install.sh looking for 1.16.0 checksum.txt not in release assets

[timothycarambat]

Hey y'all

Noticed today a bunch of CI failures when trying to run some docker scout-cli actions. We run the install script directly and do not use the uses: docker-scout/cli@v1 Github actions key - so that could be the issue.

This seems specific to the latest release 1.16.0.

The specific error is

received HTTP status=404 for url='https://github.com/docker/scout-cli/releases/download/v1.16.0/docker-scout_1.16.0_checksums.txt' 
Error:  could not find release asset for os='linux' arch='amd64' format='tar.gz'  
Error:  failed to install docker-scout 

So it seems like some checksum text file does not exist, that is all. Old implementation of our action is below

      # Working pre 1.16.0 release
      
      - name: Add VEX attestations
        env:
          CVE_EXCEPTIONS: ${{ steps.cve-list.outputs.CVE_EXCEPTIONS }}
        run: |
          echo $CVE_EXCEPTIONS
          curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
          for cve in $CVE_EXCEPTIONS; do
            for tag in "${{ join(fromJSON(steps.meta.outputs.json).tags, ' ') }}"; do
              echo "Attaching VEX exception $cve to $tag"
              docker scout attestation add \
              --file "./docker/vex/$cve.vex.json" \
              --predicate-type https://openvex.dev/ns/v0.2.0 \
              $tag
            done
          done
        shell: bash  

Changing curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- to curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- v1.15.1 seems to still work OK.

[timothycarambat]

Looks like the checksum file exists in dist in the repo right now
https://raw.githubusercontent.com/docker/scout-cli/refs/heads/main/dist/docker-scout_1.16.0_checksums.txt

But was not an asset in the release, so I'm guessing that is what happened or assets are added after the release publish and my CI actions were just unfortunately timed

[cdupuis]

Thanks for raising this @timothycarambat .

Some recent internal changes broke our release pipeline. The missing artefacts have no been added to the release. Apologies for the troubles this has caused.