prevent attestation pollution (#1567)

seladb · Sep 4, 2024 · 6d468b7 · 6d468b7
1 parent d3ac74b
commit 6d468b7
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.github/workflows/package.yml b/.github/workflows/package.yml
@@ -71,6 +71,7 @@ jobs:
         run: cmake --build "$BUILD_DIR" --target package
 
       - name: Generate artifact attestation
+        if: github.ref_type == 'tag'
         uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "${{ env.BUILD_DIR }}/*.tar.gz,${{ env.BUILD_DIR }}/*.deb,${{ env.BUILD_DIR }}/*.rpm"
@@ -113,6 +114,7 @@ jobs:
             cmake --build "$BUILD_DIR" --target package
 
       - name: Generate artifact attestation
+        if: github.ref_type == 'tag'
         uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "${{ env.BUILD_DIR }}/*.tar.gz"
@@ -156,6 +158,7 @@ jobs:
         run: cmake --build "$BUILD_DIR" --target package
 
       - name: Generate artifact attestation
+        if: github.ref_type == 'tag'
         uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "${{ env.BUILD_DIR }}/*.tar.gz,${{ env.BUILD_DIR }}/*.pkg"
@@ -226,6 +229,7 @@ jobs:
         run: cmake --build "$BUILD_DIR" --target package
 
       - name: Generate artifact attestation
+        if: github.ref_type == 'tag'
         uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "${{ env.BUILD_DIR }}/*.zip"
@@ -275,6 +279,7 @@ jobs:
         run: cmake --build "$env:BUILD_DIR" --config ${{ matrix.configuration }} --target package
 
       - name: Generate artifact attestation
+        if: github.ref_type == 'tag'
         uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "${{ env.BUILD_DIR }}/*.zip"
@@ -365,6 +370,7 @@ jobs:
           tar cvf "${PACKAGE_DIR}.tar.gz" "${PACKAGE_DIR}"
 
       - name: Generate artifact attestation
+        if: github.ref_type == 'tag'
         uses: actions/attest-build-provenance@6149ea5740be74af77f260b9db67e633f6b0a9a1 # v1.4.2
         with:
           subject-path: "${{ env.PACKAGE_DIR }}.tar.gz"