From 5adf6cc4c193bf47ece312eb51d11e579623921e Mon Sep 17 00:00:00 2001
From: qnbs <155236708+qnbs@users.noreply.github.com>
Date: Wed, 29 Jul 2026 00:12:34 +0200
Subject: [PATCH] fix(ci): exclude woff/woff2 from build-provenance attestation
 subjects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Merging PR #278 broke main: the push-triggered CI run's "Attest build
provenance" step failed with "Too many subjects specified (>1024)". This
step never runs on pull_request events (only push to main), so the PR's own
checks looked fully green and the regression only surfaced after merge.

Root cause: PR #278 self-hosts CJK fonts (@fontsource noto-sans-jp/kr/sc) to
fix the broken Google Fonts request. Those packages ship one small .woff2
file per Unicode-range subset for efficient lazy-loading — 2278 font files
in dist/ alone (2150 Noto-branded), against 195 everything else, well past
actions/attest-build-provenance's 1024-subject limit.

Fonts are vendored static assets, not application code that needs per-file
SLSA provenance — excluding woff/woff2 from subject-path still attests every
JS/CSS/HTML/JSON/wasm file that actually makes up the deployed application.
---
 .github/workflows/ci.yml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 045fbf56..a3cec063 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -224,12 +224,19 @@ jobs:
           retention-days: 3
 
       # QNBS-v3: SLSA provenance attestation — ties the dist artifact to this exact
-      # workflow run and commit SHA; verifiable with `gh attestation verify`.
+      # workflow run and commit SHA; verifiable with `gh attestation verify`. Excludes
+      # woff/woff2 — self-hosted CJK fonts (@fontsource noto-sans-jp/kr/sc) ship ~2.2k
+      # unicode-range subset files, pushing dist past the action's 1024-subject cap.
+      # Fonts are vendored static assets, not application code, so attesting the app
+      # bundle (JS/CSS/HTML/JSON/wasm/etc.) without them still covers what matters.
       - name: Attest build provenance
         if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
         uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
-          subject-path: ./dist
+          subject-path: |
+            dist/**
+            !dist/**/*.woff
+            !dist/**/*.woff2
 
       - name: Setup Pages
         if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'