Comments (3)
To answer you question, my original expected was for it to sign the items and upload them to the release, creating as needed.
Thanks for clarifying! This is an understandable confusion given our current docs; I think your suggestion makes sense.
Once that's addressed, we could look at how to make that easier to use by having it react correctly based on the trigger, for example upload new resources on a tag and sign and replace on a release.
Yes, this makes sense to me as a potential follow-on.
from gh-action-sigstore-python.
Thanks for the report @stevenh!
To make sure I understand: when you enabled release-signing-artifacts
on a non-release
trigger, what was your expected behavior? To me the name implies that the option can only work on releases (since ordinary tag events have no "object" in GitHub to attach artifacts to).
With that being said, the exception is 100% a bug on our part -- we should either ignore release-signing-artifacts
when GITHUB_EVENT
is not release
, or otherwise signal to the user that it's incompatible with their triggering event.
from gh-action-sigstore-python.
To answer your question, my original expected was for it to sign the items and upload them to the release, creating as needed.
Now I understand this wasn't the intent, but I was from reading both upload-signing-artifacts and release-signing-artifacts and the variance seems to indicate the key difference being general build artifacts vs release artifacts.
I was coming into this tool with experience of goreleaser and the behaviour there is as I described, if you enable signing from a tag workflow the result will be signed assets uploaded to the associated release.
The word in the docs I missed was re-uploads
which in hindsight was the key.
So what's the fix?
Clarify in the readme that release-signing-artifacts
currently works on an existing release so add details about the required on:
trigger.
Once that's addressed, we could look at how to make that easier to use by having it react correctly based on the trigger, for example upload new resources on a tag and sign and replace on a release.
Hope that helps?
from gh-action-sigstore-python.
Related Issues (20)
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- ImportError: cannot import name 'keys' from 'securesystemslib' HOT 6
- [CI] Self-test failure HOT 1
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- [CI] Self-test failure
- Use major version (e.g. @v2 instead of @v2.1.1) HOT 2
- Action fails on ubuntu-24.04 with "This environment is externally managed" HOT 3
- readme: Should the default example have "contents:write" ? HOT 3
- [FR] Return a list of signature paths as an output HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from gh-action-sigstore-python.