cynarAI/evOo-local
1
0
Fork 0
Code Issues Pull Requests Actions 3 Packages Projects Releases Wiki Activity

ci: skip image attestation on user-owned private repos (#103)

Browse Source 
GitHub artifact attestations are unavailable for private repositories
under personal accounts. The publish job already tags images successfully;
only the attest step failed. Gate attestation on visibility and owner type
so org and public repositories still attest.

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: cynarAI <cynarAI@users.noreply.github.com>
This commit is contained in:
cynarAI 2026-10-03 13:57:00 +02:00 committed by GitHub
parent 653ea6abe5
commit 110984b7bc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
.github/workflows/publish-server-image.yml vendored
View File

@ -256,7 +256,9 @@ jobs:
grep -Fqx "$want" <<< "$platforms" || { echo "$first_tag is missing $want" >&2; exit 1; } grep -Fqx "$want" <<< "$platforms" || { echo "$first_tag is missing $want" >&2; exit 1; }
done done
echo "digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT" echo "digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT"
# GitHub artifact attestations are unavailable for private repos on personal accounts.
- name: Attest the published image - name: Attest the published image
if: github.event.repository.private != true || github.repository_owner_type != 'User'
uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
with: with:
subject-name: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }} subject-name: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }}

3
infra/updater/src/publish-workflow.test.ts
View File

@ -41,6 +41,9 @@ describe("server image publish workflow", () => {
expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]'); expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]');
expect(workflowText).toContain("for want in linux/amd64; do"); expect(workflowText).toContain("for want in linux/amd64; do");
expect(workflowText).toContain("actions/attest-build-provenance@"); expect(workflowText).toContain("actions/attest-build-provenance@");
expect(workflowText).toContain(
"if: github.event.repository.private != true || github.repository_owner_type != 'User'",
);
}); });
it("stores digest markers under RUNNER_TEMP so self-hosted runners do not leak stale files", () => { it("stores digest markers under RUNNER_TEMP so self-hosted runners do not leak stale files", () => {