From b4c0feb30d62264df707e4204d083827c8289339 Mon Sep 17 00:00:00 2001
From: obsidian-ai <obsidian-ai@s8n.ru>
Date: Wed, 6 May 2026 18:02:02 +0100
Subject: [PATCH] ci(bluebuild): -vv + diagnostic ls before bluebuild
 invocation

---
 .github/workflows/build-bluebuild.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/build-bluebuild.yml b/.github/workflows/build-bluebuild.yml
index 95b5f81..62b9726 100644
--- a/.github/workflows/build-bluebuild.yml
+++ b/.github/workflows/build-bluebuild.yml
@@ -164,6 +164,10 @@ jobs:
           cp "$AUTH_SRC" /root/.config/containers/auth.json
           ls -la /root/.config/containers/auth.json
 
+          # Diagnostic: confirm the keypair landed where bluebuild expects.
+          ls -la bluebuild/
+          file bluebuild/cosign.pub bluebuild/cosign.key 2>&1 | head -4
+
           podman run --rm \
             --privileged \
             --entrypoint /usr/bin/bluebuild \
@@ -175,6 +179,7 @@ jobs:
             ghcr.io/blue-build/cli:latest \
             build \
               --build-driver buildah \
+              -vv \
               bluebuild/recipe.yml
           # bluebuild CLI tags as <recipe-name>:<tag> in local podman
           # storage. List + verify, then re-tag for the registries.