ci: use format() for dry_run conditions to handle both string and boolean inputs

[keelerm84]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

N/A — CI-only change, no application code or tests modified.

Related issues

Follow-up to #19 (merged). Fixes a boolean/string type mismatch in the dry_run condition for the attestation step.

Describe the solution you've provided

Replaces !inputs.dry_run with format('{0}', inputs.dry_run) == 'false' on the attestation step condition.

GitHub Actions handles dry_run differently depending on trigger type:

• workflow_dispatch with type: boolean passes inputs as strings ('true'/'false')
• workflow_call with type: boolean passes inputs as actual booleans (true/false)

The old !inputs.dry_run pattern breaks for workflow_dispatch because !'false' → !truthy → false, so the attestation step would never run on manual triggers.

format('{0}', ...) uses GitHub's documented string coercion (Boolean false → 'false', String 'false' → 'false'), normalizing both types before comparison.

Describe alternatives you've considered

• inputs.dry_run == false — only works for workflow_call (boolean); broken for workflow_dispatch due to GitHub's loose equality coercing string 'false' to NaN.
• inputs.dry_run == 'false' — only works for workflow_dispatch (string); broken for workflow_call due to boolean false coercing to 0 vs string 'false' coercing to NaN.
• fromJSON(inputs.dry_run) == false — likely works but GitHub docs don't explicitly guarantee fromJSON() is a no-op on already-parsed booleans.

Additional context

Key review points:

• Verify format('{0}', inputs.dry_run) correctly normalizes both boolean and string inputs per the GitHub expressions docs.
• The composite publish action (.github/actions/publish/action.yml) uses inputs.dry_run == 'false' internally — this is correct because composite action inputs are always received as strings regardless of caller type. Only workflow-level conditions need the format() pattern.

This is part of an org-wide fix applied across all 15 attestation-only repos.

Link to Devin session: https://app.devin.ai/sessions/7d5bda4d9dbe4ae0b950b30a50485e60
Requested by: @keelerm84

---

Note

Low Risk
Low risk CI-only change that adjusts a GitHub Actions if: expression; main risk is inadvertently skipping or always running the attestation step on manual publishes.

Overview
Updates manual-publish.yml so the build provenance attestation step runs only when dry_run is effectively false by coercing the input via format('{0}', inputs.dry_run) == 'false', avoiding string/boolean mismatches from workflow_dispatch inputs.

^{Written by Cursor Bugbot for commit 8463946. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring