From e0d7dd09a22ee3411d157180ec93671bea791e83 Mon Sep 17 00:00:00 2001 From: Miguel Martinez Date: Fri, 27 Feb 2026 18:51:28 +0100 Subject: [PATCH] fix(contracts): run check-compliance-requirement only at INIT phase The compliance requirement check is a pre-condition that should be validated before the attestation begins, not at push time. Add attestation_phases: [INIT] to restrict it accordingly. Fixes #2798 Signed-off-by: Miguel Martinez --- .github/workflows/contracts/chainloop-vault-release.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/contracts/chainloop-vault-release.yaml b/.github/workflows/contracts/chainloop-vault-release.yaml index b5484136d..194653a74 100644 --- a/.github/workflows/contracts/chainloop-vault-release.yaml +++ b/.github/workflows/contracts/chainloop-vault-release.yaml @@ -11,6 +11,8 @@ spec: with: requirement_name: sbom-compliance gate: true + attestation_phases: + - INIT - ref: source-commit with: check_signature: yes