From 79af97b6c63f68fae675713d1d6272d47af98033 Mon Sep 17 00:00:00 2001
From: Claude <claude@anthropic.com>
Date: Sun, 8 Nov 2026 08:45:05 +0900
Subject: [PATCH] Reference SLSA generator by tag, label tag commit

Release run 42426128759 (dispatch, tag v0.4.0-beta.12) pushed and
signed the image but "provenance / final" failed: the generator's
builder fetch rejects SHA refs ("Expected ref of the form
refs/tags/vX.Y.Z"). No release run has ever passed this job.
Tag v2.1.0 resolves to the same commit f7dd8c54, so the code run is
unchanged.

On workflow_dispatch github.sha is the branch head, so the image
label org.opencontainers.image.revision pointed at main (a137099)
while the tree built was the tag's (4273b4f8). Preflight now emits
the checked-out sha and the image job labels it.
---
 .github/workflows/release.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bb6cd1d..3ac1f2b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,6 +26,7 @@ jobs:
     outputs:
       version: ${{ steps.derive.outputs.version }}
       tag: ${{ steps.derive.outputs.tag }}
+      sha: ${{ steps.derive.outputs.sha }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
@@ -48,6 +49,7 @@ jobs:
           fi
           echo "tag=$TAG"           >> "$GITHUB_OUTPUT"
           echo "version=$VERSION"   >> "$GITHUB_OUTPUT"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
           echo "✓ tag=$TAG / version=$VERSION / appVersion=$APP_VER all aligned"
 
   image:
@@ -79,6 +81,9 @@ jobs:
             type=raw,value=${{ needs.preflight.outputs.version }}
             type=raw,value=${{ needs.preflight.outputs.tag }}
             type=semver,pattern={{major}}.{{minor}}
+          # github.sha is the dispatching branch head; label the built tag commit.
+          labels: |
+            org.opencontainers.image.revision=${{ needs.preflight.outputs.sha }}
       - id: push
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
@@ -124,7 +129,7 @@ jobs:
       actions: read
       id-token: write
       packages: write
-    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 # f7dd8c54 — generator rejects SHA refs
     with:
       image: ghcr.io/keiailab/postgres-operator
       digest: ${{ needs.image.outputs.digest }}