Adjust node max-http-header-size setting - #687
Merged
Merged
Conversation
Signed-off-by: Brian DeHamer <bdehamer@github.com>
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR increases the Node.js HTTP header size limit from the default 16KB to 32KB to resolve header overflow issues when using the push-to-registry option with certain OCI registries, particularly Google Artifact Registry.
- Adds NODE_OPTIONS environment variable with
--max-http-header-size=32768to the attest action step
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
jkylekelly
approved these changes
Aug 25, 2025
Merged
8 tasks
This was referenced Aug 21, 2026
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
ModeSevenIndustrialSolutions
added a commit
to modeseven-lfreleng-actions/sigul-sign-docker
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance has been a wrapper over actions/attest since v4, and GitHub steers new work at the underlying action. With no predicate-type/predicate supplied, actions/attest emits SLSA build provenance, so the published predicate is unchanged and the SBOM step already used it. The swap is not quite a one-line change. The wrapper also sets NODE_OPTIONS=--max-http-header-size=32768 on the step it wraps: node caps a single response's headers at 16KB, which some OCI registries overflow when attestations are pushed as referrers (actions/attest-build-provenance#687). push-to-registry is unconditional here, so every release took that path and dropping the setting would have reintroduced the overflow. Carry it across with a comment saying why, so a later tidy-up does not read it as redundant. Set it on the SBOM step too. That step was migrated to actions/attest earlier and pushes referrers the same way, so it has been running without the guard; nothing has overflowed yet, but the exposure is identical and the inconsistency invites removing the one that remains. Closes: lfreleng-actions#192 Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
tykeal
pushed a commit
to lfreleng-actions/docker-workflows
that referenced
this pull request
Aug 24, 2026
actions/attest-build-provenance is a wrapper: since v4 it forwards its inputs to actions/attest and adds nothing else, and GitHub directs new implementations at actions/attest instead. With no predicate supplied, actions/attest emits SLSA build provenance by default, so the swap is behaviour-preserving. The wrapper does contribute one thing beyond forwarding, and this lane depends on it: it sets NODE_OPTIONS so node accepts response headers above its 16KB default, which some OCI registries exceed on the push-to-registry path. This workflow pushes provenance to GHCR, so dropping the setting would reintroduce the intermittent overflow that actions/attest-build-provenance#687 fixed. Carry it across explicitly, with a comment recording why it must stay. Permissions are unchanged. Co-authored-by: Claude <noreply@anthropic.com> Signed-off-by: Matthew Watkins <mwatkins@linuxfoundation.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #606
When using the
push-to-registryoption some users have encountered header overflow issues when interacting with certain OCI registries.By default, node limits the total size of headers received in a single response to 16KB. We have seen certain interactions with the Google Artifact Registry API return headers totaling 21KB.
This change updates the maximum allowed header size to 32KB in order to give us some more breathing room when interacting with these registries.