Skip to content

🏥 CI FailureRelease build failed: cosign SBOM attestation to Rekor/Sigstore timed out #1023

@github-actions

Description

@github-actions

Summary

The Build Agent-Act Image job in release run #22369923231 failed while attesting the SBOM to the Sigstore/Rekor transparency log.

Commit: 5f89cffbe4d5ac99943407e85e763fd149a42049

Root Cause

The cosign attest step succeeded in generating the ephemeral certificate and SBOM, but failed when attempting to POST the attestation entry to rekor.sigstore.dev:

Error: signing ghcr.io/github/gh-aw-firewall/agent-act@sha256:4813c126c4d7395ac75bc4206375e33bef6ca01c1dce4217151c6dc51f079456: 
Post "(rekor.sigstore.dev/redacted) 
POST (rekor.sigstore.dev/redacted) giving up after 4 attempt(s)

This is a transient external service failure — the Sigstore Rekor transparency log was unavailable or rate-limiting at the time of the run. All other build jobs (Squid, Agent, API Proxy) succeeded.

The Docker image itself was built and pushed successfully to GHCR; only the SBOM attestation signature step failed, causing the job — and subsequently the Create Release job — to be skipped.

Impact

  • The release was not created (Create Release job was skipped due to upstream failure)
  • The agent-act container image was built and pushed, but lacks a Sigstore SBOM attestation
  • The other three images (squid, agent, api-proxy) completed successfully including their attestations

Recommended Actions

  1. Re-run the failed job: Retry the "Build Agent-Act Image" job when Sigstore/Rekor services are healthy. Check [Sigstore status]((status.sigstore.dev/redacted) first.
  2. Consider adding retry logic: The cosign attest step could benefit from a retry wrapper (e.g., a for loop or retry action) to handle transient Rekor outages automatically.
  3. Consider making SBOM attestation non-blocking: If SBOM attestation failures should not block releases, the step could use continue-on-error: true with an alert/notification on failure.

Details

  • Workflow: Release
  • Failed job: Build Agent-Act Image (job ID: 64745847671)
  • Failure step: cosign attest --yes --predicate agent-act-sbom.spdx.json --type spdxjson
  • External service: rekor.sigstore.dev (Sigstore transparency log)
  • Error type: Network/service timeout — 4 POST attempts all failed

Generated by CI Doctor

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingci

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions