fix(release): promote project version after attestation push#2807
fix(release): promote project version after attestation push#2807jiparis merged 3 commits intochainloop-dev:mainfrom
Conversation
Move the "Promote Chainloop Project Version" step from the release job to the finish_attestation job, ensuring it runs after chainloop attestation push. This prevents policy evaluations during push from referencing the renamed version instead of the original one. Closes chainloop-dev#2805 Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
Kusari Analysis Results:
No pinned version dependency changes, code issues or exposed secrets detected! Note View full detailed analysis result for more information on the output and the checks that were run.
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name=".github/workflows/release.yaml">
<violation number="1" location=".github/workflows/release.yaml:231">
P2: Potential script injection: `${{ needs.release.outputs.current_version }}` is interpolated directly in a `run:` block. GitHub's security hardening guide recommends passing expressions through `env:` to prevent injection if the value contains shell metacharacters.
Use an intermediate environment variable instead of direct interpolation.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Pass needs.release.outputs.current_version and github.ref_name through env variables instead of interpolating them directly in the run block. Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
|
Kusari PR Analysis rerun based on - c2cc912 performed at: 2026-03-02T16:37:44Z - link to updated analysis |
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
2 participants
Summary
releasejob to thefinish_attestationjob so it runs afterchainloop attestation push, not beforereleasetofinish_attestationCloses #2805