql
	- backends-etcd
	- backends-openbao
	- compose
	runs-on: ubuntu-latest
	steps:
	- name: Decide whether the needed jobs succeeded or failed
	uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0
	with:
	jobs: ${{ toJSON(needs) }}

	# -- Auto-merge bot PRs -------------------------------------------------------
	# Holds contents: write / pull-requests: write and runs `gh pr merge`, so it
	# is pinned to a default-branch base. The repository's "Main" ruleset -- the
	# required reviews, status checks and code scanning that make an unattended
	# merge safe -- applies to ~DEFAULT_BRANCH only, so enabling auto-merge on a
	# PR targeting any other branch would merge it under no ruleset at all. The
	# workflow's pull_request trigger is deliberately unfiltered by base (see the
	# top of this file), which is what makes the condition load-bearing rather
	# than a restatement of the trigger.
	automerge:
	name: Enable auto-merge
	# The label exclusion is not decoration: renovate.json applies
	# 'review-signing-path' to bumps of the release signing surface (cosign,
	# Syft, actions/attest), and nothing in this workflow runs cosign — signing
	# happens in container-images.yml's merge job and in helm-chart.yml, which
	# has no pull_request trigger at all. Without this clause a bump that
	# changed signing behaviour would go green here, merge unattended, and
	# first misbehave on a tag. `mage dev:check` enforces the clause
	# (verifyAutomergeLabelExclusion), so it cannot be tidied away.
	if: >-
	github.event_name == 'pull_request'
	&& github.event.pull_request.base.ref == github.event.repository.default_branch
	&& !contains(github.event.pull_request.labels.*.name, 'review-signing-path')
	&& (github.event.pull_request.user.login == 'dependabot[bot]'
	\|\| github.event.pull_request.user.login == 'renovate[bot]')
	needs:
	- ci
	runs-on: ubuntu-24.04
	permissions:
	contents: write
	pull-requests: write
	steps:
	- name: Enable auto-merge for PR
	env:
	GH_TOKEN: ${{ github.token }}
	PR_URL: ${{ github.event.pull_request.html_url }}
	PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
	run: gh pr merge --auto --merge --match-head-commit "$PR_HEAD_SHA" "$PR_URL"

Navigation Menu

Uh oh!

Batch the supersession sweep's CRL re-sign #734

Workflow file

Batch the supersession sweep's CRL re-sign #734

Uh oh!

Workflow file for this run