From c93dfcde4990c28ed238ea58b1d38e3a54104aa7 Mon Sep 17 00:00:00 2001 From: Ronen Slavin Date: Mon, 26 Oct 2026 14:30:49 +0200 Subject: [PATCH 1/2] ci(attest): push the rebuilt dist to the PR branch by name The rebuild job checks out the PR head SHA, which leaves a detached HEAD, so the bare `git push` in the auto-commit step exited with "You are not currently on a branch". Push HEAD to the PR branch explicitly. A branch that moved since the run started is rejected as non-fast-forward instead of being overwritten. Also run the workflow when the workflow file itself changes. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-attest-dist.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build-attest-dist.yaml b/.github/workflows/build-attest-dist.yaml index da9b179..8badf38 100644 --- a/.github/workflows/build-attest-dist.yaml +++ b/.github/workflows/build-attest-dist.yaml @@ -9,6 +9,7 @@ on: - 'attest/index.js' - 'attest/package.json' - 'attest/package-lock.json' + - '.github/workflows/build-attest-dist.yaml' workflow_dispatch: permissions: @@ -50,6 +51,7 @@ jobs: if: github.event_name == 'pull_request' env: PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} + PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} BASE_REPO: ${{ github.repository }} run: | # SECURITY: only act if the rebuild produced exactly one @@ -88,4 +90,7 @@ jobs: git config user.email "41898282+github-actions[bot]@users.noreply.github.com" git add attest/dist/index.js git commit -m "chore(attest): rebuild dist/index.js" - git push + # The checkout is the PR head SHA, a detached HEAD, so name the + # PR branch. If the branch moved since this run started, the push + # is rejected as non-fast-forward rather than overwriting it. + git push origin "HEAD:refs/heads/$PR_HEAD_REF" From ebb8349f313c80073444df83f2eb5a661ded437b Mon Sep 17 00:00:00 2001 From: Ronen Slavin Date: Mon, 26 Oct 2026 18:17:51 +0200 Subject: [PATCH 2/2] ci(attest): push the rebuilt dist only while the PR head is unchanged Lease the push on the PR head SHA the run built from. A plain push still landed when the branch was reset to an ancestor or deleted during the run; with the lease, any change to the branch rejects the push. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/build-attest-dist.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build-attest-dist.yaml b/.github/workflows/build-attest-dist.yaml index 8badf38..ac3a328 100644 --- a/.github/workflows/build-attest-dist.yaml +++ b/.github/workflows/build-attest-dist.yaml @@ -52,6 +52,7 @@ jobs: env: PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }} PR_HEAD_REF: ${{ github.event.pull_request.head.ref }} + PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }} BASE_REPO: ${{ github.repository }} run: | # SECURITY: only act if the rebuild produced exactly one @@ -91,6 +92,8 @@ jobs: git add attest/dist/index.js git commit -m "chore(attest): rebuild dist/index.js" # The checkout is the PR head SHA, a detached HEAD, so name the - # PR branch. If the branch moved since this run started, the push - # is rejected as non-fast-forward rather than overwriting it. - git push origin "HEAD:refs/heads/$PR_HEAD_REF" + # PR branch. The lease makes the push land only while the branch + # still points at the SHA this run built from; if it moved in any + # direction or was deleted, the push is rejected. + git push --force-with-lease="refs/heads/$PR_HEAD_REF:$PR_HEAD_SHA" \ + origin "HEAD:refs/heads/$PR_HEAD_REF"