fix: clarify GitHub attestations to be artifact ones by scop · Pull Request #8394 · jdx/mise

scop · 2026-03-01T21:53:07Z

There are e.g. release attestations these days, too.

Not changing any user setting names or the like at least yet though.

There are e.g. release attestations these days, too. Not changing any user setting names or the like at least yet though.

gemini-code-assist · 2026-03-01T21:53:26Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request focuses on enhancing clarity and precision within the codebase and user-facing content by explicitly renaming 'GitHub attestations' to 'GitHub artifact attestations'. This change helps differentiate the specific type of attestations being handled, avoiding potential confusion with other attestation mechanisms GitHub might offer. The modifications span across function names, error messages, debug logs, documentation, and automated tests, ensuring a consistent and accurate understanding of the feature's scope.

Highlights

Terminology Clarification: Updated all references to 'GitHub attestations' across the codebase, documentation, and tests to 'GitHub artifact attestations' to distinguish them from other types of GitHub attestations, such as release attestations.
Code Refactoring: Renamed internal functions like validate_github_attestation_params and verify_github_attestations to explicitly include 'artifact' in their names, improving code clarity and maintainability.
User Feedback and Debugging: Modified user-facing error messages, debug logs, and progress messages to reflect the new 'GitHub artifact attestations' terminology, providing more precise information during verification processes.
Documentation and Tests Alignment: Synchronized documentation and end-to-end tests with the updated terminology, ensuring consistency and accurate representation of the feature.

Changelog

crates/vfox/src/hooks/pre_install.rs
- Renamed validate_github_attestation_params to validate_github_artifact_attestation_params.
- Updated error messages to include 'artifact' for GitHub attestation requirements.
crates/vfox/src/vfox.rs
- Updated the error message for GitHub attestation verification to specify 'artifact attestation'.
docs/dev-tools/backends/aqua.md
- Updated documentation to refer to 'GitHub artifact attestations' in configuration and verification output examples.
docs/tips-and-tricks.md
- Updated the software verification section to mention 'GitHub artifact attestations'.
e2e/backend/test_aqua_github_attestations
- Modified test script descriptions and verification messages to use 'GitHub artifact attestations'.
e2e/core/test_ruby_github_attestations
- Modified test script descriptions and verification messages to use 'GitHub artifact attestations'.
src/backend/aqua.rs
- Updated comments to refer to 'GitHub Artifact Attestations'.
- Renamed the function call verify_github_attestations to verify_github_artifact_attestations.
- Renamed the async function verify_github_attestations to verify_github_artifact_attestations.
- Updated debug and error messages related to GitHub attestations to include 'artifact'.
src/backend/github.rs
- Updated comments to refer to 'GitHub artifact Attestations'.
- Updated function documentation for verify_attestations_or_slsa and try_verify_github_attestations to include 'artifact'.
- Updated debug and error messages related to GitHub attestations to include 'artifact'.
src/plugins/core/ruby.rs
- Renamed the function call verify_github_attestations to verify_github_artifact_attestations.
- Renamed the async function verify_github_attestations to verify_github_artifact_attestations.
- Updated debug and error messages related to GitHub attestations to include 'artifact'.
- Updated a comment to refer to 'GitHub artifact attestations'.

Activity

No human activity recorded on this pull request yet.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request clarifies that the "GitHub attestations" feature refers specifically to "GitHub artifact attestations". The changes are applied consistently across the codebase, including documentation, tests, and log/error messages. This is a great improvement for clarity. I've found a couple of minor capitalization inconsistencies in comments and suggested fixes to align them with the rest of the changes.

gemini-code-assist · 2026-03-01T21:54:29Z

        }

-        // GitHub Attestations - check registry config OR actual release assets
+        // GitHub Artifact Attestations - check registry config OR actual release assets


For consistency with the rest of the codebase, could you please use "artifact attestations" in lowercase?

Suggested change

// GitHub Artifact Attestations - check registry config OR actual release assets

// GitHub artifact attestations - check registry config OR actual release assets

gemini-code-assist · 2026-03-01T21:54:29Z

        }

-        // Check for GitHub Attestations (assets with .sigstore.json or .sigstore extension)
+        // Check for GitHub artifact Attestations (assets with .sigstore.json or .sigstore extension)


For consistency with the rest of the codebase, could you please use "artifact attestations" in lowercase?

Suggested change

// Check for GitHub artifact Attestations (assets with .sigstore.json or .sigstore extension)

// Check for GitHub artifact attestations (assets with .sigstore.json or .sigstore extension)

greptile-apps · 2026-03-01T22:01:30Z

Greptile Summary

This PR clarifies terminology throughout the codebase by replacing "GitHub attestations" with "GitHub artifact attestations" to be more specific, since GitHub now supports multiple attestation types (e.g., release attestations).

Changes:

Renamed internal functions for clarity (e.g., verify_github_attestations → verify_github_artifact_attestations)
Updated all user-facing messages, error messages, and debug output
Updated documentation and test scripts to match new terminology
Preserved backward compatibility by keeping setting names unchanged (github_attestations, MISE_AQUA_GITHUB_ATTESTATIONS)

Impact:

No logic changes - purely a terminology clarification
No breaking changes to user-facing settings or environment variables
Tests updated to match new output messages

Confidence Score: 5/5

This PR is completely safe to merge - it's a terminology clarification with zero logic changes
Perfect score because this is a straightforward search-and-replace terminology update with no logic modifications, no breaking changes, and all tests updated accordingly
No files require special attention - all changes are consistent and safe

Important Files Changed

Filename	Overview
crates/vfox/src/hooks/pre_install.rs	Renamed function from `validate_github_attestation_params` to `validate_github_artifact_attestation_params` and updated error messages for clarity
src/backend/aqua.rs	Renamed function to `verify_github_artifact_attestations` and updated all messages, comments, and debug output
src/backend/github.rs	Updated comments and user-facing messages to specify "GitHub artifact attestations"
src/plugins/core/ruby.rs	Renamed function to `verify_github_artifact_attestations` and updated all messages and comments

_{Last reviewed commit: 558c5b1}

@jdx

### 🚀 Features - **(hooks)** add task references to hooks and watch_files by @jdx in [#8400](#8400) - **(prepare)** add git-submodule built-in provider by @jdx in [#8407](#8407) - **(prepare)** add human-readable stale reasons to prepare output by @jdx in [#8408](#8408) - **(prepare)** add dependency ordering to prepare steps by @jdx in [#8401](#8401) - **(prepare)** add --explain flag for provider diagnostics by @jdx in [#8409](#8409) - **(prepare)** add per-provider timeout support by @jdx in [#8405](#8405) - **(prepare)** add blake3 content-hash freshness checking by @jdx in [#8404](#8404) - **(tasks)** monorepo vars and per-task vars by @halms in [#8248](#8248) ### 🐛 Bug Fixes - **(aqua)** restore bin_paths disk cache with fresh_file invalidation by @jdx in [#8398](#8398) - **(idiomatic)** use generic parser for idiomatic files by @risu729 in [#8171](#8171) - **(install)** apply precompiled options to all platforms in lockfile by @jdx in [#8396](#8396) - **(install)** normalize "v" prefix when matching lockfile versions by @jdx in [#8413](#8413) - **(prepare)** improve git submodule parser and fix check_staleness error handling by @jdx in [#8412](#8412) - **(python)** respect precompiled settings in lock file generation by @jdx in [#8399](#8399) - **(python)** clarify uv_venv_auto docs + prevent uv shim recursion in venv creation by @halms in [#8402](#8402) - **(task)** remove deprecated `# mise` task header syntax by @jdx in [#8403](#8403) - **(vfox)** avoid eager metadata loading during config file detection by @jdx in [#8397](#8397) - clarify GitHub attestations to be artifact ones by @scop in [#8394](#8394) - ignore comments in idiomatic version files by @iloveitaly in [#7682](#7682) ### 🚜 Refactor - unify archive detection by @risu729 in [#8137](#8137) ### 📚 Documentation - remove duplicated docs for npm.package_manager by @risu729 in [#8414](#8414)

fix: clarify GitHub attestations to be artifact ones

ac87f57

There are e.g. release attestations these days, too. Not changing any user setting names or the like at least yet though.

gemini-code-assist Bot reviewed Mar 1, 2026

View reviewed changes

[autofix.ci] apply automated fixes

558c5b1

jdx merged commit 72a9778 into jdx:main Mar 1, 2026
34 of 35 checks passed

mise-en-dev mentioned this pull request Mar 2, 2026

chore: release 2026.3.0 #8406

Merged

scop deleted the fix/gh-artifact-attestations-wording branch March 2, 2026 21:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: clarify GitHub attestations to be artifact ones#8394

fix: clarify GitHub attestations to be artifact ones#8394
jdx merged 2 commits intojdx:mainfrom
scop:fix/gh-artifact-attestations-wording

scop commented Mar 1, 2026

Uh oh!

gemini-code-assist Bot commented Mar 1, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Mar 1, 2026

Uh oh!

gemini-code-assist Bot Mar 1, 2026

Uh oh!

greptile-apps Bot commented Mar 1, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	// GitHub Artifact Attestations - check registry config OR actual release assets
	// GitHub artifact attestations - check registry config OR actual release assets

	// Check for GitHub artifact Attestations (assets with .sigstore.json or .sigstore extension)
	// Check for GitHub artifact attestations (assets with .sigstore.json or .sigstore extension)

Uh oh!

Conversation

scop commented Mar 1, 2026

Uh oh!

gemini-code-assist Bot commented Mar 1, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Mar 1, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Mar 1, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants