Chuang Wang
Seems like the slsa0.2 spec doesn't explicitly say the `configSource` and `buildConfig` shouldn't exist simultaneously. In the [Cloud Build example](https://slsa.dev/provenance/v0.2#:~:text=Cloud%20Build%20config%2Das%2Dcode) listed on the website, both sections are filled with content.
Thanks for the details @priyawadhwa ! I feel like it might be necessary to always keep `buildConfig` section for at least auditing purpose and also for helping reproduce a build....
This PR is ready for review. Please take a look @wlynch, @jagathprakash, @lcarva when you get a chance. Thank you very much for your time and feedback in advance!
> Mostly LGTM! > > Just some small tweaks. Hey @wlynch, Thank you so much for reviewing the PR. I've incorporated all the comments in the recent change except the...
/assign @wlynch added you as assignee. Thank you for the thorough review!!
/assign @wlynch
/test pull-tekton-pipeline-alpha-integration-tests
/test pull-tekton-pipeline-alpha-integration-tests