ci: disable provenance/sbom attestation (403 on new-package first push)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-04 12:36:06 -07:00
parent 3c89724d75
commit 619d39e9cb
1 changed files with 4 additions and 0 deletions
@@ -47,6 +47,10 @@ jobs:
          context: .
          platforms: linux/amd64
          push: true
+          # No attestation/SBOM manifest — its extra blob push 403s on a new
+          # GHCR package's first publish (matches the canonical shared workflow).
+          provenance: false
+          sbom: false
          tags: |
            ghcr.io/hanzoai/nodejs:${{ steps.tags.outputs.ver }}
            ghcr.io/hanzoai/nodejs:${{ steps.tags.outputs.major }}