Skip to content

fix(ci): make the sandbox kit workflow runnable #3459

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
migmartri merged 2 commits into from
Sep 22, 2026
Merged

fix(ci): make the sandbox kit workflow runnable #3459

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f398b8e
fix(ci): make the sandbox kit workflow parseable
migmartri Sep 21, 2026
573db30
fix(ci): pin a login-action that supports Docker Hub OIDC
migmartri Sep 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions .github/workflows/package_sandbox_kit.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,8 +128,11 @@ jobs:
# governed by the connection's ruleset, which matches the subject claim
# repo:chainloop-dev/chainloop:ref:refs/heads/main - adding an `environment:`
# to this job would change that claim and stop it matching.
# Docker Hub OIDC landed in login-action v4.5.0; anything older ignores
# DOCKERHUB_OIDC_CONNECTIONID and fails with "Password required", so this
# pin must not be moved backwards.
- name: Docker login to Docker Hub
uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
env:
DOCKERHUB_OIDC_CONNECTIONID: 361a9222-f648-4f62-baf4-5f500f7fbf54
with:
Expand All @@ -142,8 +145,11 @@ jobs:

- name: Add Attestation (Sandbox Kit) and Push Kit
run: |
# KIT_VERSION arrives through env, not ${{ }} interpolation, so the value
# is never expanded into this script's source.
# KIT_VERSION arrives through env, not template interpolation, so the
# value is never expanded into this script's source. Do not write the
# literal expression syntax here either: GitHub expands it inside run
# bodies, shell comments included, and an empty one makes the whole
# workflow file fail to parse.

# Force the version declared in the kit spec and make sure it exists in
# the project by passing --existing-version; if it does not exist the
Expand Down
Loading