Attestation verification failing: GH API now returns bundle: null instead of inline bundle

Devs: Plugins & API
1

The community plugin review scanner is rejecting attestations because GitHub’s attestation API recently changed its response format. The bundle field is now null and the actual bundle data is at bundle_url instead.

Evidence:

  • gh attestation verify passes locally for all release assets
  • The attestation certificate is valid and matches the correct repo, tag, and commit
  • Release asset SHA-256 digests match the signed subjects exactly
  • An independent report from a different plugin author, filed the same day, shows the identical symptom: main.js and styles.css attestations flagged as failing cryptographic verification while manifest.json from the same release passes clean, with local gh attestation verify succeeding on both flagged files: Scorecard false positive: release asset attestations reported as failing cryptographic verification

The scanner needs to fetch bundle_url when bundle is null. The attestation itself is correct.

Plugin: Image Embedder by sky150, versions 1.0.1–1.0.3 all fail despite valid attestations.

2

This has been fixed.