actions/attest
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
128 Commits 1 Branch 0 Tags
07ba9529af7d8deb0d88036b5245c1fb2b752bee
Commit Graph
42 Commits
Author SHA1 Message Date
Brian DeHamerandCopilot 426a9e3743 Update packages/attest/src/artifactMetadata.ts 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2026-02-25 17:40:10 -08:00
Brian DeHamer 79bb3e3519 new user-agent string for storage record API reqs 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2026-02-25 15:36:27 -08:00
Brian DeHamer 704a110a55 custom user-agent string for attestation API reqs 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2026-02-25 11:20:54 -08:00
Daniel Kennedy 3d6e6ce23e @actions/attest: convert to an ESM module (#2278) 2026-01-29 15:19:39 -05:00
Meredith Lancaster 1c1f3e0b2d fix linter issues 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-09 11:40:40 -08:00
Meredith Lancaster fcc7eae70d param name 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-09 11:39:12 -08:00
Meredith Lancaster abeb7669df split mega param into several different ones 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-09 11:37:04 -08:00
Meredith Lancaster 290dbce022 fix expected endpoint response 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-09 08:02:38 -08:00
Meredith Lancaster b168e2c6ee formatting 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 19:19:11 -08:00
Meredith LancasterandCopilot 38b848d6df Update packages/attest/src/artifactMetadata.ts 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-12-08 16:30:37 -08:00
Meredith Lancaster 707729fc18 fix linter issues 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 16:22:59 -08:00
Meredith Lancaster 81160137d2 fix test and function calls 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 15:59:25 -08:00
Meredith Lancaster 30b6f098fb add back param parsing function 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 15:39:26 -08:00
Meredith Lancaster 3292a4a180 fix test calls 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 15:33:01 -08:00
Meredith Lancaster 94855dbe20 reorganize function options and document 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 15:25:34 -08:00
Meredith Lancaster 0056116f2b rename file 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 15:16:26 -08:00
Meredith Lancaster dd67f5558b fix function exporting and test results 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 13:49:54 -08:00
Meredith Lancaster 6e6225d5f6 use parameter objects and add tests 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 13:17:08 -08:00
Meredith Lancaster 5e31c53ace condense parameters 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 11:02:59 -08:00
Meredith Lancaster 9539aaeaae add function for creating storage record 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 10:49:24 -08:00
Eugene e7fe163107 Remove unnecessary Buffer to Uint8Array conversion 
Removed unnecessary conversion of Buffer to Uint8Array for compatibility.
 2025-10-16 12:08:05 -04:00
Salman Muin Kayser Chishti 872b8161ee linting 2025-09-04 15:24:57 +01:00
Salman Muin Kayser Chishti 11e9c0b54c Bump package versions, and fix issues 2025-09-04 14:16:27 +01:00
Brian DeHamer 17259fc82d set workflow.ref provenance field from ref claim 
Updates the `buildSLSAProvenancePredicate` function to populate the
`workflow.ref` field from the `ref` claim in the OIDC token.

Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2025-02-26 08:47:27 -08:00
Brian DeHamer 51b0cb5578 Merge pull request #1863 from meriadec/attest-provenance-tags 
Handle tags containing "@" character in `buildSLSAProvenancePredicate`
 2024-11-01 09:35:13 -07:00
Brian DeHamer 65ddc04895 support multi-subject attestations 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-11-01 09:08:19 -07:00
Meriadec Pillet 14010a8882 Handle tags containing "@" character in buildSLSAProvenancePredicate 
When using some monorepo-related tools (like [changesets](https://github.com/changesets/changesets)),
the produced tags have a special format that includes `@` character.

For example, a `foo` package on a monorepo will produce Git tags looking
like `foo@1.0.0` if using changesets.

When used in combination with `actions/attest-build-provenance`, the
action was not properly re-crafting the tag in `buildSLSAProvenancePredicate` because
it was always splitting the workflow ref by `@` and taking the second
element.

This result in this error on CI:

```
Error: Error: Failed to persist attestation: Invalid Argument - values do not match: refs/tags/foo != refs/tags/foo@1.0.0 - https://docs.github.com/rest/repos/repos#create-an-attestation
````

This PR slightly update the logic there, and rather take "everything
located after the first '@'". This shouldn't introduce any breaking
change, while giving support for custom tags.

I've added the corresponding test case, it passes, however I couldn't
successfully run the full test suite (neither on `main`). Looking
forward for CI outcome.

Thanks in advance for the review 🙏.
 2024-10-30 14:29:42 +01:00
Brian DeHamer a840bde9c4 bump @sigstore/sign from 2.3.2 to 3.0.0 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:06:26 -07:00
Brian DeHamer 19beeb5851 fix bug with customized oidc issuer 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-09-04 10:24:28 -07:00
Brian DeHamer cda5d64e13 derive default OIDC issuer from current tenant 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-16 12:07:23 -07:00
Brian DeHamer 29f863eb6f support for headers param in attest functions 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-15 15:35:32 -07:00
Brian DeHamer ccea2d41a8 fix proxy support for jwks retrieval 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-07-26 15:03:40 -07:00
Brian DeHamer 7078b65c42 config rekor to fetch on conflict 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-06-12 11:57:18 -07:00
Brian DeHamer a035e0d5d5 new GHA build provenance 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-06-05 14:54:34 -07:00
Fredrik Skogman c25683555f Fixed a spelling error 2024-05-20 07:57:44 +02:00
Fredrik Skogman d664948017 PR feedback. Juse more JS idiomatic code 2024-05-20 07:52:36 +02:00
Fredrik Skogman 5f94fee887 Read the server url from the environment variable. 
Instead of having the urls hardcoded, read them from the environment.
I opted to read from the environment variable instead of the github context
because it would be easier to test.
 2024-05-16 17:00:35 +02:00
Brian DeHamer 019fe54f20 retry request on failure to save attestation 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-04-24 15:07:39 -07:00
Brian DeHamer f04c795925 remove dep on make-fetch-happen 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-04-23 09:39:17 -07:00
Brian DeHamer 04a08a9a42 generate v0.3 bundles in attest package 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-04-03 12:12:26 -07:00
Brian DeHamer 4de6ecc2c7 build provenance stmt from OIDC claims 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-03-22 12:34:42 -07:00
Brian DeHamer ab53ed1045 add new @actions/attest package 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-02-26 08:52:20 -08:00