From 567965dd2b0706414b19f60d9666d376c96f4910 Mon Sep 17 00:00:00 2001
From: Paolo D'Amico <paolodamico@users.noreply.github.com>
Date: Thu, 16 Jul 2026 09:33:50 -0700
Subject: [PATCH 1/2] fix(ci): fail release when attestation fails

---
 .github/workflows/release.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 923361f..4a50104 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -99,7 +99,6 @@ jobs:
 
       - name: Attest
         uses: actions/attest-build-provenance@v1
-        continue-on-error: true # TODO: remove once image attestation is operational
         with:
           push-to-registry: true
           subject-name: ghcr.io/${{ github.repository }}

From c0e08f7635f3f88057bccae127fe728f21711b59 Mon Sep 17 00:00:00 2001
From: Nicolas Vaquero <nicolas.vaquero@toolsforhumanity.com>
Date: Fri, 31 Jul 2026 15:37:03 +0200
Subject: [PATCH 2/2] fix(ci): promote release tags only after attestation
 succeeds

Push a sha-only image first, attest it, then retag latest/version so a failed attestation cannot advance release tags to an unattested digest.
---
 .github/workflows/release.yml | 29 +++++++++++++++++++++++++----
 1 file changed, 25 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0e8c32f..616a03b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -63,16 +63,14 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 https://github.com/actions/checkout/releases/tag/v7.0.0
 
+      # Push a non-release reference first so attestation can run before `latest` /
+      # version tags are advanced. If attestation fails, release tags stay unchanged.
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 https://github.com/docker/metadata-action/releases/tag/v6.2.0
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
-            # set latest tag for default branch
-            type=raw,value=latest
-            type=raw,value=${{ needs.pre-release-checks.outputs.new_version }}
-            type=ref,event=tag
             type=sha
 
       - name: Set up Docker Buildx
@@ -105,6 +103,29 @@ jobs:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.docker_build.outputs.digest }}
 
+      - name: Docker meta (release tags)
+        id: release_meta
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 https://github.com/docker/metadata-action/releases/tag/v6.2.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest
+            type=raw,value=${{ needs.pre-release-checks.outputs.new_version }}
+
+      - name: Promote attested image to release tags
+        env:
+          DIGEST: ${{ steps.docker_build.outputs.digest }}
+          TAGS: ${{ steps.release_meta.outputs.tags }}
+        run: |
+          set -euo pipefail
+          SOURCE="ghcr.io/${{ github.repository }}@${DIGEST}"
+          args=()
+          while IFS= read -r tag; do
+            [ -z "$tag" ] && continue
+            args+=(--tag "$tag")
+          done <<< "$TAGS"
+          docker buildx imagetools create "${args[@]}" "$SOURCE"
+
   create-github-release:
     needs: [pre-release-checks, docker-build]
     runs-on: