mirror of
https://github.com/actions/attest-build-provenance.git
synced 2026-06-13 18:19:53 +00:00
284c3fc77e
Fixes #454 Add support for passing a list of docker images to attest. * **action.yml** - Add a new input parameter `subject-images` to accept a list of docker images. - Update the `runs` section to handle the `subject-images` input. * **src/main.ts** - Import `parseMultiImageInput` function from `utils.ts`. - Add logic to handle the `subject-images` input and process multiple docker images for attestation. * **README.md** - Update the documentation to include usage instructions for the `subject-images` input. - Add an example for attesting multiple docker images. * **__tests__/main.test.ts** - Add test cases to verify the functionality of attesting multiple docker images using the `subject-images` input. * **src/utils.ts** - Add a new file to include the `parseMultiImageInput` function to parse the `subject-images` input. --- For more details, open the [Copilot Workspace session](https://copilot-workspace.githubnext.com/actions/attest-build-provenance/issues/454?shareId=XXXX-XXXX-XXXX-XXXX).
85 lines
3.4 KiB
YAML
85 lines
3.4 KiB
YAML
name: 'Attest Build Provenance'
|
|
description: 'Generate provenance attestations for build artifacts'
|
|
author: 'GitHub'
|
|
branding:
|
|
color: 'blue'
|
|
icon: 'lock'
|
|
|
|
inputs:
|
|
subject-path:
|
|
description: >
|
|
Path to the artifact serving as the subject of the attestation. Must
|
|
specify exactly one of "subject-path", "subject-digest", "subject-checksums", or "subject-images". May contain a glob pattern or list of paths
|
|
(total subject count cannot exceed 1024).
|
|
required: false
|
|
subject-digest:
|
|
description: >
|
|
Digest of the subject for which provenance will be generated. Must be in
|
|
the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify
|
|
exactly one of "subject-path", "subject-digest", "subject-checksums", or "subject-images".
|
|
required: false
|
|
subject-name:
|
|
description: >
|
|
Subject name as it should appear in the attestation. Required when
|
|
identifying the subject with the "subject-digest" input.
|
|
subject-checksums:
|
|
description: >
|
|
Path to checksums file containing digest and name of subjects for
|
|
attestation. Must specify exactly one of "subject-path", "subject-digest",
|
|
"subject-checksums", or "subject-images".
|
|
required: false
|
|
subject-images:
|
|
description: >
|
|
List of docker images to attest. Each image should be specified in the
|
|
format "registry/image:tag@digest". Must specify exactly one of
|
|
"subject-path", "subject-digest", "subject-checksums", or "subject-images".
|
|
required: false
|
|
push-to-registry:
|
|
description: >
|
|
Whether to push the provenance statement to the image registry. Requires
|
|
that the "subject-name" parameter specify the fully-qualified image name
|
|
and that the "subject-digest" parameter be specified. Defaults to false.
|
|
default: false
|
|
required: false
|
|
show-summary:
|
|
description: >
|
|
Whether to attach a list of generated attestations to the workflow run
|
|
summary page. Defaults to true.
|
|
default: true
|
|
required: false
|
|
github-token:
|
|
description: >
|
|
The GitHub token used to make authenticated API requests.
|
|
default: ${{ github.token }}
|
|
required: false
|
|
|
|
outputs:
|
|
bundle-path:
|
|
description: 'The path to the file containing the attestation bundle.'
|
|
value: ${{ steps.attest.outputs.bundle-path }}
|
|
attestation-id:
|
|
description: 'The ID of the attestation.'
|
|
value: ${{ steps.attest.outputs.attestation-id }}
|
|
attestation-url:
|
|
description: 'The URL for the attestation summary.'
|
|
value: ${{ steps.attest.outputs.attestation-url }}
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- uses: actions/attest-build-provenance/predicate@36fa7d009e22618ca7cd599486979b8150596c74 # predicate@1.1.4
|
|
id: generate-build-provenance-predicate
|
|
- uses: actions/attest@v2.2.0
|
|
id: attest
|
|
with:
|
|
subject-path: ${{ inputs.subject-path }}
|
|
subject-digest: ${{ inputs.subject-digest }}
|
|
subject-name: ${{ inputs.subject-name }}
|
|
subject-checksums: ${{ inputs.subject-checksums }}
|
|
subject-images: ${{ inputs.subject-images }}
|
|
predicate-type: ${{ steps.generate-build-provenance-predicate.outputs.predicate-type }}
|
|
predicate: ${{ steps.generate-build-provenance-predicate.outputs.predicate }}
|
|
push-to-registry: ${{ inputs.push-to-registry }}
|
|
show-summary: ${{ inputs.show-summary }}
|
|
github-token: ${{ inputs.github-token }}
|