gsadmin/AutopilotMonitor
1
0
Fork 0
mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 04:32:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): use current repo slug in attestation verify hints

Browse Source 
gh attestation verify only passes with the repo's current name
(okieselbach/AutopilotMonitor); the signed workflow identity carries it,
and the old dashed name fails identity matching even though git-remote
redirects still work. Verified against the first attested dry-run ZIP.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Oliver Kieselbach
2026-07-17 11:22:15 +02:00
parent b2b99e78b4
commit 7377eb9e4d
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/build-agent.yml
+3 -3
View File
@@ -330,7 +330,7 @@ jobs:
# Sigstore keyless provenance: binds the ZIP digest to this workflow run (repo, ref,
# commit, workflow file) in a public transparency log. The digest covers the identical
# bytes uploaded to blob (versioned AND stable), so one attestation covers all copies.
# Verify: gh attestation verify <zip> --repo okieselbach/Autopilot-Monitor
# Verify: gh attestation verify <zip> --repo okieselbach/AutopilotMonitor
- name: Attest build provenance (ZIP)
uses: actions/attest-build-provenance@v4
with:
@@ -375,9 +375,9 @@ jobs:
- **Published as stable:** ${{ inputs.publish_as_stable }}
### Provenance
This ZIP carries a [GitHub Artifact Attestation](https://github.com/okieselbach/Autopilot-Monitor/attestations) (Sigstore keyless). Verify:
This ZIP carries a [GitHub Artifact Attestation](https://github.com/okieselbach/AutopilotMonitor/attestations) (Sigstore keyless). Verify:
```
gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/Autopilot-Monitor
gh attestation verify AutopilotMonitor-Agent-v${{ steps.version.outputs.version }}.zip --repo okieselbach/AutopilotMonitor
```
draft: false
prerelease: ${{ inputs.prerelease }}
docs/agent/build-counter-blob.md
+1 -1
View File
@@ -57,7 +57,7 @@ attestation on top.
`actions/attest-build-provenance` (Sigstore keyless, bound to the workflow OIDC
identity). The digest covers the identical bytes uploaded to blob, so one
attestation covers all copies. Verify:
`gh attestation verify <zip> --repo okieselbach/Autopilot-Monitor`. Local builds
`gh attestation verify <zip> --repo okieselbach/AutopilotMonitor`. Local builds
cannot produce this attestation — provenance is a CI-only property.
# Citations