From b128adfe69f40b6a6319cbe072b3c4d010dcfc1d Mon Sep 17 00:00:00 2001
From: Roland Walker <walker@pobox.com>
Date: Sat, 12 Sep 2026 17:32:47 -0400
Subject: [PATCH] remove artifact attestations from ghcr.io images

Artifact attestations are great, but this causes the headline
suggestion at

 * https://github.com/dbcli/mycli/pkgs/container/mycli

to be a "docker pull" command which fails, giving

    unsupported media type application/vnd.oci.empty.v1+json

A number of fixes were tried in the v2.24.x series before giving up and
removing attestations.

Some permissions could probably also be removed from publish.yml.

Incidentally update the changelog for release v2.24.4 .
---
 .github/workflows/publish.yml | 6 ------
 changelog.md                  | 8 ++++++--
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 470b2db2..81cd7fbb 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -308,9 +308,3 @@ jobs:
         push: true
         tags: ${{ steps.meta.outputs.tags }}
         labels: ${{ steps.meta.outputs.labels }}
-
-    - name: Generate artifact attestation
-      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
-      with:
-        subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
-        push-to-registry: true
diff --git a/changelog.md b/changelog.md
index e2f7bdc2..7d54216b 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,6 +1,11 @@
-Upcoming (TBD)
+2.24.4 (2026/09/12)
 ==============
 
+Bug Fixes
+--------
+* Remove artifact attestations from ghcr.io images, fixing package examples.
+
+
 Internal
 --------
 * Remove `continue-on-error` from release tests.
@@ -23,7 +28,6 @@ Bug Fixes
 * Set `artifact-metadata: write` in `publish.yml`.
 
 
-
 2.24.1 (2026/09/12)
 ==============