Skip to content

fix: authenticate release attestation checks #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cristibleotiu merged 1 commit into from
Aug 19, 2026
Merged

fix: authenticate release attestation checks #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -424,6 +424,7 @@ jobs:

- name: Sign and verify the exact digest
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
IMAGE_REF: ${{ steps.image.outputs.ref }}
run: |
set -euo pipefail
Expand Down
4 changes: 2 additions & 2 deletions source/manifest.sha256
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
62e8086d12da15c097919ac4638fb1d2663fc4e681d5b445eb5674b2e0a5f3b8 .gitattributes
1e67bf680bc339b93c4587430053354ce2cc63fee29a61cf27c3bc00258fb682 .github/workflows/ci.yml
f53d3da2d034b1db8cf6c3d4120c43ec798a5b1b452ca77ecb51576fc994b21d .github/workflows/cloudflare-cleanup.yml
e61cd4e6080971e276474c616ffb3e1f75be9401e903ef8a8d1a22635d4c27cf .github/workflows/release.yml
e0edcb3d626886e2fbbe4fc8d7997e8d717c2ffeecc71407f8d9db95b2828aa8 .github/workflows/release.yml
eb7f3d450b8fbf95dba22be5e077277ff7a8f49631e36e8b5e8ac89c49324f95 .github/workflows/security.yml
696452e46b8506219542eb7135c99419725055c59bd15e00e610d567d3a67ac6 .gitignore
fe73738d8611a7a6f2c6cfb90c848e2199af7c2bad05e8c40275b8dc8b0efab7 Dockerfile
Expand Down Expand Up @@ -12140,5 +12140,5 @@ c7bacb9dffc56a0411b55022538de645e5fa8fb18455e397d782366a9d371114 tests/runtime-
8e321ca8065577c96f3dfa35c96deb21771a001c76775ac2ecc7295a316ad2a3 tests/runtime-supervision/tail-test-stub.sh
91b1138b515c45788533118b27f08efd49013e6e9806166580d6e14e2d8c0680 tests/test_cloudflare_cleanup_recovery.py
7be07ef767a2132c79ae431847edce048b935aae4fc5e71fc938005a16460a23 tests/test_cloudflare_ephemeral_tunnels.py
66f62eea21d17237561425286428337e3189e51d1b53458e129994605dc5b9a9 tests/test_release_contract.py
36e9cdfb1a7cf921af62bc9294cb92752837795d55cabc124c003ac6986bc8f1 tests/test_release_contract.py
a52e62e437de00e1504c383419056e96cddf18b15a85e0053f63136184bb7722 tests/test_sbom_contract.py
9 changes: 9 additions & 0 deletions tests/test_release_contract.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1026,6 +1026,15 @@ def test_cosign_v3_uses_bundle_aware_installer(self):
workflow,
)

def test_release_attestation_verification_has_scoped_github_token(self):
release = read(".github/workflows/release.yml")
signing_step = release[
release.index(" - name: Sign and verify the exact digest"):
release.index(" - name: Prove public anonymous pull before tag promotion")
]
self.assertIn("GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}", signing_step)
self.assertIn("gh attestation verify", signing_step)

def test_ghcr_tag_inspection_fails_closed(self):
fake_curl = r'''#!/usr/bin/env bash
set -euo pipefail
Expand Down
Loading