GitHub attestation "subject digest does not match" in CI

By Kaveh Alemi·Latchkey

An attestation binds a predicate to a specific subject digest. Verification fails when the digest recorded in the attestation does not match the digest of the artifact you are checking, so the two do not refer to the same build output.

What this error means

gh attestation verify or a policy fails with "subject digest does not match", or no attestation is found because the digest passed to attest was wrong.

Error: verification failed: no attestation matching the subject digest
sha256:aaaa... (attested subject was sha256:bbbb...)

Common causes

Attested a stale or locally-computed digest

A digest captured before the final push (or computed from a local image) differs from the digest actually stored in the registry.

The image was rebuilt between attest and verify

A second build produced a new digest, so the attestation points at an artifact that is no longer the one being deployed.

How to fix it

Attest the digest the push returned

1. Use the digest output of the build-push step as the subject digest.
2. Do not rebuild between attesting and verifying.
3. Verify against the same digest that was pushed.

- id: build
  uses: docker/build-push-action@v6
  with:
    push: true
- uses: actions/attest-build-provenance@v1
  with:
    subject-name: ghcr.io/acme/app
    subject-digest: ${{ steps.build.outputs.digest }}

Verify with the same immutable digest

Reference the image by digest on verify so the subject cannot drift from what was attested.

gh attestation verify oci://ghcr.io/acme/app@sha256:... --owner acme

How to prevent it

• Always attest the digest returned by the push step.
• Never rebuild an image between attesting and verifying it.
• Verify by digest, not by a mutable tag.

Frequently asked questions

Related guides

References

• GitHub Actions documentation