fix(release): bump sign-and-attest.yml pin to include SBOM-upload fix - #57
Merged
Conversation
The v0.1.0 tag's docker-sign job failed on the pinned commit (ca91728) because that commit's SBOM step tried to upload release assets with insufficient permissions (403). attested-delivery/.github#32 fixed this at f0c5cba; bump the pin so re-tagging v0.1.0 actually picks it up.
There was a problem hiding this comment.
Pull request overview
This PR updates the pinned commit SHA for the reusable sign-and-attest.yml workflow in the release pipeline so tagged releases can successfully generate and attest the image SBOM without failing on a 403 during the SBOM upload step.
Changes:
- Bump the
docker-signjob’s reusable workflow pin fromca91728…tof0c5cba…to pick up the upstream SBOM upload fix. - Update the surrounding inline comments to document why the pin changed (SBOM upload-release-assets permission failure).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
"#32" alone resolves to this repo's own issue #32 (an unrelated tutorial task), not attested-delivery/.github#32 (the actual fix this pin bump depends on). Spell out the owner/repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v0.1.0'sdocker-signjob failed (job 86801064430) because the centralsign-and-attest.ymlreusable, pinned atca91728, tried to upload the image SBOM as a release asset with insufficient permissions (403), skippingdocker-verify/gate-image/attest-container-scan.Root cause fixed upstream: attested-delivery/.github#32 (merged at
f0c5cba5).Change
Bumps this repo's
docker-signjob pin fromca91728tof0c5cba5so the fix actually takes effect on the next tagged run. No other pins touched — they weren't affected by #32.Verification
actionlint .github/workflows/release.ymlpasses clean.just checkpasses clean (build+lint+test).attested-delivery/.github'sorigin/mainHEAD post-merge.Prerequisite for closing out Task #43 (#43) — this repo's owner has authorized re-cutting the
v0.1.0tag once this merges, to get a fully-attested container image. Does not close #43 by itself; the re-tag and independent re-verification still need to happen after this merges.