26476146809
95%

Ran 26 May 2026 09:33PM UTC

Jobs 1

Files 89

Run time 1min

Badge

Embed ▾

Committed 26 May 2026 09:27PM UTC coverage: 94.991%. Remained the same

Build # 26476146809

Build Type

push

github

Committed by

web-flow

Commit Message

fix(release-sign): upload .intoto.jsonl ourselves to support immutable releases (#521)

ci(release-sign): upload .intoto.jsonl ourselves to support immutable releases

The SLSA generator's upload-assets path uses softprops/action-gh-release,
which PATCHes the release record (target_commitish). On repos with the
"Make release tags immutable" setting enabled, that PATCH is rejected:

  Validation Failed: target_commitish cannot be changed when
  release is immutable

(Observed in run 26474552375 on tsoracle-driver-openraft-v0.3.3 backfill.)

Flip upload-assets to false (default), let the generator emit the
.intoto.jsonl as a workflow artifact, and add a second download-artifact
step in the attach job to fetch it. `gh release upload` only touches
asset slots — release metadata is left untouched, so it works against
immutable releases. Drop the now-redundant contents:write permission
from the provenance job and the upload-tag-name input (no longer
relevant when not uploading).

Coverage Stats

13445 of 14154 relevant lines covered (94.99%)

345035.08 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	26476146809.1	26 May 2026 09:33PM UTC	89	94.99	GitHub Action Run

prisma-risk / tsoracle / 26476146809
95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26476146809

prisma-risk / tsoracle / 26476146809 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26476146809

prisma-risk / tsoracle / 26476146809
95%

README BADGES
x