mirror of
https://github.com/diegosouzapw/OmniRoute.git
synced 2026-09-13 18:32:12 +03:00
e52858435c
The publish job builds with `build:cli`, which assembles dist/ but does not write dist/BUILD_SHA — only `build:release` does, via write-build-sha.mjs. The #10427 provenance guard inside check:pack-artifact then rejects the artifact for having no SHA, so the build+validate pair in this job could never pass: [provenance] dist/BUILD_SHA is missing — the artifact cannot be traced to a commit. This is the same structural gap that was fixed in ci.yml's Package Artifact job earlier in the v3.8.50 cycle; npm-publish.yml carried it too and it only became visible now that the job finally got past the runner's disk exhaustion. Stamp from github.sha (on a release event that is the tag commit, which is on main) and fetch origin/main so the ancestry probe can resolve the ref that the guard checks against by default.