From 4fff86adc17acdc36b8ce454739f351c4e534978 Mon Sep 17 00:00:00 2001
From: "Jose I. Paris" <jiparis@chainloop.dev>
Date: Fri, 31 Jul 2026 11:17:46 +0200
Subject: [PATCH] fix(ci): pin the organization on attestation init in GitHub
 workflows

Attestations that authenticate via OIDC could resolve a different
organization than intended, causing the runs to fail. Pass
--org chainloop explicitly to `chainloop attestation init` so the
organization is fixed for the whole attestation lifecycle.

Assisted-by: Claude Code
Signed-off-by: Jose I. Paris <jiparis@chainloop.dev>
---
 .github/workflows/author_verification.yml      | 2 +-
 .github/workflows/codeql.yml                   | 2 +-
 .github/workflows/package_chart.yaml           | 2 +-
 .github/workflows/release.yaml                 | 4 ++--
 .github/workflows/scm_configuration_check.yaml | 2 +-
 .github/workflows/secrets-scan-daily.yml       | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/author_verification.yml b/.github/workflows/author_verification.yml
index 5657ec6ac..6057ee4d5 100644
--- a/.github/workflows/author_verification.yml
+++ b/.github/workflows/author_verification.yml
@@ -29,7 +29,7 @@ jobs:
 
       - name: Initialize Attestation
         run: |
-          chainloop attestation init --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT --collectors aiconfig
+          chainloop attestation init --org chainloop --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT --collectors aiconfig
         env:
           # Needed for commit signature verification: https://docs.chainloop.dev/concepts/attestations#commit-verification
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b68eed98a..0b768bbb9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,7 +44,7 @@ jobs:
       - name: Initialize Attestation
         if: ${{ github.event_name != 'pull_request' }}
         run: |
-          chainloop attestation init --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT
+          chainloop attestation init --org chainloop --workflow $CHAINLOOP_WORKFLOW_NAME --project $CHAINLOOP_PROJECT
         env:
           # Needed for commit signature verification: https://docs.chainloop.dev/concepts/attestations#commit-verification
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/package_chart.yaml b/.github/workflows/package_chart.yaml
index 0de756414..2d557737d 100644
--- a/.github/workflows/package_chart.yaml
+++ b/.github/workflows/package_chart.yaml
@@ -57,7 +57,7 @@ jobs:
           # Force the version that's inside the Chart.yaml file
           # and make sure it exists in the project by passing the --existing-version flag
           # if it doesn't exist, the attestation will fail, and first we need to create/update/rename the version in the project and re-run the job
-          chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT} --version ${app_version} --existing-version
+          chainloop attestation init --org chainloop --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT} --version ${app_version} --existing-version
 
           # Attest Control plane image
           chainloop attestation add --name control-plane-image --value "${CONTAINER_CP}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f89f980ef..1fc779d9f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -26,7 +26,7 @@ jobs:
 
       - name: Run Release Gate Attestation
         run: |
-          chainloop attestation init --workflow release-gate --project chainloop
+          chainloop attestation init --org chainloop --workflow release-gate --project chainloop
           chainloop attestation push
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -77,7 +77,7 @@ jobs:
       - name: Initialize Attestation
         id: init_attestation
         run: |
-          attestation_id=$(chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME} --release --remote-state -o json | jq -r .attestationID)
+          attestation_id=$(chainloop attestation init --org chainloop --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME} --release --remote-state -o json | jq -r .attestationID)
           echo "attestation_id=$attestation_id" >> $GITHUB_OUTPUT
         env:
           CHAINLOOP_WORKFLOW_NAME: "release"
diff --git a/.github/workflows/scm_configuration_check.yaml b/.github/workflows/scm_configuration_check.yaml
index 419c7fb27..5abcf8a68 100644
--- a/.github/workflows/scm_configuration_check.yaml
+++ b/.github/workflows/scm_configuration_check.yaml
@@ -31,7 +31,7 @@ jobs:
 
       - name: Initialize Attestation
         run: |
-          chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}
+          chainloop attestation init --org chainloop --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}
 
       - name: Generate a token
         id: generate-token
diff --git a/.github/workflows/secrets-scan-daily.yml b/.github/workflows/secrets-scan-daily.yml
index 672cec0ed..6a6031be9 100644
--- a/.github/workflows/secrets-scan-daily.yml
+++ b/.github/workflows/secrets-scan-daily.yml
@@ -30,7 +30,7 @@ jobs:
 
       - name: Initialize Attestation
         run: |
-          chainloop attestation init --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}
+          chainloop attestation init --org chainloop --workflow ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}
 
       - name: Install Gitleaks
         run: |