Repository navigation
Back to one release workflow (L2); the daily OSV scan stays - #111
Merged
Merged
Conversation
release.yml, dispatched on main, builds, signs, attests and publishes in one job again, on its Blacksmith runner reading main's BuildKit cache, and its SAN is release.yml@refs/heads/main: nothing but this repository's main can invoke it, so the SAN binds the repository. The reusable builder never made the release L3 - task release shared the job with the id-token - and being callable from any repository it needed a guard and a pinned source repository to stay as safe as before. osv.yml and task osv stay, now checking the SBOM's signature against release.yml@refs/heads/main. go-tools back at 99d7447. Reverts f033995 and b207bee but for the OSV scan. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Decision 2026-10-13: the release stays at SLSA Build L2.
release.ymlis again the only release workflow: one job on Blacksmith, reading main's cache, with the SANrelease.yml@refs/heads/main. Nothing outside this repository's main can invoke it, so that SAN binds the repository; the guard and--certificate-github-workflow-repositoryare no longer needed.osv.ymlandtask osv(osv-scanner v2.7.0 in versions.yaml). Its signature check now pinsrelease.yml@refs/heads/main.task lint, versions and workflows tests green.🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.