mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-01 12:22:24 +03:00
9dc8eab70e
npm rejects provenance-signed uploads from self-hosted runners: 422 Unprocessable Entity - Error verifying sigstore provenance bundle: Unsupported GitHub Actions runner environment: "self-hosted". Only "github-hosted" runners are supported when publishing with provenance. v3.8.50 learned that at minute 76 of its 10th publish attempt, after the tag, the GitHub Release and the Docker images were already out. USE_VPS_RUNNER had routed the job to the .113 pool on 2026-08-02; no release ran between 07-30 and 08-28, so the pairing sat latent for four weeks. It is pure text — a job whose runs-on resolves to self-hosted and a step whose run contains --provenance — so the workflow lint now checks it as a hard rule: reported in plain mode, blocking under --strict and --ratchet (the CI mode), emitted as provenanceRunnerFindings=<n> next to the other counters. Against origin/main the rule finds the two real offenders (the staged upload AND the DIRECT emergency fallback in npm-publish.yml); against the #11877 split it finds none. --provenance-file is deliberately not matched (different flag, pre-built bundle) and an opaque runs-on expression with no literal self-hosted is classified unknown and skipped — the check never guesses. The unit suite's last case walks the real .github/workflows and asserts zero findings, so it is red on main until #11877 lands and green after; that is the regression guard working, not a flake.