From a51097e4e7f7d9982640b3daae026d57446ad72f Mon Sep 17 00:00:00 2001 From: MotherSphere Date: Sat, 1 Aug 2026 15:00:41 +0200 Subject: [PATCH] fix(ci): tell gh which repository to upload the signatures to The v0.2.0 release shipped WITHOUT its .sig files, and Colony's self-update verifies signatures fail-closed - so that release cannot be installed or updated to through the store. The signing itself worked. The upload did not: gh release upload "$TAG" dist/*.sig --clobber failed to run git: fatal: not a git repository The sign job deliberately has no `actions/checkout` - it downloads the built assets rather than the source - so there is no git repository for `gh` to infer the target from. The download step three lines above already passes `-R "\${{ github.repository }}"`; the upload step was missed. The failure mode is the worst kind: the job that exists to guarantee a release is never published unsigned reported red only AFTER the release was published, so it recorded the problem instead of preventing it. All four Colony satellite repos carry the identical defect. --- .github/workflows/release.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e5c7306..8383647 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -137,4 +137,10 @@ jobs: env: GH_TOKEN: ${{ github.token }} TAG: ${{ needs.release-please.outputs.tag_name }} - run: gh release upload "$TAG" dist/*.sig --clobber + # -R is not optional here. This job has no `actions/checkout`, so there + # is no git repository for `gh` to infer the target from, and it dies + # with "not a git repository" AFTER the assets have been signed. The + # download step above already passes it; this one was missed, and the + # release shipped unsigned while the job that was meant to prevent + # exactly that reported the failure too late to stop it. + run: gh release upload "$TAG" -R "${{ github.repository }}" dist/*.sig --clobber