ci: Remove lowdown and configure from the sign release job step
What the developer wrote
Authored by ShahanaFarooqui
ci: Remove lowdown and configure from the sign release job step
Changelog-None: Fixes draft release job creation in CI.
What changed, and why it matters
This is a routine GitHub Actions CI maintenance change. It removes two unnecessary setup commands (installing a documentation tool called lowdown and running a build configuration script) from the automated step that signs release artifacts. There is no security-relevant change visible in the diff.
No security action required. Treat as normal CI cleanup.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/workflows/release.yml, simplifying the ‘Sign release’ job by removing ‘sudo apt-get install -y lowdown’ and ‘./configure’ from the run block. The remaining command is ‘tools/build-release.sh –without-zip sign’. The commit message frames this as fixing draft release job creation in CI. No cryptographic, permission, or code changes are present.
Changed components
.github/workflows/release.ymlInspect captured patch +1 / −4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 451212b2..c47a8278 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -161,10 +161,7 @@ jobs:
run: echo "default-key ${{ steps.gpg.outputs.keyid }}" >> ~/.gnupg/gpg.conf
- name: Sign release
- run: |
- sudo apt-get install -y lowdown
- ./configure
- tools/build-release.sh --without-zip sign
+ run: tools/build-release.sh --without-zip sign
- name: Upload signed artifact
uses: actions/upload-artifact@v4
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.