From d5930a31de9afa9cc0d19f764cbaed920e9aa34f Mon Sep 17 00:00:00 2001 From: Emir Hasanbegovic Date: Sun, 23 Aug 2026 11:52:06 -0400 Subject: [PATCH] fix(release): compile the SLSA generator from source A SHA-pinned generator call cannot resolve which prebuilt builder release to download, so the binary never arrives and the generator dies at exit 127. compile-generator builds it from source; satellite's 1.0.0 shipped with exactly this flag on the same pin. --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b1fa016..dde21ad 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -660,6 +660,10 @@ jobs: base64-subjects: ${{ needs.harden.outputs.hashes }} provenance-name: dish-linux.intoto.jsonl upload-assets: false + # A SHA-pinned call cannot resolve the prebuilt builder's release, so + # the binary never downloads and the generator dies at exit 127; build + # it from source instead. + compile-generator: true publish: name: Publish to GitHub Releases