You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: .github/workflows/native-cli-publish.yml
+11Lines changed: 11 additions & 0 deletions
Original file line number
Diff line number
Diff line change
@@ -213,6 +213,17 @@ jobs:
213
213
exit 1
214
214
fi
215
215
release_sha="${TARGET_SHA}"
216
+
# Why publishing is blocked here: the attestation certificate binds
217
+
# SourceRepositoryDigest to the workflow run head (GITHUB_SHA), never
218
+
# to the checked-out build commit, so assets published for an older
219
+
# release commit can never pass the dispatcher's tag-to-certificate
220
+
# verification. Recovery dispatch may only validate builds.
221
+
if [ "${should_publish}" = "true" ] && [ "${release_sha}" != "${GITHUB_SHA}" ]; then
222
+
echo "Recovery-target dispatch cannot publish release assets: the release commit ${release_sha} differs from the run head ${GITHUB_SHA}, so the attestation certificate digest would never match the release tag." >&2
223
+
echo "Rerun the original failed workflow run whose head commit is the release commit instead." >&2
224
+
echo "See docs/release-recovery-runbook.md for the recovery procedure." >&2
225
+
exit 1
226
+
fi
216
227
else
217
228
if [ "${BUILD_SHA}" != "${GITHUB_SHA}" ] || [ "${TARGET_SHA}" != "${GITHUB_SHA}" ]; then
218
229
echo "Build SHA and release target must match the approved event commit." >&2
Copy file name to clipboardExpand all lines: Packages/src/Editor/FirstPartyTools/Common/InputSimulation/UnityCLILoop.FirstPartyTools.Common.InputSimulation.Editor.asmdef
0 commit comments