mirror of
https://github.com/danderson1988/visual-notes.git
synced 2026-07-22 08:30:17 +00:00
45c51c8e48
Three releases (1.0.13, 1.0.16, 1.0.17) failed Obsidian's review with "attestation exists but signature is invalid or does not match this repository" despite trying attest-build-provenance v1, v2, and actions/attest v4. Decoding the actual published bundles via the attestations API shows they are well-formed sigstore v0.3 bundles whose Fulcio certificates correctly identify this repo and workflow — the verification failure is on the checker's side and not fixable from here. Since a present-but-unverifiable attestation is a review Error while a missing one is only a Recommendation, the attest step is removed (comment in the workflow explains why, so it doesn't get re-added blindly). Attestations are permanent and keyed by file digest, and source didn't change across 1.0.13-1.0.17, so the old broken attestations still cover the current main.js/styles.css bytes. To escape them: - esbuild now emits a version-stamped banner comment in main.js (also makes installed copies identifiable) - styles.css header comment gains the repo URL Verified via the API that the new digests have zero attestations.
50 lines
1.5 KiB
YAML
50 lines
1.5 KiB
YAML
name: Release Obsidian plugin
|
|
|
|
on:
|
|
push:
|
|
tags:
|
|
- "*"
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v5
|
|
|
|
- name: Setup Node.js
|
|
uses: actions/setup-node@v5
|
|
with:
|
|
node-version: "24.x"
|
|
cache: "npm"
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Build plugin
|
|
run: npm run build
|
|
|
|
# NOTE: no attestation step, deliberately. Attestations generated here
|
|
# (attest-build-provenance v1/v2, actions/attest v4 — all tried) are
|
|
# cryptographically well-formed and correctly identify this repo, but
|
|
# Obsidian's release checker fails to verify them ("signature is
|
|
# invalid or does not match this repository"), turning an optional
|
|
# nice-to-have into a hard review Error. A missing attestation is only
|
|
# a soft Recommendation. Attestations are also permanent and keyed by
|
|
# file digest — re-attesting unchanged bytes stacks more of them — so
|
|
# don't re-add this step unless Obsidian's verifier is confirmed fixed.
|
|
- name: Create release
|
|
uses: softprops/action-gh-release@v2
|
|
with:
|
|
tag_name: ${{ github.ref_name }}
|
|
name: ${{ github.ref_name }}
|
|
draft: true
|
|
generate_release_notes: true
|
|
files: |
|
|
main.js
|
|
manifest.json
|
|
styles.css
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|