fix(ci): compile SLSA generator from source to fix SHA-pinned ref failure

[shinagawa-web]

Summary

• Adds compile-generator: true to the provenance job in goreleaser.yml
• Closes fix(ci): work around slsa-github-generator v2.1.0 private repo false-positive #262 (supersedes it with a correct root-cause fix)

Root cause

The previous workaround in #262 (private-repository: true) was based on an incorrect diagnosis.

The actual failure chain in the v3.0.2 release run was:

BUILDER_REF: f7dd8c54c2067bafc12ca7a55595d5ee9b75204a
Invalid ref: f7dd8c54c2067bafc12ca7a55595d5ee9b75204a. Expected ref of the form refs/tags/vX.Y.Z

When the caller pins the reusable workflow with @<sha>, detect-workflow-js emits the raw 40-char commit SHA as BUILDER_REF. builder-fetch.sh inside slsa-github-generator requires BUILDER_REF to start with refs/tags/ before it will download the pre-built binary, so it exits 2. The SHA resolution code that exists later in the script is never reached.

This affects both v2.0.0 and v2.1.0 and is independent of private-repository. The privacy-check (if repoResp.data.private && !override) always passes for this public repository — it was never the root cause.

Fix

compile-generator: true switches from the download path (builder-fetch.sh) to the compile-from-source path (git checkout <sha> + go build), which accepts a bare SHA ref without the refs/tags/ prefix requirement.

Smoke test

Verified via workflow_dispatch on this branch (run 25362560733) with a valid base64-encoded subject. All provenance jobs passed:

• provenance-test / detect-env ✅
• provenance-test / generator ✅ (Generate builder, Create and sign provenance, Upload the signed provenance)
• provenance-test / final ✅

This is the first run where provenance-test / final succeeded. The private-repository: true workaround in #262 did not pass this test.

Upstream

Filed slsa-framework/slsa-github-generator#4503 with a proposed fix (PR slsa-framework/slsa-github-generator#4502) so that the default compile-generator: false path can also handle bare SHA refs in a future release.

Test plan

• Smoke-tested via workflow_dispatch on this branch
• Push v3.0.3 tag and verify the provenance job succeeds and .intoto.jsonl is attached to the release

[github-actions]

Benchmark Comparison

Comparing PR branch against main branch:

Legend: ✅ OK (no change or faster) | ⚠️ Caution (+10~50% slower) | ❌ Regression (+50%+ slower)

goos: linux
goarch: amd64
pkg: github.com/shinagawa-web/gomarklint/v3/cmd
cpu: AMD EPYC 7763 64-Core Processor                
geomean                     14.71m         14.72m        +0.11% ✅ [time/op]
geomean                    1.651Mi         1.651Mi        -0.00% ✅ [memory/op]
geomean                     4.510k         4.510k        +0.00% ✅ [allocs/op]

[Copilot]

Pull request overview

Updates the release workflow’s SLSA provenance generation to avoid failures when the reusable workflow is pinned by commit SHA (where BUILDER_REF becomes a bare SHA instead of a refs/tags/* ref).

Changes:

• Enable compile-generator: true for the provenance job to force the SLSA generator to be built from source instead of downloading a prebuilt binary.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!