From 1d5233cee092bb3d78ff601cab2e3f8de5f9c3fd Mon Sep 17 00:00:00 2001 From: sax3l Date: Tue, 22 Sep 2026 05:42:21 +0200 Subject: [PATCH] =?UTF-8?q?fix(cd):=20attestation=20not-ready=20regex=20?= =?UTF-8?q?=E2=80=94=20cosign=203.x=20says=20'no=20matching=20attestations?= =?UTF-8?q?:'=20(no=20'found')?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Measured live 2026-09-22: release.yml's G17 attest finished 03:37:18, but cd.yml's poll loop hit the digest at 03:37:02 (image pushed before the attestation upload completed) and cosign 3.1.3 failed with 'Error: no matching attestations: ' — the gate's retry regex required the trailing 'found', so a transient not-ready state was misread as a hard verify failure. Broaden the regex to accept both message forms; the fail-closed behaviour for REAL attest failures is unchanged. --- .gitea/workflows/cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml index 6707d83..51b9583 100644 --- a/.gitea/workflows/cd.yml +++ b/.gitea/workflows/cd.yml @@ -168,7 +168,7 @@ jobs: if cosign verify-attestation --key cosign.pub --type "$PREDICATE_TYPE" "${IMAGE_REPO}@${digest}" >/tmp/verify.log 2>&1; then break fi - if grep -qE "no matching (attestations|signatures) found" /tmp/verify.log; then + if grep -qE "no matching (attestations|signatures)( found)?" /tmp/verify.log; then echo "image present but attestation not attached yet (attempt $attempt/$max_attempts) — waiting for release.yml's cosign attest..." sleep 15 continue -- 2.54.0