fix(release): scope checksums-job gh calls with --repo to avoid the g… #307
hyperpolymathscorecard-enforcer.yml
on: push
scorecard
30s
check-critical
6s
Annotations
2 errors and 1 warning
|
scorecard
Process completed with exit code 1.\n\nObserved today on the v0.1.1 release run (26145492160): all three\nbuild legs uploaded their binaries (they DO checkout), but the\nchecksums job failed before publishing SHA256SUMS. This left v0.1.1\nwithout the canonical manifest — I uploaded it manually as a one-off,\nbut future releases would silently re-bottle the bug.\n\nFix: pass `--repo \"$GITHUB_REPOSITORY\"` explicitly on both the\ndownload and the upload. Two-character change to two lines, no new\ncheckout cost, no behaviour change beyond losing the git probe.\nMatches the gh CLI guidance for CI use (\"prefer --repo over relying\non git auto-detection in non-clone contexts\").\n\nRefs #282 (the v0.1.1 release was cut as part of that issue's closure).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
|
|
scorecard
Process completed with exit code 1.\n\nObserved today on the v0.1.1 release run (26145492160): all three\nbuild legs uploaded their binaries (they DO checkout), but the\nchecksums job failed before publishing SHA256SUMS. This left v0.1.1\nwithout the canonical manifest — I uploaded it manually as a one-off,\nbut future releases would silently re-bottle the bug.\n\nFix: pass `--repo \"$GITHUB_REPOSITORY\"` explicitly on both the\ndownload and the upload. Two-character change to two lines, no new\ncheckout cost, no behaviour change beyond losing the git probe.\nMatches the gh CLI guidance for CI use (\"prefer --repo over relying\non git auto-detection in non-clone contexts\").\n\nRefs #282 (the v0.1.1 release was cut as part of that issue's closure).\n\nCo-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>",
|
|
check-critical
Found unpinned actions:
|