From b6fdabaea86f8cbcb207764bb1f174445201b094 Mon Sep 17 00:00:00 2001
From: SnapOtter <snapotter.hq@gmail.com>
Date: Sun, 12 Jul 2026 05:02:15 +0800
Subject: [PATCH] ci(release): keep image attestations in GitHub's API, drop
 provenance sidecars (#504)

Stop pushing SLSA attestations to the registries as OCI referrer tags (attest.yml: push-to-registry: false) and disable buildx's default provenance sidecars (release.yml: provenance: false). GHCR rendered both as package versions / unknown-unknown architecture entries on the package page. The release/publish flow (publish-images gate, RELEASE_TOKEN, web Sentry DSN) is unchanged.
---
 .github/workflows/attest.yml  | 26 ++++++++------------------
 .github/workflows/release.yml |  4 ++++
 2 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/attest.yml b/.github/workflows/attest.yml
index e8da18b0..7b4be36b 100644
--- a/.github/workflows/attest.yml
+++ b/.github/workflows/attest.yml
@@ -2,8 +2,12 @@ name: Attest Provenance
 
 # Generates SLSA build-provenance attestations for an already-published release,
 # so no image rebuild is required. Dispatch it after a release once the image
-# manifest and source archives exist. Provenance is pushed to the registries as
-# OCI referrers (verify with: gh attestation verify oci://<image>@<digest>).
+# manifest and source archives exist.
+#
+# Keep image attestations in GitHub's attestation API instead of pushing them
+# back to registries. GHCR renders OCI fallback sha256-* attestation tags as
+# package versions, which makes the package page recommend non-runtime artifacts.
+# Verify with: gh attestation verify oci://<image>@<digest> -R snapotter-hq/SnapOtter
 
 on:
   workflow_dispatch:
@@ -26,35 +30,21 @@ jobs:
     permissions:
       id-token: write
       attestations: write
-      packages: write
       contents: read
     steps:
-      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.repository_owner }}
-          password: ${{ secrets.GHCR_TOKEN }}
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-
       - name: Attest GHCR image
         uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         with:
           subject-name: ghcr.io/snapotter-hq/snapotter
           subject-digest: ${{ inputs.image_digest }}
-          push-to-registry: true
+          push-to-registry: false
 
       - name: Attest Docker Hub image
         uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
         with:
           subject-name: docker.io/snapotter/snapotter
           subject-digest: ${{ inputs.image_digest }}
-          push-to-registry: true
+          push-to-registry: false
 
   archives:
     name: Attest source archives
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c6838b2d..d5d4233c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -252,6 +252,10 @@ jobs:
           secrets: |
             sentry_auth_token=${{ secrets.SENTRY_AUTH_TOKEN }}
           labels: ${{ steps.meta.outputs.labels }}
+          # The manual attestation workflow signs release images. Buildx's
+          # default provenance sidecars show up in GHCR as unknown/unknown
+          # architectures on the package page.
+          provenance: false
           outputs: type=image,"name=snapotter/snapotter,ghcr.io/snapotter-hq/snapotter",push-by-digest=true,name-canonical=true,push=true
           cache-from: type=registry,ref=ghcr.io/snapotter-hq/snapotter:cache-${{ env.PLATFORM_PAIR }}
           cache-to: type=registry,ref=ghcr.io/snapotter-hq/snapotter:cache-${{ env.PLATFORM_PAIR }},mode=max