Skip to content

Conversation

maennchen
Copy link
Member

Backported PRs:

The commits are based on the SBoM PR (#14241) which changed the actions.

Adding attestations: write permission fixes the issue. See
https://github.com/maennchen/elixir/actions/runs/17445512019/job/49539258297

Backported PRs:
* elixir-lang#14604
* elixir-lang#14627

The commits are based on the SBoM PR (elixir-lang#14241) which changed the
actions.
@ericmj
Copy link
Member

ericmj commented Sep 3, 2025

Why do we need this here but not on main?

@maennchen
Copy link
Member Author

There has been quite a lot of changes on the release.yaml file. (https://github.com/elixir-lang/elixir/commits/main/.github/workflows/release.yml) Most likely the SBoM one (#14241) or the permissions PR (#14333) made a difference when left out.

The sign job on main does not need the permission because it is not creating attestations. Instead build and sbom are. On v1.18, sign does create attestations.

It's quite hard at this point to point out why it resulted in the current state with the 2 backported commits.

@maennchen
Copy link
Member Author

maennchen commented Sep 3, 2025

(Looking at this now makes me wonder how git even succeeded to cherry pick those commits without any conflicts.)

@josevalim josevalim merged commit 66bb6da into elixir-lang:v1.18 Sep 5, 2025
12 checks passed
@josevalim
Copy link
Member

💚 💙 💜 💛 ❤️

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants