From f8e904adf72674a999b86b1702ef1a0ba4d66821 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Mon, 14 Sep 2026 15:31:57 +0200 Subject: [PATCH] docs(attest-release-files): name the signer workflow in the verify hint The attestation is signed by this reusable workflow, not by the caller. `gh attestation verify --repo /` alone checks the signer against the caller repository and fails; the header now passes --signer-workflow with this workflow's path. Assisted-by: claude-code:claude-opus-5 Agent-Session: https://claude.ai/code/session_012BSvdctvVZ6Yz6nYUAA2p7 Agent-Host: 32116e Signed-off-by: Sebastian Mendel --- .github/workflows/attest-release-files.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/attest-release-files.yml b/.github/workflows/attest-release-files.yml index e056f69..db9623a 100644 --- a/.github/workflows/attest-release-files.yml +++ b/.github/workflows/attest-release-files.yml @@ -42,8 +42,10 @@ # with: # subject-path: 'dist/*' # same value as release-files # -# Verify afterwards with: -# gh attestation verify --repo / +# Verify afterwards with (this reusable workflow is the signer, so name it; +# `--repo` alone checks the signer against the caller repository and fails): +# gh attestation verify --repo / \ +# --signer-workflow netresearch/.github/.github/workflows/attest-release-files.yml # # SECURITY: pinned action SHAs, harden-runner, least-privilege job # permissions. `subject-path` reaches the run block only through `env:` and