lauren 44c4693539 [ci] Dont sign builds originating from anything other than facebook/react (#32738) ... We now generate attestations in `process_artifacts_combined` so we can verify the provenance of the build later in other workflows. However, this requires `write` permissions for `id-token` and `attestations` so PRs from forks cannot generate this attestation. To get around this, I added a `--no-verify` flag to scripts/release/download-experimental-build.js. This flag is only passed in `runtime_build_and_test.yml` for the sizebot job, since 1) the workflow runs in the `pull_request` trigger which has read-only permissions, and 2) the downloaded artifact is only used for sizebot calculation, and not actually used. The flag is explicitly not passed in `runtime_commit_artifacts.yml` since there we actually use the artifact internally. This is fine as once a PR lands on main, it will then run the build on that new commit and generate an attestation. --- [//]: # (BEGIN SAPLING FOOTER) Stack created with [Sapling](https://sapling-scm.com). Best reviewed with [ReviewStack](https://reviewstack.dev/facebook/react/pull/32738). * #32739 * __->__ #32738		2025-03-25 11:16:19 -04:00
..
download-build-artifacts.js	[ci] Dont sign builds originating from anything other than facebook/react (#32738)	2025-03-25 11:16:19 -04:00
parse-params.js	[ci] Fix ci prep script	2024-07-29 13:03:59 -04:00
print-prerelease-summary.js	Updated release script documentation and command names (#17929)	2020-02-05 08:52:31 -08:00
test-packaging-fixture.js	Upgrade prettier (#26081)	2023-01-31 08:25:05 -05:00