Skip to content

ci: run publish job on GitHub-hosted runner for reliable Sigstore egress #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
27Bslash6 merged 1 commit into from
Jun 6, 2026
+5 −1
Merged

ci: run publish job on GitHub-hosted runner for reliable Sigstore egress #42

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 5 additions & 1 deletion .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,11 @@ jobs:
# refs/heads/main stops a feature branch from publishing its own Cargo.toml).
# Explicit == 'true' avoids relying on string-coercion of the action output.
if: ${{ needs.release-please.outputs.release_created == 'true' || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') }}
runs-on: cachekit
# GitHub-hosted: the self-hosted ARC pods have unreliable DNS/egress to Sigstore
# (Fulcio/Rekor), which intermittently fails build-provenance + SBOM attestation
# and blocks publish. A hosted runner has reliable egress to Sigstore + crates.io,
# and the publish job is infrequent + free on public repos.
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
Expand Down
Loading