From 927930aadb56b125443a99da4c9c72bdcf0231b0 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Sun, 24 May 2026 18:41:02 -0400 Subject: [PATCH] fix(release): fix action versions and misplaced verify-capabilities step - actions/checkout@v6 and setup-go@v6 do not exist; downgrade to @v4 and @v5 - The verify-capabilities step in the docker job ran before checkout on a fresh runner with no dist/artifacts.json; remove it (capabilities are verified in the release job before goreleaser runs) Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/release.yml | 19 +++---------------- 1 file changed, 3 insertions(+), 16 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 99ee0d6..dbdae00 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -12,10 +12,10 @@ jobs: release: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v4 with: fetch-depth: 0 - - uses: actions/setup-go@v6 + - uses: actions/setup-go@v5 with: go-version-file: go.mod - name: Install Syft for SBOM generation @@ -46,21 +46,8 @@ jobs: packages: write steps: - # workflow#765: runtime truth-check via plugin verify-capabilities. - - name: Verify capabilities (runtime truth-check) - run: | - RUNNER_ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/') - BIN=$(jq -r --arg arch "$RUNNER_ARCH" \ - '[.[] | select(.type=="Binary" and .goos=="linux" and .goarch==$arch and (.name|startswith("workflow-plugin-migrations")))] | .[0].path // ""' \ - dist/artifacts.json) - if [ -z "$BIN" ] || [ "$BIN" = "null" ]; then - echo "::warning::No matching linux/$RUNNER_ARCH binary in dist/artifacts.json; skipping verify-capabilities" - jq '.[] | {name, type, goos, goarch, path}' dist/artifacts.json - exit 0 - fi - "${{ runner.temp }}/wfctl-bin/wfctl" plugin verify-capabilities --binary "$BIN" . - name: Check out code - uses: actions/checkout@v6 + uses: actions/checkout@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3