From 2395b00f63c7f62196f042ea786bc88b69dc54f6 Mon Sep 17 00:00:00 2001
From: Andrew Heberle <andrew.heberle@gmail.com>
Date: Tue, 6 Oct 2026 17:14:05 +0800
Subject: [PATCH] ci(attest): fix attesting openapi schema after file name
 change

---
 .github/workflows/release.yml | 2 +-
 AGENTS.md                     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a34c7a6c..30ebb469 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -53,7 +53,7 @@ jobs:
           sbom-path: sbom.spdx.json
       - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
-          subject-path: packages/core/schema.json
+          subject-path: packages/core/openapi.json
       - run: npm run release:ci:${{ inputs.release }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/AGENTS.md b/AGENTS.md
index ee6bc9ec..badc5789 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,6 +51,6 @@ Prefer the scripts in `package.json` over invoking tools directly.
 
 ## Boundaries
 - Don't commit secrets, tokens, or `.env` files.
-- Don't edit generated files (`worker-configuration.d.ts`); regenerate with `npm run cf-typegen`.
+- Don't edit generated files (`**/worker-configuration.d.ts` and `packages/core/openapi.json`); regenerate with `npm run cf-typegen` and `npm run schema` respectively.
 - Keep changes scoped to the task. No drive-by refactors or renames.
 - Do not change any of the OpenAPI surface as this could break clients.