Summary
The Build Agent-Act Image job in release run #22369923231 failed while attesting the SBOM to the Sigstore/Rekor transparency log.
Commit: 5f89cffbe4d5ac99943407e85e763fd149a42049
Root Cause
The cosign attest step succeeded in generating the ephemeral certificate and SBOM, but failed when attempting to POST the attestation entry to rekor.sigstore.dev:
Error: signing ghcr.io/github/gh-aw-firewall/agent-act@sha256:4813c126c4d7395ac75bc4206375e33bef6ca01c1dce4217151c6dc51f079456:
Post "(rekor.sigstore.dev/redacted)
POST (rekor.sigstore.dev/redacted) giving up after 4 attempt(s)
This is a transient external service failure — the Sigstore Rekor transparency log was unavailable or rate-limiting at the time of the run. All other build jobs (Squid, Agent, API Proxy) succeeded.
The Docker image itself was built and pushed successfully to GHCR; only the SBOM attestation signature step failed, causing the job — and subsequently the Create Release job — to be skipped.
Impact
- The release was not created (Create Release job was skipped due to upstream failure)
- The agent-act container image was built and pushed, but lacks a Sigstore SBOM attestation
- The other three images (squid, agent, api-proxy) completed successfully including their attestations
Recommended Actions
- Re-run the failed job: Retry the "Build Agent-Act Image" job when Sigstore/Rekor services are healthy. Check [Sigstore status]((status.sigstore.dev/redacted) first.
- Consider adding retry logic: The
cosign attest step could benefit from a retry wrapper (e.g., a for loop or retry action) to handle transient Rekor outages automatically.
- Consider making SBOM attestation non-blocking: If SBOM attestation failures should not block releases, the step could use
continue-on-error: true with an alert/notification on failure.
Details
- Workflow: Release
- Failed job: Build Agent-Act Image (job ID: 64745847671)
- Failure step:
cosign attest --yes --predicate agent-act-sbom.spdx.json --type spdxjson
- External service:
rekor.sigstore.dev (Sigstore transparency log)
- Error type: Network/service timeout — 4 POST attempts all failed
Generated by CI Doctor
Summary
The Build Agent-Act Image job in release run #22369923231 failed while attesting the SBOM to the Sigstore/Rekor transparency log.
Commit:
5f89cffbe4d5ac99943407e85e763fd149a42049Root Cause
The
cosign atteststep succeeded in generating the ephemeral certificate and SBOM, but failed when attempting to POST the attestation entry torekor.sigstore.dev:This is a transient external service failure — the Sigstore Rekor transparency log was unavailable or rate-limiting at the time of the run. All other build jobs (Squid, Agent, API Proxy) succeeded.
The Docker image itself was built and pushed successfully to GHCR; only the SBOM attestation signature step failed, causing the job — and subsequently the Create Release job — to be skipped.
Impact
Recommended Actions
cosign atteststep could benefit from a retry wrapper (e.g., aforloop orretryaction) to handle transient Rekor outages automatically.continue-on-error: truewith an alert/notification on failure.Details
cosign attest --yes --predicate agent-act-sbom.spdx.json --type spdxjsonrekor.sigstore.dev(Sigstore transparency log)