release-signing-artifacts fails on push tags trigger

[stevenh]

Description
If you enable release-signing-artifacts in push tags triggered flow if fails with:

Traceback (most recent call last):
  File "/home/runner/work/_actions/sigstore/gh-action-sigstore-python/v2.1.1/action.py", line 194, in <module>
    artifact = _download_ref_asset(filetype)
  File "/home/runner/work/_actions/sigstore/gh-action-sigstore-python/v2.1.1/action.py", line 74, in _download_ref_asset
    r.raise_for_status()
  File "/opt/hostedtoolcache/Python/3.10.13/x64/lib/python3.10/site-packages/requests/models.py", line 1021, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 404 Client Error: Not Found for url: https://github.com/....

From the docs I couldn't find any indication that this should only be used with a different trigger criteria.

Version

v2.1.1

[woodruffw]

Thanks for the report @stevenh!

To make sure I understand: when you enabled release-signing-artifacts on a non-release trigger, what was your expected behavior? To me the name implies that the option can only work on releases (since ordinary tag events have no "object" in GitHub to attach artifacts to).

With that being said, the exception is 100% a bug on our part -- we should either ignore release-signing-artifacts when GITHUB_EVENT is not release, or otherwise signal to the user that it's incompatible with their triggering event.

[stevenh]

To answer your question, my original expected was for it to sign the items and upload them to the release, creating as needed.

Now I understand this wasn't the intent, but I was from reading both upload-signing-artifacts and release-signing-artifacts and the variance seems to indicate the key difference being general build artifacts vs release artifacts.

I was coming into this tool with experience of goreleaser and the behaviour there is as I described, if you enable signing from a tag workflow the result will be signed assets uploaded to the associated release.

The word in the docs I missed was re-uploads which in hindsight was the key.

So what's the fix?
Clarify in the readme that release-signing-artifacts currently works on an existing release so add details about the required on: trigger.

Once that's addressed, we could look at how to make that easier to use by having it react correctly based on the trigger, for example upload new resources on a tag and sign and replace on a release.

Hope that helps?

[woodruffw]

To answer you question, my original expected was for it to sign the items and upload them to the release, creating as needed.

Thanks for clarifying! This is an understandable confusion given our current docs; I think your suggestion makes sense.

Once that's addressed, we could look at how to make that easier to use by having it react correctly based on the trigger, for example upload new resources on a tag and sign and replace on a release.

Yes, this makes sense to me as a potential follow-on.