actions/attest
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
130 Commits 1 Branch 0 Tags
bf401015f0f188993b735c853c5aff13c8515cb1
Commit Graph
54 Commits
Author SHA1 Message Date
Salman Muin Kayser Chishti bf401015f0 Merge pull request #2524 from actions/dependabot/npm_and_yarn/packages/attest/brace-expansion-2.1.7 
chore(deps): bump brace-expansion from 2.1.4 to 2.1.7 in /packages/attest
 2026-10-01 13:54:04 +01:00
dependabot[bot] 07ba9529af chore(deps): bump brace-expansion in /packages/attest 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.1.4 to 2.1.7.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.1.4...v2.1.7)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 12:42:36 +00:00
dependabot[bot] 3a92f2718e chore(deps): bump ip-address from 10.2.0 to 10.7.2 in /packages/attest 
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.2.0 to 10.7.2.
- [Release notes](https://github.com/beaugunderson/ip-address/releases)
- [Commits](https://github.com/beaugunderson/ip-address/compare/v10.2.0...v10.7.2)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.7.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-01 12:42:25 +00:00
dependabot[bot] 6496e1159b chore(deps): bump minimatch from 9.0.5 to 9.0.9 in /packages/attest (#2330) 
Bumps [minimatch](https://github.com/isaacs/minimatch) from 9.0.5 to 9.0.9.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/minimatch/compare/v9.0.5...v9.0.9)

---
updated-dependencies:
- dependency-name: minimatch
  dependency-version: 9.0.9
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-03 12:04:33 -04:00
dependabot[bot] 9d7388e34a chore(deps-dev): bump undici from 6.23.0 to 6.28.0 in /packages/attest (#2463) 
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.28.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.23.0...v6.28.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.28.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-03 12:04:29 -04:00
dependabot[bot] 7e355ff9d7 chore(deps): bump brace-expansion in /packages/attest (#2467) 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.1.0 to 2.1.4.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.1.0...v2.1.4)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-03 12:04:25 -04:00
dependabot[bot] 387355ba5c chore(deps): bump tar from 7.5.10 to 7.5.22 in /packages/attest 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.10 to 7.5.22.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.10...v7.5.22)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.22
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-26 15:27:39 +00:00
Meredith Lancaster 7dd930f082 Merge pull request #2368 from actions/dependabot/npm_and_yarn/packages/attest/brace-expansion-2.0.3 
chore(deps): bump brace-expansion from 2.0.2 to 2.0.3 in /packages/attest
 2026-06-08 15:21:00 -07:00
dependabot[bot] 3778c1f266 chore(deps): bump ip-address from 10.0.1 to 10.2.0 in /packages/attest 
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.0.1 to 10.2.0.
- [Commits](https://github.com/beaugunderson/ip-address/commits)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-05-06 23:08:09 +00:00
dependabot[bot] e01cf86fd3 chore(deps): bump brace-expansion in /packages/attest 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-04-20 21:46:32 +00:00
dependabot[bot] d5e5e0ca10 chore(deps): bump tar from 7.5.7 to 7.5.10 in /packages/attest 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.7 to 7.5.10.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.7...v7.5.10)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-06 13:29:24 +00:00
Brian DeHamer 79bb3e3519 new user-agent string for storage record API reqs 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2026-02-25 15:36:27 -08:00
dependabot[bot] 5d460c1b73 chore(deps): bump tar from 7.5.6 to 7.5.7 in /packages/attest 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.6 to 7.5.7.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.6...v7.5.7)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-29 20:20:49 +00:00
Daniel Kennedy 3d6e6ce23e @actions/attest: convert to an ESM module (#2278) 2026-01-29 15:19:39 -05:00
Daniel Kennedy cf504df20e Attest: undo the @actions/github/@octokit bumps 2026-01-27 13:31:31 -05:00
Daniel Kennedy 9a9b2c4f15 Bump @actions/http-client and @actions/github on all packages 2026-01-27 13:31:31 -05:00
dependabot[bot] 36e222372e chore(deps): bump tar from 7.5.2 to 7.5.6 in /packages/attest 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.2 to 7.5.6.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.2...v7.5.6)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-01-21 21:04:00 +00:00
Tingluo Huang f3ecfa051d . 2026-01-08 16:19:53 +00:00
Tingluo Huang 5469ceef45 Bump version to 3.0.0 and update dependencies for @actions/core, @actions/github, and @actions/http-client 2026-01-08 14:34:05 +00:00
copilot-swe-agent[bot]andTingluoHuang 62b0bc66d6 Revert @actions/attest http-client dependency to ^2.2.3 
Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>
 2026-01-07 23:17:02 +00:00
copilot-swe-agent[bot]andTingluoHuang 45f6498c99 Revert @actions/attest version to 2.1.0 - no new release needed 
Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>
 2026-01-07 22:33:05 +00:00
copilot-swe-agent[bot]andTingluoHuang 94d044f218 Verify changes with tests - all package-specific tests passing 
Co-authored-by: TingluoHuang <1750815+TingluoHuang@users.noreply.github.com>
 2026-01-07 22:03:56 +00:00
Meredith Lancaster cc01df9878 regenerate package lock 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 19:22:04 -08:00
Meredith Lancaster 8dbe4a812c regenerate package lock 
Signed-off-by: Meredith Lancaster <malancas@github.com>
 2025-12-08 13:17:18 -08:00
dependabot[bot] b8d55263b1 Bump tar from 7.5.1 to 7.5.2 in /packages/attest 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.1 to 7.5.2.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.1...v7.5.2)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-12-06 01:06:03 +00:00
dependabot[bot] 6754e24d5e Bump glob from 10.4.5 to 10.5.0 in /packages/attest 
Bumps [glob](https://github.com/isaacs/node-glob) from 10.4.5 to 10.5.0.
- [Changelog](https://github.com/isaacs/node-glob/blob/main/changelog.md)
- [Commits](https://github.com/isaacs/node-glob/compare/v10.4.5...v10.5.0)

---
updated-dependencies:
- dependency-name: glob
  dependency-version: 10.5.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-11-19 17:36:35 +00:00
Salman Muin Kayser Chishti ac12f586ff Prepare @actions/attest 2.0.0 release 2025-10-20 12:07:20 +01:00
Salman Muin Kayser Chishti 163c6493df package json 2025-10-15 16:27:29 +01:00
Salman Muin Kayser Chishti bfa8a2566b Keep attest at the same version 2025-10-15 16:27:29 +01:00
Salman Muin Kayser Chishti a160d5b10c update with dist updates 2025-10-15 16:22:51 +01:00
Salman Muin Kayser Chishti 8209fc5475 package updates 2025-09-04 15:15:02 +01:00
Salman Muin Kayser Chishti 11e9c0b54c Bump package versions, and fix issues 2025-09-04 14:16:27 +01:00
dependabot[bot] 3cd98a77ca Bump undici from 5.28.5 to 5.29.0 in /packages/attest 
Bumps [undici](https://github.com/nodejs/undici) from 5.28.5 to 5.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v5.28.5...v5.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 5.29.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-05-15 16:30:57 +00:00
Brian DeHamer f8cf7bb47e Merge pull request #2045 from actions/dependabot/npm_and_yarn/packages/attest/octokit/endpoint-9.0.6 
Bump @octokit/endpoint from 9.0.5 to 9.0.6 in /packages/attest
 2025-05-08 10:47:59 -07:00
dependabot[bot] 5b044c3671 Bump @octokit/request-error from 5.1.0 to 5.1.1 in /packages/attest 
Bumps [@octokit/request-error](https://github.com/octokit/request-error.js) from 5.1.0 to 5.1.1.
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](https://github.com/octokit/request-error.js/compare/v5.1.0...v5.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/request-error"
  dependency-version: 5.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-05-08 11:19:50 +00:00
dependabot[bot] 36d77f99f9 Bump @octokit/endpoint from 9.0.5 to 9.0.6 in /packages/attest 
Bumps [@octokit/endpoint](https://github.com/octokit/endpoint.js) from 9.0.5 to 9.0.6.
- [Release notes](https://github.com/octokit/endpoint.js/releases)
- [Commits](https://github.com/octokit/endpoint.js/compare/v9.0.5...v9.0.6)

---
updated-dependencies:
- dependency-name: "@octokit/endpoint"
  dependency-version: 9.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2025-05-08 11:19:48 +00:00
Brian DeHamer 17259fc82d set workflow.ref provenance field from ref claim 
Updates the `buildSLSAProvenancePredicate` function to populate the
`workflow.ref` field from the `ref` claim in the OIDC token.

Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2025-02-26 08:47:27 -08:00
Brian DeHamer 4226953ba4 bump undici to 5.28.5 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2025-02-14 08:02:10 -08:00
Brian DeHamer bc817e5c77 Merge pull request #1848 from actions/bdehamer/attest-prep-1-5 
`@actions/attest`: prep release of @actions/attest v1.5.0
 2024-10-14 12:49:33 -07:00
Brian DeHamer ad75fd720a Merge pull request #1847 from actions/bdehamer/attest-update-core 
`@actions/attest`: bump @actions/core from 1.10.1 to 1.11.1
 2024-10-14 12:49:15 -07:00
Brian DeHamer 1b0814bceb prep release of @actions/attest v1.5.0 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:33:10 -07:00
Brian DeHamer 40845d7567 bump @actions/core from 1.10.1 to 1.11.1 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:16:09 -07:00
Brian DeHamer a840bde9c4 bump @sigstore/sign from 2.3.2 to 3.0.0 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-10-14 12:06:26 -07:00
Brian DeHamer 19beeb5851 fix bug with customized oidc issuer 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-09-04 10:24:28 -07:00
Brian DeHamer e34e1a99d2 bump @actions/http-client from 2.2.1 to 2.2.3 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-22 07:52:03 -07:00
Brian DeHamer 29f863eb6f support for headers param in attest functions 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-08-15 15:35:32 -07:00
Brian DeHamer ccea2d41a8 fix proxy support for jwks retrieval 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-07-26 15:03:40 -07:00
Brian DeHamer 8c0d1197a8 prep 1.3.0 release of @actions/attest 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-05-21 13:11:37 -07:00
Brian DeHamer 019fe54f20 retry request on failure to save attestation 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-04-24 15:07:39 -07:00
Brian DeHamer f04c795925 remove dep on make-fetch-happen 
Signed-off-by: Brian DeHamer <bdehamer@github.com>
 2024-04-23 09:39:17 -07:00