Repository navigation
fix(release): attest-build-provenance@v4 needs subject-path, not path - #9164
Merged
Merged
Conversation
… (Refs #8996) First tag run (t27o-v0.1.0, run 38170030354) built and signed everything, then the attestation step refused: 'One of subject-path, subject-digest, or subject-checksums must be provided'. v4 dropped the old path input name. One-word fix; the release step never ran, so nothing was published and the tag is re-pushed after this merges. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
gHashTag
enabled auto-merge (squash)
October 11, 2026 20:11
Contributor
gHashTag
added a commit
that referenced
this pull request
Oct 12, 2026
…+ recipes AF4 round 2 (attest-input-rename) (#9297) Matrix-regen fired for the first time on real drift: gates.t27 was 3 rows off master (.github/workflows gained t27o-golden and t27o-release from #9147, and #9117 deleted brain-seal-refresh). Regen per docs/claw/README.md: census 61 blocking + 3 soft + 2 reporting, pins re-indexed (oracle-nightly 30->29, queen-publish 42->41, new rows pinned at 57/58 with their events). recipes.t27 AF4 round 2 (#9285): +1 verified row -- t27o-release / attest-input-rename (#9164: attest-build-provenance v4 renamed the input path -> subject-path; one-word workflow edit, then delete and re-push the tag). Table 21 -> 22 rows, census C_AUTO 16 / C_REVIEW 3 / C_OWNER 3. The fallback row's COND now carries the compare-vs-master discipline every night tick ran (a red on a PR describes the branch; its cause may be master; a stale failed run describes an old SHA). Two bound defects fixed in the same commit: - recipes all_kinds_unique kept 19-row while bounds through the 21-row table (rows 19-20 were never compared); it takes the row count as a parameter now, tied to COUNT by the test. - gates all_names_unique inner bound stayed 65 when the outer grew to 66: the computed range (i+1)..65 at i=65 inverts (66..65) and the lowering does not clamp it to empty -- the walk went wrong and no_duplicate_names_pairwise failed. Both bounds are 66 now, with a comment naming the trap; the unclamped inverted range is recorded for the compiler lane. Lab (fresh t27c from master tip): typecheck OK both files; gates 10/10 tests, recipes 11/11, 0 FAIL, 0 vacuous. ASCII clean, no new duplicate groups. Refs #9285, #9281. Part of #9271. Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
t27o releaseworkflow's first real run (tagt27o-v0.1.0, run 38170030354) built and cosign-signed everything, then died at the attestation step:attest-build-provenancev4 takessubject-path, notpath(the old name was dropped upstream). The workflow passeswith: {path: "dist/*"}, so the action saw no subject and failed; the release step never ran and nothing was published.One-word fix:
path->subject-path..github/workflows/t27o-release.ymlis already carried bytools/policy/foreign-exceptions.txt(#9160).After this merges, the tag is re-pushed at the new master tip so the release actually publishes.
Refs #8996
🤖 Generated with Claude Code