fix: add escape hatch for when signing service is down.

gilescope · gilescope · commit da0a28169216 · 2026-02-26T10:36:58.000Z
Signed-off-by: Giles Cope &lt;gilescope@gmail.com&gt;
diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
@@ -32,6 +32,11 @@ on:
         description: "Force release if it already exists?"
         required: true
         default: false
+      skip-attestation:
+        description: "Skip SBOM attestation (use when Sigstore/Rekor is down)"
+        required: false
+        type: boolean
+        default: false
 
 jobs:
   prepare-release:
@@ -426,6 +431,7 @@ jobs:
       # GHCR only has arch-specific tags with commit tag (season-retag creates multi-arch release tag only)
       image: ghcr.io/midnight-ntwrk/midnight-node:${{ needs.prepare-release.outputs.commit_tag }}-${{ matrix.arch }}
       sbom-artifact-name: sbom-midnight-node-ghcr-${{ matrix.arch }}-release
+      skip-attestation: ${{ inputs.skip-attestation || false }}
     secrets: inherit
 
   sbom-scan-ghcr-toolkit:
@@ -439,6 +445,7 @@ jobs:
       # GHCR only has arch-specific tags with commit tag (season-retag creates multi-arch release tag only)
       image: ghcr.io/midnight-ntwrk/midnight-node-toolkit:${{ needs.prepare-release.outputs.commit_tag }}-${{ matrix.arch }}
       sbom-artifact-name: sbom-midnight-node-toolkit-ghcr-${{ matrix.arch }}-release
+      skip-attestation: ${{ inputs.skip-attestation || false }}
     secrets: inherit
 
   sbom-scan-dockerhub-node:
@@ -451,6 +458,7 @@ jobs:
     with:
       image: midnightntwrk/midnight-node:${{ needs.prepare-release.outputs.release_tag }}-${{ matrix.arch }}
       sbom-artifact-name: sbom-midnight-node-dockerhub-${{ matrix.arch }}-release
+      skip-attestation: ${{ inputs.skip-attestation || false }}
     secrets: inherit
 
   sbom-scan-dockerhub-toolkit:
@@ -463,6 +471,7 @@ jobs:
     with:
       image: midnightntwrk/midnight-node-toolkit:${{ needs.prepare-release.outputs.release_tag }}-${{ matrix.arch }}
       sbom-artifact-name: sbom-midnight-node-toolkit-dockerhub-${{ matrix.arch }}-release
+      skip-attestation: ${{ inputs.skip-attestation || false }}
     secrets: inherit
 
   sbom-scan-midnightntwrk-node:
@@ -477,6 +486,7 @@ jobs:
       sbom-artifact-name: sbom-midnight-node-midnightntwrk-${{ matrix.arch }}-release
       platform: linux/${{ matrix.arch }}
       multi-arch-image: ghcr.io/midnightntwrk/midnight-node:${{ needs.prepare-release.outputs.release_tag }}
+      skip-attestation: ${{ inputs.skip-attestation || false }}
     secrets: inherit
 
   sbom-scan-midnightntwrk-toolkit:
@@ -491,4 +501,5 @@ jobs:
       sbom-artifact-name: sbom-midnight-node-toolkit-midnightntwrk-${{ matrix.arch }}-release
       platform: linux/${{ matrix.arch }}
       multi-arch-image: ghcr.io/midnightntwrk/midnight-node-toolkit:${{ needs.prepare-release.outputs.release_tag }}
+      skip-attestation: ${{ inputs.skip-attestation || false }}
     secrets: inherit
