fix(ci): fail release when build attestation fails

[paolodamico]

Motivation

• Ensure provenance attestation failures are fatal in the release workflow so container images cannot be published without provenance, closing the regression introduced by marking the attestation step continue-on-error.

Description

• Remove the continue-on-error: true line from the Attest step in .github/workflows/release.yml so the docker-build job fails when attestation fails.

Testing

• Validated the change by printing the workflow (sed -n '1,220p' .github/workflows/release.yml), inspecting the diff (git diff -- .github/workflows/release.yml), checking the edited lines (nl -ba .github/workflows/release.yml | sed -n '88,112p'), and committing the change (git commit), and all commands completed successfully.

---

Codex Task

---

Note

Medium Risk
Changes the release publish path for container images; a misconfigured promote step could leave tags stale or only partially updated, though runtime app code is unaffected.

Overview
The release workflow now blocks publishing latest and version tags until build provenance attestation succeeds, and fails the job if attestation fails (the continue-on-error bypass on the Attest step is removed).

Instead of tagging the image as latest/release version on the initial push, the first build only pushes a SHA reference. After attestation passes, a new step uses docker buildx imagetools create to point latest and the release version tag at the already-built, attested digest—so a failed attestation never advances consumer-facing tags.

^{Reviewed by Cursor Bugbot for commit c0e08f7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 567965dd2b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate image tags before failing on attestation

When the attestation service or registry write fails, this now fails the job only after the Docker Build step has already run with push: true and the metadata includes the release/latest tags. That leaves GHCR tags advanced to an unattested digest while create-github-release is skipped via needs: docker-build, producing a partial release instead of preventing publication. Gate the final tags on a successful attestation, such as pushing a staging/digest-only reference first and tagging the release only after attestation succeeds, before making this step fatal.

Useful? React with 👍 / 👎.

[orekav]

Applied - c0e08f7