Sigstore v1.9 not compatible with previous v.1.8 integration about sigstore-js HOT 1 CLOSED

@enteraga6 there was a little refactoring of the way the identity token is retrieved in v1.9. Looking at your code, I think you just need to remove the signOptions altogether:

https://github.com/enteraga6/slsa-github-generator/blob/sigstore-bug/.github/actions/sign-attestations/src/main.ts#L20-L23

Those options were really only intended to be used in scenarios where you want to use the OAuth provider to retrieve an OIDC token.

You can see here that when those options are omitted, it will fallback to using the CI provider (which is the one which knows how to retrieve an OIDC token from GHA:

https://github.com/sigstore/sigstore-js/blob/sigstore%401.9.0/packages/client/src/config.ts#L130-L139

I think the change that may have broken this for you was that it used to always try the CI provider by default as the first strategy for retrieving a token and now it only falls back to that when some other strategy hasn't been configured.

from sigstore-js.