From c12cb0eb8ec82e3a2b6a872b8a80ad411db314f6 Mon Sep 17 00:00:00 2001 From: Dmitrii Creed Date: Sat, 16 May 2026 14:42:35 +0400 Subject: [PATCH] fix(ci): filter download-artifact pattern in push.yaml docker-finalize MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The first signed prod release after PR #257 merged (run 25959575686 on commit 62185dc) failed at the `download all build artifacts` step in docker-finalize with "Artifact download failed after 5 retries". Net effect: images shipped + got signed + got SBOM/SLSA attestations, BUT the SC CLI tarballs never reached dist.simple-container.com and no git release tag was pushed. Root cause: the step ran `actions/download-artifact@v4` with no pattern, so it tried to pull EVERY artifact in the run. PR #257 added two new classes of artifact this step does not need: 1. image-digest- (4 per release) — published for verify-attestations.yml to consume; small. 2. *.dockerbuild (4 per release) — automatically uploaded by docker/build-push-action@v7.1.0 as build-cache artifacts; 100+ MB each. The unfiltered parallel download started ~15 artifacts in parallel and one of the large .dockerbuild artifacts flaked beyond the 5-retry budget, failing the whole step. branch-preview.yaml's publish-sc-preview already filters via `pattern: sc-*` (added when that workflow was set up); push.yaml docker-finalize didn't. Matching the pattern here. The two subsequent download-artifact steps (`download bin tools artifact`, `download docs artifact`) already filter by name, so they're fine. Recovery: this PR merging triggers a fresh push.yaml run that should publish the SC tarballs to dist and push the release tag. Images from the failed run are already signed on Docker Hub (verified manually); the new run will resign with a fresh version number, so consumers verifying the failed-run images would still get valid signatures — they just wouldn't have matching tarballs on dist. Refs PR #257 (caused), PR #258+ (fix). Signed-off-by: Dmitrii Creed --- .github/workflows/push.yaml | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index f02eec35..e48761e5 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -588,9 +588,19 @@ jobs: ${{ secrets.SC_CONFIG }} EOF sc secrets reveal - - name: download all build artifacts + - name: download sc tarball artifacts uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0 with: + # Filter to sc-* artifacts only — without a pattern, this step + # also pulls the build-push-action's internal `*.dockerbuild` + # cache artifacts (one per matrix item, often 100+ MB each) and + # the `image-digest-*` artifacts we publish for + # verify-attestations.yml to consume. None of those are needed + # here, and the .dockerbuild ones flake the parallel-download + # path: PR #257's first prod release (run 25959575686) failed + # at this step with "Artifact download failed after 5 retries" + # because the unfiltered download saturated the runner. + pattern: sc-* path: artifacts - name: download bin tools artifact uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0