From 3715f519de877e9c367cb2443b44e37a67f0c7a3 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Thu, 3 Sep 2026 11:12:28 -0700 Subject: [PATCH] docker latest: the signing job checks out the workflow's own commit The job only assembles and signs manifests, so nothing there needs the source_ref checkout; the local signing action now comes from the same revision as the workflow file that calls it. Claude-Session: https://claude.ai/code/session_01A5zMqzaUg1Snur4Yg8xJGa --- .github/workflows/container_latest.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/container_latest.yml b/.github/workflows/container_latest.yml index 2e476ebbd..488d97eaa 100644 --- a/.github/workflows/container_latest.yml +++ b/.github/workflows/container_latest.yml @@ -448,11 +448,12 @@ jobs: matrix: variant: ${{ fromJSON(needs.setup.outputs.variants) }} steps: - - name: Checkout + - name: Checkout the signing action uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 with: - ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.source_ref || github.ref }} - + sparse-checkout: .github/actions + persist-credentials: false + - name: Configure variant id: config run: |