From ff194172c1a0b3579b45cd4fddad40bfaae04554 Mon Sep 17 00:00:00 2001 From: Chris Bargmann Date: Thu, 20 Aug 2026 10:17:26 +0200 Subject: [PATCH 1/3] ci: migrate attestation steps to actions/attest actions/attest-sbom and actions/attest-build-provenance are deprecated and today are thin wrappers around actions/attest, so this just cuts out the middleman. Inputs are identical (subject-name, subject-digest, sbom-path, push-to-registry), the attestation type is picked from the inputs -> sbom-path gives an SBOM attestation, no sbom-path gives SLSA build provenance. Pinned to 1e69f48 (v4 / v4.2.2). Same change as solution-arsenal#759 and artifact-conduit#460. --- .github/workflows/docker.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index 1c21eba..b699e8c 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -116,15 +116,17 @@ jobs: format: 'cyclonedx-json' output-file: 'sbom.cyclonedx.json' upload-release-assets: false + # actions/attest picks the attestation type from its inputs: sbom-path + # yields an SBOM attestation, its absence a SLSA build provenance one. - name: Attest SBOM - uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} subject-digest: ${{ steps.image.outputs.digest }} sbom-path: 'sbom.cyclonedx.json' push-to-registry: true - name: Attest provenance - uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} subject-digest: ${{ steps.image.outputs.digest }} From c60da6e168ed877b43e75af4bb33fbc98b4422ac Mon Sep 17 00:00:00 2001 From: Chris Bargmann Date: Thu, 20 Aug 2026 10:17:53 +0200 Subject: [PATCH 2/3] ci: stop creating artifact metadata storage records create-storage-record defaults to true whenever push-to-registry is set, so every attest step tries it and every one of them fails with "Failed to persist storage record: no artifacts found". Thats 2 warnings per image, 4 per build here, and it has never once succeeded. Storage records only feed the org Linked Artifacts page, which we dont use. The attestations themselves are unaffected, they still land in the repo and get pushed to ghcr. The error is not an auth failure either, the "check the artifact-metadata:write permission" hint the action prints after it is unconditional and the org check already passes -> adding that permission would be a guess. --- .github/workflows/docker.yaml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index b699e8c..89c1df4 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -118,6 +118,10 @@ jobs: upload-release-assets: false # actions/attest picks the attestation type from its inputs: sbom-path # yields an SBOM attestation, its absence a SLSA build provenance one. + # create-storage-record only feeds the org Linked Artifacts page, which + # we dont use. It defaults to true whenever push-to-registry is set and + # has only ever failed here with "no artifacts found", so turn it off + # rather than keep two bogus warnings per image in every build. - name: Attest SBOM uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: @@ -125,9 +129,11 @@ jobs: subject-digest: ${{ steps.image.outputs.digest }} sbom-path: 'sbom.cyclonedx.json' push-to-registry: true + create-storage-record: false - name: Attest provenance uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 with: subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} subject-digest: ${{ steps.image.outputs.digest }} push-to-registry: true + create-storage-record: false From 456816694dcafffb6ed569325473bab08a9b4290 Mon Sep 17 00:00:00 2001 From: Chris Bargmann Date: Thu, 20 Aug 2026 10:35:33 +0200 Subject: [PATCH 3/3] ci: spell out the full version in the attest pin comment Every other pin in this repo carries the full vX.Y.Z, 29 of 29, so a bare "# v4" was the odd one out. The SHA is what actually pins it, but the comment is what people read. --- .github/workflows/docker.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml index 89c1df4..5502cce 100644 --- a/.github/workflows/docker.yaml +++ b/.github/workflows/docker.yaml @@ -123,7 +123,7 @@ jobs: # has only ever failed here with "no artifacts found", so turn it off # rather than keep two bogus warnings per image in every build. - name: Attest SBOM - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} subject-digest: ${{ steps.image.outputs.digest }} @@ -131,7 +131,7 @@ jobs: push-to-registry: true create-storage-record: false - name: Attest provenance - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4 + uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2 with: subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} subject-digest: ${{ steps.image.outputs.digest }}