From 92c352f3a8a305c2c5a84d79a09e5be071246a89 Mon Sep 17 00:00:00 2001 From: shcommit Date: Wed, 2 Sep 2026 09:48:23 +0900 Subject: [PATCH] fix: skip release attestation on a private repo, bump to 0.3.1 The v0.3.0 tag's release run failed at the attestation step -- GitHub's attestation API rejects it for a user-owned private repository ("Feature not available for user-owned private repositories"), which could only be discovered against a real tag push. The job never reached "Create GitHub Release", so v0.3.0 has no published release. release.yml now guards the attestation step on `!github.event.repository.private`, so it skips cleanly now and starts running automatically once this repository goes public -- no workflow change needed then. The archive and its checksum are unaffected. SECURITY.md documents the current gap. Version bumped to 0.3.1; this release supersedes the never-published v0.3.0 tag. --- .claude-plugin/plugin.json | 2 +- .github/workflows/release.yml | 8 ++++++++ SECURITY.md | 11 ++++++++++- adapters/antigravity/plugin.json | 2 +- adapters/gemini-cli/gemini-extension.json | 2 +- changelog.md | 12 ++++++++++++ skills/adr-toolkit/SKILL.md | 2 +- skills/adr-toolkit/VERSION | 2 +- 8 files changed, 35 insertions(+), 6 deletions(-) diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json index eec16f3..447cf52 100644 --- a/.claude-plugin/plugin.json +++ b/.claude-plugin/plugin.json @@ -1,5 +1,5 @@ { "name": "adr-toolkit", - "version": "0.3.0", + "version": "0.3.1", "description": "Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions." } diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9d65cf4..571b37a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -51,6 +51,14 @@ jobs: sha256sum "$ARCHIVE" > "${ARCHIVE}.sha256" echo "archive=$ARCHIVE" >> "$GITHUB_OUTPUT" - name: Generate build provenance attestation + # GitHub's attestation API rejects this for a user-owned private + # repository ("Feature not available for user-owned private + # repositories") -- discovered on the v0.3.0 tag push, since this + # can only be confirmed against a real tag push, not a local dry + # run. Skipped while private; starts running automatically once + # this repository goes public (see docs/decisions/0016 and the + # project's public-transition plan), no workflow change needed. + if: ${{ !github.event.repository.private }} uses: actions/attest-build-provenance@v2 with: subject-path: ${{ steps.package.outputs.archive }} diff --git a/SECURITY.md b/SECURITY.md index 2332879..d4d34a4 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -29,6 +29,14 @@ signature -- no private key is held or rotated by this project -- proving the archive was produced by this repository's own CI, from the exact commit the release tag points to. +**While this repository is private, attestation is not generated** -- +GitHub's attestation API rejects it for a user-owned private repository. +The release workflow skips that step automatically and still publishes +the archive and its checksum; attestation starts appearing on releases +once the repository goes public, with no workflow change required. Check +a given release's assets on the Releases page to see whether an +attestation is available for it. + To verify a downloaded archive: ```bash @@ -36,7 +44,8 @@ To verify a downloaded archive: sha256sum -c adr-toolkit-skill-vX.Y.Z.tar.gz.sha256 # Provenance: confirms the archive was actually built by this repo's CI, -# not a look-alike release from a compromised account or a different repo +# not a look-alike release from a compromised account or a different repo. +# Only available once this repository is public -- see the note above. gh attestation verify adr-toolkit-skill-vX.Y.Z.tar.gz -R SHcommit/ADR-toolkit ``` diff --git a/adapters/antigravity/plugin.json b/adapters/antigravity/plugin.json index b9d857f..00d9b6d 100644 --- a/adapters/antigravity/plugin.json +++ b/adapters/antigravity/plugin.json @@ -1,6 +1,6 @@ { "$schema": "https://antigravity.google/schemas/v1/plugin.json", "name": "adr-toolkit", - "version": "0.3.0", + "version": "0.3.1", "description": "Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions." } diff --git a/adapters/gemini-cli/gemini-extension.json b/adapters/gemini-cli/gemini-extension.json index eec16f3..447cf52 100644 --- a/adapters/gemini-cli/gemini-extension.json +++ b/adapters/gemini-cli/gemini-extension.json @@ -1,5 +1,5 @@ { "name": "adr-toolkit", - "version": "0.3.0", + "version": "0.3.1", "description": "Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions." } diff --git a/changelog.md b/changelog.md index 3e3a945..a05423a 100644 --- a/changelog.md +++ b/changelog.md @@ -4,6 +4,18 @@ Lightweight human-readable summary of meaningful repository changes. ## Unreleased +## v0.3.1 (2026-09-02) + +- Fixed the release workflow: GitHub's Artifact Attestation API rejects + attestation for a user-owned private repository, which broke the + `v0.3.0` tag's release run before it could publish anything (that tag + exists in git history but has no corresponding GitHub Release -- this + release supersedes it). `.github/workflows/release.yml` now skips the + attestation step while this repository is private and will start + running it automatically once the repository goes public; the + packaged archive and its SHA-256 checksum are unaffected and still + published on every release. `SECURITY.md` documents this. + ## v0.3.0 (2026-09-02) - Recorded this release's architectural decisions as ADR-0012 through diff --git a/skills/adr-toolkit/SKILL.md b/skills/adr-toolkit/SKILL.md index 3a103db..d781ea1 100644 --- a/skills/adr-toolkit/SKILL.md +++ b/skills/adr-toolkit/SKILL.md @@ -2,7 +2,7 @@ name: adr-toolkit description: Initialize, record, and check Architecture Decision Records by inspecting the repository and existing decisions before asking questions. user-invocable: true -version: 0.3.0 +version: 0.3.1 --- # ADR Toolkit diff --git a/skills/adr-toolkit/VERSION b/skills/adr-toolkit/VERSION index 9325c3c..a2268e2 100644 --- a/skills/adr-toolkit/VERSION +++ b/skills/adr-toolkit/VERSION @@ -1 +1 @@ -0.3.0 \ No newline at end of file +0.3.1 \ No newline at end of file