Fix image publication action pins #29

Merged

wantxapas merged 1 commit from codex/fix-tidy-cook-publish into main

2026-07-22 23:22:33 +01:00

wantxapas commented

2026-07-22 23:17:10 +01:00

(Migrated from github.com)

What changed

Pin actions/checkout v4 to its valid immutable commit.
Pin actions/attest v4 to the commit behind its annotated tag.

Root cause

The original workflow accidentally assigned the attestation commit to checkout and assigned the attestation tag-object SHA where GitHub Actions requires a resolvable commit. All three publication jobs therefore failed during job setup before Docker ran.

Impact

After merge, the main-branch workflow can publish the AMD64/ARM64 backend, frontend, and backup images to GHCR.

Validation

Workflow YAML parses successfully.
git diff --check passes.
Both replacement revisions were verified through the GitHub API.

## What changed - Pin actions/checkout v4 to its valid immutable commit. - Pin actions/attest v4 to the commit behind its annotated tag. ## Root cause The original workflow accidentally assigned the attestation commit to checkout and assigned the attestation tag-object SHA where GitHub Actions requires a resolvable commit. All three publication jobs therefore failed during job setup before Docker ran. ## Impact After merge, the main-branch workflow can publish the AMD64/ARM64 backend, frontend, and backup images to GHCR. ## Validation - Workflow YAML parses successfully. - git diff --check passes. - Both replacement revisions were verified through the GitHub API.