From bd5219aeea0b70adc4cdc7cad030d5d329baff37 Mon Sep 17 00:00:00 2001 From: Emir Hasanbegovic Date: Sun, 23 Aug 2026 11:52:10 -0400 Subject: [PATCH] fix(release): compile the SLSA generator from source Same 127 dish-linux hit on its first tag: a SHA-pinned generator call cannot resolve the prebuilt builder release. (cherry picked from commit c46a2abef4c0279172812d566298d47de2719000) --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7f7fcdb..981b905 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -421,6 +421,10 @@ jobs: base64-subjects: ${{ needs.harden.outputs.hashes }} provenance-name: dish-windows.intoto.jsonl upload-assets: false + # A SHA-pinned call cannot resolve the prebuilt builder's release, so + # the binary never downloads and the generator dies at exit 127; build + # it from source instead. + compile-generator: true # Publishes on both triggers. `tag_name` is explicit because on # workflow_dispatch github.ref is the default branch, not the tag that