fix(ci): attest release provenance only on public repos - #134
Merged
Conversation
Build-provenance attestation 403s on user-owned private repos ("Feature not available for user-owned private repositories"), so every release on this repo class burned red post-tag. The visibility guard keeps attestations for public callers and everything else for private ones.
Gate-Passed: no-local-gate (docs/CI-only change to one workflow file; operative gate is the fleet reusable on this PR)
Merged
forkwright
pushed a commit
that referenced
this pull request
Sep 3, 2026
🤖 I have created a release *beep* *boop* --- <details><summary>0.3.0</summary> ## [0.3.0](v0.2.0...v0.3.0) (2026-09-03) ### Features * **phase-a:** derive public gate authority ([#123](#123)) ([9aa9a56](9aa9a56)) ### Bug Fixes * **ci:** attest release provenance only on public repos ([#134](#134)) ([9a2b090](9a2b090)) * **ci:** make the dependabot auto-merge guard refuse instead of merging ([#90](#90)) ([37d3f1b](37d3f1b)), closes [#89](#89) * **ci:** name the sha's real version on every action pin ([#119](#119)) ([254f210](254f210)) * **ci:** run CI on a pull request whose base is not main ([#92](#92)) ([4358b47](4358b47)) * **control:** validate registration responses into an exhaustive state machine ([#95](#95)) ([35f1b1f](35f1b1f)) * **deps:** pin koinon to v0.1.0 and clear the mechanical lint-baseline entries ([#73](#73)) ([8850220](8850220)), closes [#57](#57) [#61](#61) * **deps:** regenerate Cargo.lock so koinon matches the v0.2.0 the manifest already declares ([#124](#124)) ([6622e4c](6622e4c)) * **dictyon:** bound control-connection establishment with a deadline ([#76](#76)) ([62596f7](62596f7)), closes [#52](#52) * **dictyon:** index peer removals and refuse to frame an unframable payload ([#78](#78)) ([3f6011b](3f6011b)), closes [#55](#55) * **dictyon:** reject an over-limit key response before buffering it ([#79](#79)) ([3ecf9ce](3ecf9ce)), closes [#55](#55) * **dictyon:** validate server-supplied key-hex and routing-data fields at netmap ingestion ([#97](#97)) ([2f0bd71](2f0bd71)) * **gate-attestation:** pin hybrid-gate.yml call to a SHA, closing the lint-debt gap ([#91](#91)) ([32d4488](32d4488)) * **hamma-core:** decode a Node with no Addresses instead of failing the map update ([#72](#72)) ([f8ef9b2](f8ef9b2)) * **hamma-core:** drop a dead allow suppressing a lint that never fires ([#80](#80)) ([fa1ddfb](fa1ddfb)), closes [#57](#57) * **hamma-core:** enforce the documented config ranges at the deserialize boundary ([#77](#77)) ([f3b2335](f3b2335)) * **hamma-core:** redact the pre-auth key from AuthInfo debug output ([#74](#74)) ([9b0b747](9b0b747)), closes [#57](#57) * **handshake:** chunked AsyncRead header reader ([#81](#81)) ([00c38b9](00c38b9)), closes [#55](#55) * **lint:** burn down the kanon-lint debt baseline and delete it ([#86](#86)) ([8c420f3](8c420f3)), closes [#57](#57) * **llms:** classify dictyon as a library, not a CLI, in the discovery corpus ([#87](#87)) ([c1f7815](c1f7815)), closes [#85](#85) * **mitos:** zeroize AuthInfo::auth_key on drop ([#93](#93)) ([a39bca4](a39bca4)) * **noise:** add FrameTooLarge error taxonomy ([#83](#83)) ([e023a1a](e023a1a)), closes [#55](#55) * **noise:** validate hex length before allocation ([#82](#82)) ([8b8bad6](8b8bad6)), closes [#55](#55) * **release:** derive the path-dep version pin release-please patches ([#75](#75)) ([043cb5a](043cb5a)) * **release:** drop the component/package-name fields that wedge release-please ([#121](#121)) ([6b7380f](6b7380f)) ### Documentation * refresh the _llm state corpus and README status against the tree ([#120](#120)) ([20a7195](20a7195)) </details> --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Attestation 403s on user-owned private repos; the guard keeps the public-repo attestation and stops the post-release red on private ones. Diagnosed from gnomon's v0.1.4 post-release failure today.