From 9c1d0586ef5d46b481d5a401f7d247f172bfff70 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Tue, 8 Sep 2026 18:34:52 +0200 Subject: [PATCH] ci: skip the provenance attestation on test runs of build-agent A dispatch with upload_blob=false and create_release=false publishes nothing, so the Sigstore attestation would write a permanent public transparency-log entry for bytes nobody ever receives. The step now runs only when the run actually ships something. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/build-agent.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/build-agent.yml b/.github/workflows/build-agent.yml index 642a58e4..d515a725 100644 --- a/.github/workflows/build-agent.yml +++ b/.github/workflows/build-agent.yml @@ -471,7 +471,10 @@ jobs: # EXEs are subjects of their own so an extracted binary can be verified without the ZIP. # Runs after signing -- the digests must be those of the signed files. # Verify: gh attestation verify --repo okieselbach/AutopilotMonitor + # Skipped when a run neither uploads nor releases: a test dispatch would otherwise write + # a permanent entry to the public transparency log for bytes nobody ever receives. - name: Attest build provenance + if: inputs.upload_blob || inputs.create_release uses: actions/attest-build-provenance@v4 with: subject-path: |