From e227f951a47fbf8ec584dd4f6f50307980b87b2d Mon Sep 17 00:00:00 2001 From: Alessandro De Blasis Date: Sun, 23 Aug 2026 16:23:48 +0300 Subject: [PATCH] fix(ci): provenance guard verifies the linux binary on the linux runner MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The guard executed dist's darwin_arm64 build to diff stunt llm against the checkout — valid on the macOS local cut (v0.51.2), Exec format error on the ubuntu runner. The llm reference is identical in every target, so the runner now verifies the binary it can execute; the other targets stay pinned by checksums.txt. --- .github/workflows/release.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a872254c..ac399271 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -74,7 +74,11 @@ jobs: run: | set -euo pipefail go build -o /tmp/ref-stunt ./cmd/stunt - BIN="$(find dist -name stunt -path '*darwin_arm64*' | head -1)" + # The runner is linux: verify the binary it can execute. `stunt + # llm` embeds the same hand-maintained reference in every target, + # so a source-vs-artifact skew shows up on any platform; the + # remaining targets are pinned by checksums.txt. + BIN="$(find dist -name stunt -path '*linux_amd64*' | head -1)" test -x "$BIN" /tmp/ref-stunt llm > /tmp/ref.txt "$BIN" llm > /tmp/dist.txt @@ -82,7 +86,7 @@ jobs: echo "::error::shipped binary does not match this checkout (stunt llm differs) — refusing to trust the release artifacts" exit 1 fi - echo "provenance check: shipped darwin_arm64 binary matches this checkout" + echo "provenance check: shipped linux_amd64 binary matches this checkout" - name: Upload artifacts uses: actions/upload-artifact@v4