actions/attest
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
116 Commits 1 Branch 0 Tags
79bb3e3519d40f8ff5a440d32f5bec005dcf49ec
Commit Graph
116 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Salman Chishti 50b052442c Support Nodejs.24 - Merge pull request #2110 from actions/salmanmkc/node24 
Support Node.js 24
 2025-10-16 16:25:47 +01:00
Salman Muin Kayser Chishti e98c2154a1 remove skip lib check 2025-10-15 16:28:21 +01:00
Salman Muin Kayser Chishti 163c6493df package json 2025-10-15 16:27:29 +01:00
Salman Muin Kayser Chishti bfa8a2566b Keep attest at the same version 2025-10-15 16:27:29 +01:00
Salman Muin Kayser Chishti a160d5b10c update with dist updates 2025-10-15 16:22:51 +01:00
Salman Muin Kayser Chishti 872b8161ee linting 2025-09-04 15:24:57 +01:00
Salman Muin Kayser Chishti 8209fc5475 package updates 2025-09-04 15:15:02 +01:00
Salman Muin Kayser Chishti 11e9c0b54c Bump package versions, and fix issues 2025-09-04 14:16:27 +01:00
Brian DeHamer 30ca54a683 Merge pull request #2058 from actions/dependabot/npm_and_yarn/packages/attest/undici-5.29.0 
Bump undici from 5.28.5 to 5.29.0 in /packages/attest
 2025-05-25 16:30:11 -07:00
dependabot[bot] 3cd98a77ca Bump undici from 5.28.5 to 5.29.0 in /packages/attest 
Bumps [undici](https://github.com/nodejs/undici) from 5.28.5 to 5.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v5.28.5...v5.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 5.29.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-05-15 16:30:57 +00:00
Brian DeHamer f8cf7bb47e Merge pull request #2045 from actions/dependabot/npm_and_yarn/packages/attest/octokit/endpoint-9.0.6 
Bump @octokit/endpoint from 9.0.5 to 9.0.6 in /packages/attest
 2025-05-08 10:47:59 -07:00
Brian DeHamer 932d8d1b67 Merge pull request #2044 from actions/dependabot/npm_and_yarn/packages/attest/octokit/request-error-5.1.1 
Bump @octokit/request-error from 5.1.0 to 5.1.1 in /packages/attest
 2025-05-08 10:47:20 -07:00
dependabot[bot] 5b044c3671 Bump @octokit/request-error from 5.1.0 to 5.1.1 in /packages/attest 
Bumps [@octokit/request-error](https://github.com/octokit/request-error.js) from 5.1.0 to 5.1.1.
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](https://github.com/octokit/request-error.js/compare/v5.1.0...v5.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/request-error"
  dependency-version: 5.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-05-08 11:19:50 +00:00
dependabot[bot] 36d77f99f9 Bump @octokit/endpoint from 9.0.5 to 9.0.6 in /packages/attest 
Bumps [@octokit/endpoint](https://github.com/octokit/endpoint.js) from 9.0.5 to 9.0.6.
- [Release notes](https://github.com/octokit/endpoint.js/releases)
- [Commits](https://github.com/octokit/endpoint.js/compare/v9.0.5...v9.0.6)

---
updated-dependencies:
- dependency-name: "@octokit/endpoint"
  dependency-version: 9.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-05-08 11:19:48 +00:00
Brian DeHamer 17259fc82d set workflow.ref provenance field from ref claim 
Updates the `buildSLSAProvenancePredicate` function to populate the
`workflow.ref` field from the `ref` claim in the OIDC token.

Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2025-02-26 08:47:27 -08:00
Brian DeHamer 4226953ba4 bump undici to 5.28.5 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2025-02-14 08:02:10 -08:00
Bassem Dghaidi 5156412c00 Merge pull request #1857 from actions/neo-cache-service 
Integrate cache service v2
 2024-11-22 19:22:23 +01:00
Bassem Dghaidi cf56a4d6ad Post merge cleanup 2024-11-14 02:04:20 -08:00
Bassem Dghaidi a6563809e5 Merge branch 'main' into neo-cache-service 2024-11-14 02:02:55 -08:00
Brian DeHamer 83ea5e6805 Merge pull request #1870 from actions/bdehamer/attest-1.5-release-notes 
`@actions/attest`: Release notes for v1.5.0 release
 2024-11-01 09:55:13 -07:00
Brian DeHamer 286a1b1305 update release notes for @actions/attest v1.5.0 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-11-01 09:45:11 -07:00
Brian DeHamer 51b0cb5578 Merge pull request #1863 from meriadec/attest-provenance-tags 
Handle tags containing "@" character in `buildSLSAProvenancePredicate`
 2024-11-01 09:35:13 -07:00
Brian DeHamer 6a1cd1787d Merge pull request #1865 from actions/bdehamer/multi-subject 
`@actions/attest`: Support multi-subject attestations
 2024-11-01 09:33:11 -07:00
Brian DeHamer 65ddc04895 support multi-subject attestations 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-11-01 09:08:19 -07:00
Meriadec Pillet 14010a8882 Handle tags containing "@" character in buildSLSAProvenancePredicate 
When using some monorepo-related tools (like [changesets](https://github.com/changesets/changesets)),
the produced tags have a special format that includes `@` character.

For example, a `foo` package on a monorepo will produce Git tags looking
like `foo@1.0.0` if using changesets.

When used in combination with `actions/attest-build-provenance`, the
action was not properly re-crafting the tag in `buildSLSAProvenancePredicate` because
it was always splitting the workflow ref by `@` and taking the second
element.

This result in this error on CI:

```
Error: Error: Failed to persist attestation: Invalid Argument - values do not match: refs/tags/foo != refs/tags/foo@1.0.0 - https://docs.github.com/rest/repos/repos#create-an-attestation
````

This PR slightly update the logic there, and rather take "everything
located after the first '@'". This shouldn't introduce any breaking
change, while giving support for custom tags.

I've added the corresponding test case, it passes, however I couldn't
successfully run the full test suite (neither on `main`). Looking
forward for CI outcome.

Thanks in advance for the review 🙏.
 2024-10-30 14:29:42 +01:00
Bassem Dghaidi afaf93f986 Merge branch 'main' into neo-cache-service 2024-10-21 02:25:12 -07:00
Brian DeHamer bc817e5c77 Merge pull request #1848 from actions/bdehamer/attest-prep-1-5 
`@actions/attest`: prep release of @actions/attest v1.5.0
 2024-10-14 12:49:33 -07:00
Brian DeHamer ad75fd720a Merge pull request #1847 from actions/bdehamer/attest-update-core 
`@actions/attest`: bump @actions/core from 1.10.1 to 1.11.1
 2024-10-14 12:49:15 -07:00
Brian DeHamer a8659a4f65 Merge pull request #1846 from actions/bdehamer/sigstore-3-0-0 
`@actions/attest`: bump @sigstore/sign from 2.3.2 to 3.0.0
 2024-10-14 12:48:55 -07:00
Brian DeHamer 1b0814bceb prep release of @actions/attest v1.5.0 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:33:10 -07:00
Brian DeHamer 40845d7567 bump @actions/core from 1.10.1 to 1.11.1 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:16:09 -07:00
Brian DeHamer a840bde9c4 bump @sigstore/sign from 2.3.2 to 3.0.0 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:06:26 -07:00
Bassem Dghaidi c432cdf279 Merge branch 'main' into neo-cache-service 2024-09-24 02:36:02 -07:00
Brian DeHamer 32badf40f7 Merge pull request #1823 from actions/bdehamer/enterprise-issuer 
[@actions/attest] Fix bug with customized OIDC issuer
 2024-09-05 09:17:37 -07:00
Brian DeHamer 19beeb5851 fix bug with customized oidc issuer 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-09-04 10:24:28 -07:00
Brian DeHamer 54f1bb6409 Merge pull request #1805 from actions/bdehamer/update-http-client 
bump @actions/http-client from 2.2.1 to 2.2.3
 2024-08-22 08:39:26 -07:00
Brian DeHamer e34e1a99d2 bump @actions/http-client from 2.2.1 to 2.2.3 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-22 07:52:03 -07:00
Brian DeHamer b4b02b837a improve release notes for @actions/attest 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-16 12:43:39 -07:00
Brian DeHamer cda5d64e13 derive default OIDC issuer from current tenant 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-16 12:07:23 -07:00
Brian DeHamer f213760a3b Merge pull request #1790 from actions/bdehamer/attest-headers 
support for headers param in attest functions
 2024-08-16 07:21:46 -07:00
Brian DeHamer 29f863eb6f support for headers param in attest functions 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-15 15:35:32 -07:00
Brian DeHamer 68a7e6b1a5 Merge pull request #1776 from actions/bdehamer/jwks-proxy-fix 
fix proxy support for jwks retrieval
 2024-07-29 16:31:41 -07:00
Brian DeHamer ccea2d41a8 fix proxy support for jwks retrieval 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-07-26 15:03:40 -07:00
Brian DeHamer d8e24a34c9 Merge pull request #1759 from actions/bdehamer/rekor-409 
config rekor to fetch on conflict
 2024-06-12 12:25:06 -07:00
Brian DeHamer 7078b65c42 config rekor to fetch on conflict 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-06-12 11:57:18 -07:00
Brian DeHamer 4102b269e4 Merge pull request #1745 from actions/bdehamer/attest-provenance 
(@actions/attest) New GHA provenance build type
 2024-06-12 11:45:37 -07:00
Brian DeHamer a035e0d5d5 new GHA build provenance 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-06-05 14:54:34 -07:00
Brian DeHamer 1da6586ab2 Merge pull request #1738 from actions/bdehamer/attest-1.3.0 
(@actions/attest) prepare 1.3.0 release
 2024-06-05 14:53:11 -07:00
Bassem Dghaidi 741960fe91 add debug 2024-05-23 09:04:37 -07:00
Brian DeHamer 8c0d1197a8 prep 1.3.0 release of @actions/attest 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-05-21 13:11:37 -07:00