From 03d49029a3057596bcead82ddf1274225692da0b Mon Sep 17 00:00:00 2001 From: Ruben Hensen Date: Thu, 22 Oct 2026 13:28:30 +0200 Subject: [PATCH] fix: don't create an artifact storage record for the image attestation The attest action creates a storage record by default, which needs artifact-metadata: write from every caller. We don't use storage records, so every run ended with a warning. The attestation itself is unchanged. --- .github/workflows/docker-publish.yml | 3 +++ CHANGELOG.md | 4 ++++ 2 files changed, 7 insertions(+) diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index e4f7a2d..8b1a38c 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -439,6 +439,9 @@ jobs: subject-name: ${{ steps.prepare.outputs.image }} subject-digest: ${{ steps.push.outputs.digest }} push-to-registry: true + # Storage records (org artifact metadata) need artifact-metadata: write + # from every caller; we don't use them, so don't create one. + create-storage-record: false - name: Install cosign if: steps.push.outputs.published == 'true' && inputs.cosign diff --git a/CHANGELOG.md b/CHANGELOG.md index e3d6298..d038ccc 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # Changelog +## v1.1.2 + +- `docker-publish.yml`: the provenance attestation no longer tries to create an artifact storage record. That needed `artifact-metadata: write` from every caller and only produced a warning; the attestation itself is unchanged. + ## v1.1.1 - Callers use the moving `@v1` tag again, as in v1.0. v1.1.0 asked for a commit SHA per caller, which meant a pull request in every repository for each release. `templates/zizmor.yml` allows a tag for `privacybydesign/*` again and still requires a SHA for every other action.