From 1a53399a9e5ab30eaad8597285ee6faf757fe417 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:39:36 +0200
Subject: [PATCH] build/bake: fail fast on dependency signature verification
 errors

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 .github/workflows/bake.yml  | 14 +++++++-------
 .github/workflows/build.yml | 14 +++++++-------
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/bake.yml b/.github/workflows/bake.yml
index 71353d7..05bd233 100644
--- a/.github/workflows/bake.yml
+++ b/.github/workflows/bake.yml
@@ -262,17 +262,17 @@ jobs:
             const sigstore = new Sigstore();
             
             for (const image of core.getMultilineInput('images')) {
-              await core.group(`Verifying ${image}`, async () => {
-                try {
+              try {
+                await core.group(`Verifying ${image}`, async () => {
                   await sigstore.verifyImageAttestations(image, {
                     certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`,
                     platform: OCI.defaultPlatform()
                   });
-                } catch (error) {
-                  core.setFailed(error);
-                  return;
-                }
-              });
+                });
+              } catch (error) {
+                core.setFailed(`Failed to verify ${image}: ${error.message || error}`);
+                break;
+              }
             }
       -
         name: Set up Docker Buildx
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e3f2e91..4baeb0d 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -266,17 +266,17 @@ jobs:
             const sigstore = new Sigstore();
             
             for (const image of core.getMultilineInput('images')) {
-              await core.group(`Verifying ${image}`, async () => {
-                try {
+              try {
+                await core.group(`Verifying ${image}`, async () => {
                   await sigstore.verifyImageAttestations(image, {
                     certificateIdentityRegexp: `^https://github.com/docker/github-builder(-experimental)?/.github/workflows/bake.yml.*$`,
                     platform: OCI.defaultPlatform()
                   });
-                } catch (error) {
-                  core.setFailed(error);
-                  return;
-                }
-              });
+                });
+              } catch (error) {
+                core.setFailed(`Failed to verify ${image}: ${error.message || error}`);
+                break;
+              }
             }
       -
         name: Set outputs