mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 21:20:25 +00:00
Anso
023801c980
cosign matches --certificate-identity-regexp case-sensitively against the certificate SAN. The signed identity is https://github.com/Studio-Saelix/sencho/.github/workflows/docker-publish.yml@refs/tags/vX.Y.Z, so the lower-case org spelling in the documented commands failed to match: verified against saelix/sencho:0.97.1 with cosign 3.1.3, the lower-case form errors with "no matching CertificateIdentity found" and the capitalised form verifies. Registry paths (ghcr.io/studio-saelix/...) stay lower-case because the registry lower-cases them; only the certificate identity is capitalised. Also restate what actually guards publication. The Docker Hub credentials live in the production environment, that environment allows only v* tag deployments, and required reviewers are intentionally unset because the Release PR merge is the only approval step. The dev workflow no longer describes that environment as an approval gate; the real distinction is that the dev build never publishes to Docker Hub.