From d73d7cd3de4292f829b24c4f5ec06a46be8528ac Mon Sep 17 00:00:00 2001
From: JorisJonkers Agent <agents@jorisjonkers.dev>
Date: Thu, 9 Jul 2026 18:35:08 +0000
Subject: [PATCH] fix: add subject-name to attest-build-provenance step

The actions/attest-build-provenance action requires subject-name when
subject-digest is provided. Added the OCI ref (ghcr.io/jorisjonkers-dev/
<artifact-name>:deploy-<version>) as the subject name, matching the tag
scheme used in publish.sh.
---
 .github/workflows/deploy-artifact.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/deploy-artifact.yml b/.github/workflows/deploy-artifact.yml
index 685afd5..2bef56b 100644
--- a/.github/workflows/deploy-artifact.yml
+++ b/.github/workflows/deploy-artifact.yml
@@ -133,6 +133,7 @@ jobs:
         if: ${{ steps.publish.outputs.artifact-digest != '' }}
         uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
+          subject-name: ghcr.io/jorisjonkers-dev/${{ inputs.artifact-name }}:deploy-${{ inputs.artifact-version }}
           subject-digest: ${{ steps.publish.outputs.artifact-digest }}
           push-to-registry: true