From c17bd864d0614d1bec5e39fa78c04cfea382331a Mon Sep 17 00:00:00 2001 From: elkaix Date: Fri, 11 Sep 2026 23:55:12 -0400 Subject: [PATCH 1/2] ci(release): smoke jobs verify the releasing repository, not pgrundev The image-runs and cosign-verify jobs pulled from and verified against pgrundev/pgbot by name, so on a fork they 404'd after a successful goreleaser. Derive both from GITHUB_REPOSITORY (lowercased for ghcr). --- .github/workflows/release.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 20f622e..0500dcc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -159,8 +159,9 @@ jobs: - name: anonymous docker run --version run: | VERSION="${GITHUB_REF_NAME#v}" + IMAGE="ghcr.io/$(echo "$GITHUB_REPOSITORY" | tr '[:upper:]' '[:lower:]')" docker logout ghcr.io || true # ensure the pull is anonymous - out="$(docker run --rm ghcr.io/pgrundev/pgbot:"$VERSION" --version)" + out="$(docker run --rm "$IMAGE":"$VERSION" --version)" echo "$out" case "$out" in "pgbot version"*) echo "image is public and runs ✓" ;; @@ -181,11 +182,11 @@ jobs: - name: cosign verify-blob --bundle run: | VERSION="${GITHUB_REF_NAME}" - base="https://github.com/pgrundev/pgbot/releases/download/${VERSION}" + base="https://github.com/${GITHUB_REPOSITORY}/releases/download/${VERSION}" curl -fsSL "$base/checksums.txt" -o checksums.txt curl -fsSL "$base/checksums.txt.cosign.bundle" -o checksums.txt.cosign.bundle cosign verify-blob --bundle checksums.txt.cosign.bundle \ - --certificate-identity-regexp '^https://github.com/pgrundev/pgbot/\.github/workflows/release\.yml@' \ + --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/\.github/workflows/release\.yml@" \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ checksums.txt echo "published cosign bundle verifies ✓" From 05a15d392ea9b6cb1102461ba7562877a77d0797 Mon Sep 17 00:00:00 2001 From: elkaix Date: Sat, 12 Sep 2026 00:06:14 -0400 Subject: [PATCH 2/2] ci(release): exact cosign certificate identity instead of an unescaped regexp --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 0500dcc..7dd327e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -186,7 +186,7 @@ jobs: curl -fsSL "$base/checksums.txt" -o checksums.txt curl -fsSL "$base/checksums.txt.cosign.bundle" -o checksums.txt.cosign.bundle cosign verify-blob --bundle checksums.txt.cosign.bundle \ - --certificate-identity-regexp "^https://github.com/${GITHUB_REPOSITORY}/\.github/workflows/release\.yml@" \ + --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/release.yml@${GITHUB_REF}" \ --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \ checksums.txt echo "published cosign bundle verifies ✓"