From 7c3ec3d83f7de182911286796e9bfdd388fb279b Mon Sep 17 00:00:00 2001 From: forkwright Date: Thu, 3 Sep 2026 14:50:27 -0500 Subject: [PATCH] fix(ci): attest release provenance only on public repos Build-provenance attestation 403s on user-owned private repos ("Feature not available for user-owned private repositories"), so every release on this repo class burned red post-tag. The visibility guard keeps attestations for public callers and everything else for private ones. Gate-Passed: no-local-gate (docs/CI-only change to one workflow file; operative gate is the fleet reusable on this PR) --- .github/workflows/release-please.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 9bde866..99c3ab5 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -26,7 +26,12 @@ jobs: attest-release-source: needs: [release-please] - if: needs.release-please.outputs.release_created == 'true' + # WHY the visibility guard: build-provenance attestation 403s on + # user-owned PRIVATE repos ("Feature not available for user-owned private + # repositories"), so without it every release burns red post-tag on this + # repo class. Public callers keep the attestation; private callers keep + # everything else. The release itself already happened by this job's gate. + if: needs.release-please.outputs.release_created == 'true' && github.event.repository.visibility == 'public' runs-on: ubuntu-latest steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1