Repository navigation
ci(release): stop uploading the attestation bundle to immutable releases - #99
Merged
Merged
Conversation
The v1.7.2 release run attested both artifacts but then failed with "HTTP 422: Cannot upload assets to an immutable release": this repository has immutable releases enabled, so nothing can be added once goreleaser has published. Drop the upload step and keep the attestation, which is stored in GitHub's attestation API and verified with gh attestation verify. The release footer now shows gh attestation download for offline verification instead of an attached bundle. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #99 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 6 6
Lines 552 552
=========================================
Hits 552 552
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The v1.7.2 release run attested both artifacts (
gh attestation verifypasses for the tarball and the SBOM) but the follow-up step failed withHTTP 422: Cannot upload assets to an immutable release. This repository has immutable releases enabled, so nothing can be added once goreleaser has published. The upload step is removed; the attestation stays in GitHub's attestation API, and the release footer now showsgh attestation downloadfor offline verification instead of promising an attached bundle. The v1.7.2 release notes were edited by hand to drop that paragraph.