From 6bf7ff4139dbd05c2b31a010ae8a13f12d4d20ed Mon Sep 17 00:00:00 2001
From: Toddy Mladenov <toddysm@gmail.com>
Date: Thu, 2 Jul 2026 09:27:57 -0700
Subject: [PATCH] fix(build): pass --disable-path-validation to oras attach

oras now rejects the absolute temp file path passed to `oras attach`
("absolute file path detected"), failing the referrer-publish step.
The path is an intentional mktemp dir we control, so disable the check.
---
 .github/workflows/build-cssc-dashboard.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build-cssc-dashboard.yml b/.github/workflows/build-cssc-dashboard.yml
index d1646a3..9927fc6 100644
--- a/.github/workflows/build-cssc-dashboard.yml
+++ b/.github/workflows/build-cssc-dashboard.yml
@@ -241,6 +241,7 @@ jobs:
               --artifact-type application/vnd.in-toto+json \
               --annotation "in-toto.io/predicate-type=${pt}" \
               --annotation "org.opencontainers.image.title=${title}" \
+              --disable-path-validation \
               "${IMAGE}@${pd}" \
               "${work}/${title}:application/vnd.in-toto+json"
             echo "attached ${pt} referrer to ${IMAGE}@${pd}"