Re-enable SLSA build provenance once upstream supports Node24 runners

[felixgeelhaar]

Problem

The slsa-provenance job in .github/workflows/release.yml (slsa-framework/slsa-github-generator generator_generic_slsa3.yml@v2.1.0) started failing on every release: GitHub now forces Node20 actions onto Node24 runners, and v2.1.0's internal actions break under Node24 ("Input required and not supplied: path", exit 127). v2.1.0 is the latest release — there is nothing newer to bump to, and continue-on-error is not allowed on reusable-workflow jobs.

Confirmed: the job passed on v0.76.0 and failed on v0.77.0 (release itself succeeded — binaries, GHCR docker images, cosign sigs, SBOMs all published).

Interim (done)

Disabled the job via if: ${{ vars.ENABLE_SLSA_PROVENANCE == 'true' }} (unset = skipped). The release retains GitHub-native build-provenance attestation (the goreleaser job's actions/attest-build-provenance step), verifiable with gh attestation verify — so provenance is still attested, just not the SLSA-framework .intoto.jsonl.

To re-enable

When slsa-github-generator ships a Node24-compatible release:

1. Bump the uses: pin (SHA + version) in release.yml.
2. Set repo variable ENABLE_SLSA_PROVENANCE=true.

Refs: v0.77.0 release run, https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

[felixgeelhaar]

Investigated for the end-to-end sweep. Still upstream-blocked: slsa-framework/slsa-github-generator's latest release is v2.1.0 (2025-02-24) — there is no newer/Node24-compatible tag to bump to, and continue-on-error isn't permitted on reusable-workflow jobs, so the job cannot be made green as-is.

Provenance is adequately covered meanwhile without the framework generator:

• actions/attest-build-provenance attests the release archives (SLSA-compliant build provenance, gh attestation verify-able).
• GoReleaser's cosign signs: / docker_signs: sign the archives and the GHCR images.

Action: leave the job gated off (ENABLE_SLSA_PROVENANCE unset). Re-enable + bump the pin when upstream ships a Node24-compatible release — this issue tracks that. No code change needed now.

[felixgeelhaar]

Status as of v0.80.0 (2026-07-10)

Still upstream-blocked — no change actionable. Re-checked slsa-framework/slsa-github-generator: latest release is still v2.1.0 (2025-02-24), ~16 months old, with no Node24-compatible successor or RC. Nothing to bump the pin to.

Provenance has held across every release since — v0.79.0, v0.79.1, and now v0.80.0 all published successfully with:

• actions/attest-build-provenance — SLSA-compliant build provenance on the release archives (gh attestation verify-able).
• GoReleaser cosign signs: / docker_signs: — signed archives + GHCR images.

The slsa-provenance job remains gated off (ENABLE_SLSA_PROVENANCE unset); the goreleaser job is unaffected. No SLSA-framework .intoto.jsonl is the only gap.

Action unchanged: when upstream ships a Node24-compatible release, bump the uses: pin in release.yml and set ENABLE_SLSA_PROVENANCE=true. Keeping this issue open to track that. Verified: https://github.com/slsa-framework/slsa-github-generator/releases/latest