chore: update repo-platform template to build@dbb1eda539ab - #74
Merged
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Update update-release.yml and SECURITY.md to use the renamed attestation.json asset.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the repo-platform template revision and adopts the renamed Sigstore attestation bundle.
Changes:
- Advances template provenance to
dbb1eda. - Renames the release attestation asset to
attestation.json. - Revises release asset detection and cleanup.
File summaries
| File | Review |
|---|---|
.github/workflows/release.yml |
Updates attestation handling, but repository-owned consumers still reference attestation.jsonl. |
.github/repo-platform-manifest.json |
Records updated template hashes and revision. |
.github/.copier-answers.yml |
Advances the Copier template reference. |
Review details
Suppressed comments (1)
.github/workflows/release.yml:133
- The filename migration leaves
attestation.jsonlbundles from pre-update attempts untouched. Such a bundle is counted as a release asset, downloaded and attested as a subject, and then published alongside the new bundle, defeating the stale-bundle cleanup this step promises. Delete both the current and legacy bundle names during the transition.
"$BUNDLE_NAME") gh release delete-asset "$TAG" "$name" --yes ;;
- Files reviewed: 3/3 changed files
- Comments generated: 1
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+118
to
+120
| # One Sigstore bundle covering every asset, under the attest action's | ||
| # own file name. | ||
| BUNDLE_NAME: attestation.json |
Vivswan
added a commit
that referenced
this pull request
Sep 4, 2026
…asset check and SECURITY.md (#76) ## What this changes The template sync in #74 renamed the attestation bundle the managed publish stage attaches: ```text .github/workflows/release.yml (managed) BUNDLE_NAME: attestation.json .github/workflows/update-release.yml:171 select(. != "attestation.jsonl") <- still the old name SECURITY.md:34 --bundle against the `attestation.jsonl` release asset ``` ## How ```text before: publish attaches attestation.json -> a rerun's asset check sees [attestation.json index.js settings.schema.json] != expected -> pipeline stops after: asset check ignores attestation.json AND attestation.jsonl (a pre-rename attempt's leftover the managed cleanup does not delete) ``` - `update-release.yml`: the ignore list names both bundle names, with the reason beside it; comments follow the rename. - `SECURITY.md`: `gh attestation verify --bundle` points at `attestation.json`. Raised by the Copilot review on #74. Its other note, the managed `release.yml` deleting only the current bundle name on reruns, belongs to Vivswan/repo-platform and is not touched here. ## Proof - yamllint and actionlint green on the workflow; `git grep attestation.jsonl` leaves only the deliberate legacy-name ignore. - Rubber-duck review (codex): no findings.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Automated template update from
Vivswan/repo-platform(build branch).79b961bbuild@dbb1eda539abReview any merge conflicts and confirm repository-local sections were preserved before merging.
Note
This branch is regenerated on every sync run; manual commits
pushed to it are overwritten. Make fixes in a separate branch or
after merging.
Split-class files were rebuilt structurally over this update: the managed
region comes from a clean render at the new template ref, the
repository-owned content outside it byte-for-byte from the previous
commit, and copier's merged result for these files was discarded. Local
edits inside a managed region do NOT survive this rebuild (managed
regions are template-owned); such edits are reset and flagged below.
Each bullet names its file's actual disposition (not every file has
previous content to carry); verify each file's diff before merging:
.gitignore: repository-owned content outside the managed region restored from the repository's copyAGENTS.md: repository-owned content outside the managed region restored from the repository's copyCONTRIBUTING.md: repository-owned content outside the managed region restored from the repository's copySECURITY.md: repository-owned content outside the managed region restored from the repository's copy