26479664586
95%

Ran 26 May 2026 10:56PM UTC

Jobs 1

Files 89

Run time 1min

Badge

Embed ▾

Committed 26 May 2026 10:50PM UTC coverage: 94.938%. Remained the same

Build # 26479664586

Build Type

push

github

Committed by

web-flow

Commit Message

fix(release-sign): pass SLSA subjects in SHA256SUMS format, not JSON (#534)

The SLSA generic generator v2.x expects `base64-subjects` to be a
SHA256SUMS payload (lines of `<sha256-hex>  <filename>`, two spaces
between), NOT the SLSA v1.x JSON array format I'd been producing.
Feeding the generator binary JSON triggered:

  sha: unexpected sha256 hash format for "[{\"name\":\"...\",\"digest\":{\"sha256\":\"...\"}}]"
  ##[error]Process completed with exit code 1.

(Observed in run 26478817397 after the @v2.1.0 tag-ref fix unblocked
the binary download — exposing the format mismatch behind it.)

Switch the build job's subjects payload from a JSON array to a single
SHA256SUMS line. The same line is reused for the .sha256 sidecar we
upload to the release, so build it once and base64 only for the SLSA
input. Confirmed the round-trip:

  $ printf '%s  %s\n' <sha> <name> | base64 | base64 -d
  <sha>  <name>

The SLSA v1.x JSON array format is no longer accepted by v2.x — the
generic generator's input contract was tightened to match the binary's
internal sha256sum -c style parser.

Refs: https://github.com/slsa-framework/slsa-github-generator/blob/v2.1.0/internal/builders/generic/README.md

Coverage Stats

13486 of 14205 relevant lines covered (94.94%)

383633.68 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	26479664586.1	26 May 2026 10:56PM UTC	89	94.94	GitHub Action Run

prisma-risk / tsoracle / 26479664586
95%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26479664586

prisma-risk / tsoracle / 26479664586 95%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 26479664586

prisma-risk / tsoracle / 26479664586
95%

README BADGES
x