[imanimanyara]

Summary

A caller's release is signed by this reusable workflow, not by the caller's own release.yml. So gh attestation verify <file> --repo OWNER/REPO fails with Error: verifying with issuer "sigstore.dev", because gh expects a workflow in the caller's repository. Adding --signer-workflow simtabi/.github/.github/workflows/go-release.yml makes it pass. Measured 2026-11-13 against simtabi/authama v0.1.6: exit 0 with the flag, failure without.

• go-release/README.md, under Attestations: the verify command with the flag, and why it is needed.
• .github/workflows/go-release.yml and templates/go/release.yml: the same command in their header comments. These are comment-only changes.
• go-release/tests/test_go_release.py: a new VerifyCommands test. Every gh attestation verify in the three files must name the signer (a backslash-continued command is read as one line), and at least 3 must be found. Seen red both ways: with the flag removed from the template, and with no commands found.

authama's own docs get the same fix in sangehq/authama#189.

Checks

python3 -m unittest discover -s go-release/tests: 12 tests, OK.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.