From 23a6ac41ddedfe1ee38b7504564a43f3c988b635 Mon Sep 17 00:00:00 2001 From: JorisJonkers Agent Date: Thu, 9 Jul 2026 19:24:18 +0000 Subject: [PATCH] fix: remove tag from attest subject-name actions/attest-build-provenance (v2.2.3) validates subject-name as an OCI image name, which must NOT include a tag when push-to-registry is true. The action uses the subject-digest to construct the fully-qualified ref and rejects any ref that already includes a tag. Removes ":deploy-${version}" from subject-name; the digest alone is sufficient for attestation lookup. --- .github/workflows/deploy-artifact.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/deploy-artifact.yml b/.github/workflows/deploy-artifact.yml index 2bef56b..749d2ae 100644 --- a/.github/workflows/deploy-artifact.yml +++ b/.github/workflows/deploy-artifact.yml @@ -133,7 +133,7 @@ jobs: if: ${{ steps.publish.outputs.artifact-digest != '' }} uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3 with: - subject-name: ghcr.io/jorisjonkers-dev/${{ inputs.artifact-name }}:deploy-${{ inputs.artifact-version }} + subject-name: ghcr.io/jorisjonkers-dev/${{ inputs.artifact-name }} subject-digest: ${{ steps.publish.outputs.artifact-digest }} push-to-registry: true