release: every workflow names the predicate type the statement actually carries

The third thing the first real release found, and this refusal was correct.

Phase C stopped with "the release notes tell people to pass --predicate-type
https://spdx.dev/Document and the statement that was just made is
https://spdx.dev/Document/v2.3". That check exists precisely because the
provenance plan wrote the URI down as a promise taken from the action's
documentation rather than from an attestation, and said out loud it was
unmeasured. It has now been measured: the statement carries the versioned one.

The value was written in five places across three files and only one of them
was being checked. Three of the five are not checks at all - they are the
commands a person copies out of the release notes, and with the wrong URI gh
answers "no attestation found", which reads exactly like a release nobody
attested.

It cannot be written once: three workflows are three files and a workflow
cannot read a constant out of another one. So the guard asks for agreement
rather than for a single home - it collects every spdx.dev URI in
.github/workflows and refuses when there are two different ones.

The lesson worth keeping: read a predicate type out of a bundle, not out of
documentation. base64 -d on dsseEnvelope.payload and predicateType is inside.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: donislawdev

.github/workflows/attest-release.yml

@@ -123,7 +123,7 @@ jobs:
         # missing file rather than a wrong flag.
         run: |
           set -euo pipefail
-          promised="https://spdx.dev/Document"
+          promised="https://spdx.dev/Document/v2.3"
           actual="$(python3 - "$BUNDLE" <<'PY'
           import base64, json, sys
           bundle = json.load(open(sys.argv[1], encoding="utf-8"))

.github/workflows/release.yml

@@ -465,7 +465,7 @@ jobs:
             echo
             echo "\`\`\`"
             echo "gh attestation verify <the file you downloaded> -R ${GITHUB_REPOSITORY} \\"
-            echo "   --predicate-type https://spdx.dev/Document"
+            echo "   --predicate-type https://spdx.dev/Document/v2.3"
             echo "\`\`\`"
             echo
             echo "The predicate type has to be given. \`gh\` asks for build provenance unless told"

.github/workflows/verify-release.yml

@@ -222,7 +222,7 @@ jobs:
           gh attestation verify "$linux" -R "$GITHUB_REPOSITORY"
           echo "what is inside, on a signed file: $windows"
           gh attestation verify "$windows" -R "$GITHUB_REPOSITORY" \
-            --predicate-type https://spdx.dev/Document
+            --predicate-type https://spdx.dev/Document/v2.3
 
       - name: the same two commands with no network to the API
         shell: bash
@@ -237,7 +237,7 @@ jobs:
             --bundle ./*.provenance.sigstore.json
           gh attestation verify "$windows" -R "$GITHUB_REPOSITORY" \
             --bundle ./*.sbom.sigstore.json \
-            --predicate-type https://spdx.dev/Document
+            --predicate-type https://spdx.dev/Document/v2.3
 
       - name: every Windows program is signed, stamped, and by OUR certificate
         shell: pwsh
@@ -289,7 +289,7 @@ jobs:
         run: |
           set -euo pipefail
           gh release view "$TAG" --repo "$GITHUB_REPOSITORY" --json body --jq .body > notes.md
-          for promised in "gh attestation verify" "--predicate-type https://spdx.dev/Document" "verify-SHA256SUMS.txt"; do
+          for promised in "gh attestation verify" "--predicate-type https://spdx.dev/Document/v2.3" "verify-SHA256SUMS.txt"; do
             grep -qF -- "$promised" notes.md || {
               echo "the release notes never mention: $promised"
               echo "This job just ran it, so the page and the check disagree about what a person should do."

internal/guard/attestation_test.go

@@ -3,6 +3,7 @@ package guard
 import (
 	"os"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -171,6 +172,63 @@ func TestTheAttestingHalfFetchesWhatTheChecksumsName(t *testing.T) {
 	}
 }
 
+// Every workflow that names the SBOM predicate type names the SAME one.
+//
+// This fact is written five times across three files, and it cannot be written
+// once: the notes tell a person what to type, the attesting half checks that
+// promise against the statement it just made, and the verifying half runs the
+// command for real. They are three different jobs in three different files and
+// a workflow cannot read a constant out of another one.
+//
+// 🔴 What it cost when they disagreed, on the first real release, on
+// 2026-08-28: the notes promised https://spdx.dev/Document, the statement
+// carried https://spdx.dev/Document/v2.3, and the attesting half stopped the
+// release. It was RIGHT to - the promise was written from the action's
+// documentation rather than from an attestation, and the provenance plan said
+// out loud that it was unmeasured - but the value that was wrong was written in
+// five places and only one of them was checked.
+//
+// The one that matters most is not the check. It is the pair of commands a
+// person types out of the release notes: with the wrong URI, gh answers "no
+// attestation found", which reads exactly like a release nobody attested.
+func TestEveryWorkflowNamesTheSamePredicateType(t *testing.T) {
+	dir := filepath.Join(repoRoot(t), ".github", "workflows")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Skipf("no workflows here: %v", err)
+	}
+
+	uri := regexp.MustCompile(`https://spdx\.dev/[A-Za-z0-9./-]*`)
+	found := map[string][]string{}
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".yml") {
+			continue
+		}
+		body, err := os.ReadFile(filepath.Join(dir, entry.Name()))
+		if err != nil {
+			t.Fatalf("reading %s: %v", entry.Name(), err)
+		}
+		for _, match := range uri.FindAllString(string(body), -1) {
+			found[match] = append(found[match], entry.Name())
+		}
+	}
+
+	if len(found) == 0 {
+		t.Fatal("no workflow names the SBOM predicate type, so this guard checked nothing")
+	}
+	if len(found) > 1 {
+		for value, files := range found {
+			t.Errorf("%q is named in %v", value, files)
+		}
+		t.Error("the workflows disagree about the SBOM predicate type. One of them tells a " +
+			"person what to type, one checks that promise against the statement, and one " +
+			"runs the command for real - so a disagreement here is a release page whose " +
+			"own instructions answer \"no attestation found\".\n" +
+			"What to do: the value is whatever the statement actually carries. Read it out " +
+			"of a bundle rather than out of documentation.")
+	}
+}
+
 func TestTheReleaseNotesSayHowToCheckWhatWasDownloaded(t *testing.T) {
 	job := releasePublishJob(t)
 	var notes string