What the developer wrote
Authored by Keeqler
Fix builder workflow again
What changed, and why it matters
This is a small GitHub Actions workflow fix. It corrects a path trigger so the workflow runs when the workflow file itself changes, and adds a missing 'attestations: write' permission needed for newer GitHub artifact attestation features. There is no direct security vulnerability in the diff; it is a maintenance/configuration correction.
No security action required; treat as routine CI maintenance. Reviewers may verify the attestation permission is only used by intended steps and that OIDC/token trust boundaries remain minimal.
Security signals we found
Workflow path trigger corrected to self-referential path
Added 'attestations: write' GitHub Actions permission
Evidence from the diff
The commit updates .github/workflows/builder-image-build.yml. It changes the paths trigger from ‘.github/workflows/docker.yml’ to ‘.github/workflows/builder-image-build.yml’ so edits to this workflow actually trigger runs. It also adds ‘attestations: write’ to the job permissions, likely required by github-actions-related attestation steps (e.g., actions/attest-build-provenance). No code affecting wallet logic, cryptography, or user data is changed.
Changed components
.github/workflows/builder-image-build.ymlInspect captured patch +2 / −1
diff --git a/.github/workflows/builder-image-build.yml b/.github/workflows/builder-image-build.yml
index 89ddbc5..a872f3f 100644
--- a/.github/workflows/builder-image-build.yml
+++ b/.github/workflows/builder-image-build.yml
@@ -6,7 +6,7 @@ on:
- main
paths:
- 'Dockerfile'
- - '.github/workflows/docker.yml'
+ - '.github/workflows/builder-image-build.yml'
workflow_dispatch:
env:
@@ -21,6 +21,7 @@ jobs:
contents: read
packages: write
id-token: write
+ attestations: write
steps:
- name: Checkout repository
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.