From 6c241aad78956031d9fab8eec9ec39a36f8beb85 Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Mon, 13 Jul 2026 00:36:47 -0400 Subject: [PATCH] fix(sign-and-attest): disable release-asset upload on image SBOM step anchore/sbom-action's own upload-release-assets default (true) tries to attach the SBOM to a GitHub Release matching the run's tag name. This job only grants contents: read, so any tagged caller with a matching release (e.g. go-htmx's v0.1.0) gets a 403 "Resource not accessible by integration" on that step, failing the job after the image is already signed and the SBOM already generated, skipping every downstream verify/gate/scan job. The SBOM is already published as a cosign-attested OCI referrer two steps later, so the upload-artifact/upload-release-assets side effects are unnecessary here, matching the fix already applied to the binary-path sbom job in caller workflows. --- .github/workflows/sign-and-attest.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/sign-and-attest.yml b/.github/workflows/sign-and-attest.yml index 5723b48..7756ad4 100644 --- a/.github/workflows/sign-and-attest.yml +++ b/.github/workflows/sign-and-attest.yml @@ -94,6 +94,13 @@ jobs: run: cosign sign --yes "${IMAGE_REF}" # --- CycloneDX SBOM, attested as an OCI referrer --- + # upload-artifact/upload-release-assets disabled: the SBOM is already + # published as a cosign-attested OCI referrer below, and this job's + # `contents: read` permission can't satisfy the action's own default + # `upload-release-assets: true` (it tries to attach to a GitHub + # Release matching the tag name, which 403s as "Resource not + # accessible by integration") — mirrors the identical fix already + # applied to the binary-path `sbom` job in caller repos. - name: Generate CycloneDX SBOM if: ${{ inputs.sbom }} uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0 @@ -101,6 +108,8 @@ jobs: image: ${{ env.IMAGE_REF }} format: cyclonedx-json output-file: sbom.cdx.json + upload-artifact: false + upload-release-assets: false - name: Attest SBOM (cosign) if: ${{ inputs.sbom }} run: |