From dc84694353fa493a9a4bfd33339873d22abd3f0d Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Sat, 3 Oct 2026 11:25:10 +0000 Subject: [PATCH] ci: skip image attestation on user-owned private repos GitHub artifact attestations are unavailable for private repositories under personal accounts. The publish job already tags images successfully; only the attest step failed. Gate attestation on visibility and owner type so org and public repositories still attest. Co-authored-by: cynarAI --- .github/workflows/publish-server-image.yml | 2 ++ infra/updater/src/publish-workflow.test.ts | 3 +++ 2 files changed, 5 insertions(+) diff --git a/.github/workflows/publish-server-image.yml b/.github/workflows/publish-server-image.yml index 22dd357..dedea74 100644 --- a/.github/workflows/publish-server-image.yml +++ b/.github/workflows/publish-server-image.yml @@ -256,7 +256,9 @@ jobs: grep -Fqx "$want" <<< "$platforms" || { echo "$first_tag is missing $want" >&2; exit 1; } done echo "digest=$(docker buildx imagetools inspect "$first_tag" --format '{{.Manifest.Digest}}')" >> "$GITHUB_OUTPUT" + # GitHub artifact attestations are unavailable for private repos on personal accounts. - name: Attest the published image + if: github.event.repository.private != true || github.repository_owner_type != 'User' uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 with: subject-name: ghcr.io/${{ steps.ns.outputs.repo }}/${{ matrix.name }} diff --git a/infra/updater/src/publish-workflow.test.ts b/infra/updater/src/publish-workflow.test.ts index bf1faef..f75de81 100644 --- a/infra/updater/src/publish-workflow.test.ts +++ b/infra/updater/src/publish-workflow.test.ts @@ -41,6 +41,9 @@ describe("server image publish workflow", () => { expect(workflowText).toContain('if [[ "${#sources[@]}" -ne 1 ]]'); expect(workflowText).toContain("for want in linux/amd64; do"); expect(workflowText).toContain("actions/attest-build-provenance@"); + expect(workflowText).toContain( + "if: github.event.repository.private != true || github.repository_owner_type != 'User'", + ); }); it("stores digest markers under RUNNER_TEMP so self-hosted runners do not leak stale files", () => {