From e233e5ea886cdb69178e849a49a084fc5ab2bafe Mon Sep 17 00:00:00 2001 From: Mike Rodriguez Date: Sat, 19 Sep 2026 04:19:30 -0700 Subject: [PATCH] ci: work around SignPath v3 artifact access regression --- .github/workflows/ci-validation.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci-validation.yml b/.github/workflows/ci-validation.yml index 27fb70a..3b4d3d9 100644 --- a/.github/workflows/ci-validation.yml +++ b/.github/workflows/ci-validation.yml @@ -288,7 +288,10 @@ jobs: - name: Submit VDD package to SignPath id: submit_signing if: env.SIGNPATH_SIGNING_RUN == 'true' - uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0.0 + # v3.0.0 currently rejects otherwise valid GitHub artifacts with + # "User has no access to the requested GitHub resource" (upstream #18). + # v2.3 is the last Node 24-compatible release before that regression. + uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2.3.0 with: api-token: ${{ secrets.SIGNPATH_API_TOKEN }} organization-id: ${{ vars.SIGNPATH_ORG_ID }}