From 5008de50526c2fe08aa0d81ef9a57ad9f1b528ba Mon Sep 17 00:00:00 2001 From: Thayne McCombs Date: Tue, 24 Mar 2026 02:21:40 -0600 Subject: [PATCH] fix: correct attestation subjects Use the original files as the source, rather than the file that is uploaded to the artifact, as that is actually a zip file (what?) Fixes: #1936 --- .github/workflows/CICD.yml | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/.github/workflows/CICD.yml b/.github/workflows/CICD.yml index 6ebd3c23..5208267a 100644 --- a/.github/workflows/CICD.yml +++ b/.github/workflows/CICD.yml @@ -275,19 +275,13 @@ jobs: unset IS_RELEASE ; if [[ $GITHUB_REF =~ ^refs/tags/v[0-9].* ]]; then IS_RELEASE='true' ; fi echo "IS_RELEASE=${IS_RELEASE}" >> $GITHUB_OUTPUT - - name: "Attest artifact: tarball" + - name: "Attest artifacts" uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4 if: steps.is-release.outputs.IS_RELEASE with: - subject-name: ${{ steps.package.outputs.PKG_NAME }} - subject-digest: sha256:${{ steps.upload-tarball.outputs.artifact-digest }} - - - name: "Attest artifact: Debian package" - uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4 - if: 'steps.is-release.outputs.IS_RELEASE && steps.debian-package.outputs.DPKG_NAME' - with: - subject-name: ${{ steps.debian-package.outputs.DPKG_NAME }} - subject-digest: sha256:${{ steps.upload-deb.outputs.artifact-digest }} + subject-path: | + ${{ steps.package.outputs.PKG_PATH }} + ${{ steps.debian-package.outputs.DPKG_PATH }} - name: Publish archives and packages uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1