fix(cd): attestation not-ready regex — cosign 3.x says 'no matching attestations:' (no 'found')

Measured live 2026-09-22: release.yml's G17 attest finished 03:37:18, but cd.yml's poll loop hit the digest at 03:37:02 (image pushed before the attestation upload completed) and cosign 3.1.3 failed with 'Error: no matching attestations: ' — the gate's retry regex required the trailing 'found', so a transient not-ready state was misread as a hard verify failure. Broaden the regex to accept both message forms; the fail-closed behaviour for REAL attest failures is unchanged.
2026-09-22 05:42:21 +02:00
parent 52d897c16a
commit 1d5233cee0
1 changed files with 1 additions and 1 deletions
@@ -168,7 +168,7 @@ jobs:
            if cosign verify-attestation --key cosign.pub --type "$PREDICATE_TYPE" "${IMAGE_REPO}@${digest}" >/tmp/verify.log 2>&1; then
              break
            fi
-            if grep -qE "no matching (attestations|signatures) found" /tmp/verify.log; then
+            if grep -qE "no matching (attestations|signatures)( found)?" /tmp/verify.log; then
              echo "image present but attestation not attached yet (attempt $attempt/$max_attempts) — waiting for release.yml's cosign attest..."
              sleep 15
              continue