From d912712668b06f751dd69de550c608ab8e45a2b6 Mon Sep 17 00:00:00 2001
From: cynarAI <155274210+cynarAI@users.noreply.github.com>
Date: Sat, 3 Oct 2026 22:25:48 +0200
Subject: [PATCH] ci: pass the attestation lookup's jq filter to gh api without
 -r (#120)

Every image publish on main failed at "Resolve registry attestation
eligibility" with "accepts 1 arg(s), received 2". The step ran
`gh api ... --jq -r '.owner.type'`, but gh api has no -r option: --jq
took "-r" as its filter and the real filter became a second positional
argument. gh api --jq already prints strings without quotes, so the
filter is now passed directly. The images were built and their
manifests pushed; only the attestation decision failed.

The workflow test now rejects `--jq -r`. Run with the repository's
values, the fixed step reports a personal account and a private
repository and skips attestation, as the guard intends.


Claude-Session: https://claude.ai/code/session_01EyQw3AEaHYXegvgvTPAsi1

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/publish-server-image.yml | 4 ++--
 infra/updater/src/publish-workflow.test.ts | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish-server-image.yml b/.github/workflows/publish-server-image.yml
index 791958c..abd0398 100644
--- a/.github/workflows/publish-server-image.yml
+++ b/.github/workflows/publish-server-image.yml
@@ -263,8 +263,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          owner_type="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.owner.type')"
-          private="$(gh api "repos/${GITHUB_REPOSITORY}" --jq -r '.private')"
+          owner_type="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.owner.type')"
+          private="$(gh api "repos/${GITHUB_REPOSITORY}" --jq '.private')"
           if [[ "$owner_type" == "User" && "$private" == "true" ]]; then
             echo "enabled=false" >> "$GITHUB_OUTPUT"
             echo "Skipping registry attestation: unavailable for private repositories on personal accounts."
diff --git a/infra/updater/src/publish-workflow.test.ts b/infra/updater/src/publish-workflow.test.ts
index 4c9e292..9c80853 100644
--- a/infra/updater/src/publish-workflow.test.ts
+++ b/infra/updater/src/publish-workflow.test.ts
@@ -43,6 +43,8 @@ describe("server image publish workflow", () => {
     expect(workflowText).toContain("actions/attest-build-provenance@");
     expect(workflowText).not.toContain("github.repository_owner_type");
     expect(workflowText).toContain(`gh api "repos/\${GITHUB_REPOSITORY}"`);
+    // `gh api --jq` already prints raw strings; `--jq -r` takes `-r` as the filter and fails.
+    expect(workflowText).not.toContain("--jq -r");
     expect(workflowText).toContain(".owner.type");
     expect(workflowText).toContain("if: steps.attestation.outputs.enabled == 'true'");
     expect(workflowText).toContain('[[ "$owner_type" == "User" && "$private" == "true" ]]');