Create generator-generic-ossf-slsa3-publish.yml #854
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a new GitHub Actions workflow for generating SLSA (Supply-chain Levels for Software Artifacts) provenance attestations at level 3. The workflow generates cryptographic hashes of build artifacts and creates a signed provenance file using the SLSA framework's generic generator.
Key changes:
- Adds SLSA provenance generation workflow triggered on releases and manual dispatch
- Implements a two-job pipeline: artifact building and provenance generation
- Uses SLSA framework v1.4.0 for generating and uploading attestations
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| build: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| digests: ${{ steps.hash.outputs.digests }} |
There was a problem hiding this comment.
The output references 'digests' but the hash step (line 55) sets 'hashes' instead. Change 'digests' to 'hashes' to match the actual output variable name.
| files=$(ls artifact*) | ||
| # Generate the subjects (base64 encoded). | ||
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" |
There was a problem hiding this comment.
Using 'ls' with glob patterns can fail if no files match and is not recommended in scripts. Use a shell glob directly or 'find' instead: 'files=(artifact*)' or quote the expansion when used.
| files=$(ls artifact*) | |
| # Generate the subjects (base64 encoded). | |
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" | |
| files=(artifact*) | |
| # Generate the subjects (base64 encoded). | |
| echo "hashes=$(sha256sum "${files[@]}" | base64 -w0)" >> "${GITHUB_OUTPUT}" |
| # List the artifacts the provenance will refer to. | ||
| files=$(ls artifact*) | ||
| # Generate the subjects (base64 encoded). | ||
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" |
There was a problem hiding this comment.
The output variable is named 'hashes' but line 23 and line 65 reference it as 'digests'. Either rename this to 'digests' for consistency, or update lines 23 and 65 to use 'hashes'.
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" | |
| echo "digests=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" |
1 participant
No description provided.