slsa-framework
Support for pull_request
This is a tracking issue for supporting pull_request events. Please comment regarding your use case.
Another use-case: is to test the configuration.
For example, I didn't realize that env vars are case-sensitive and ran into this problem
env variable empty or not set: {{ .Env.Version }}
because I had been using VERSION in my evaluted-envs.
See https://github.com/slsa-framework/slsa-verifier/pull/298
The OpenZepplin folks mentioned that they would like support for pull requests https://github.com/OpenZeppelin/defender-client/issues/277
Is there anything stopping delegator from PR events? I believe it should be able to output unsigned attestations if htere's a guard on the sign-attestations step.
Right. I think signing is the biggest thing though there are some other subtle differences as well. I think we had issues with which git sha we pick up when generating the provenance? I can't exactly remember but I think detect-workflow-js already supports it: https://github.com/slsa-framework/slsa-github-generator/blob/942ce4027d93050826def3a8677d51c851419e97/.github/actions/detect-workflow-js/src/detect.ts#L84
It would be nice to have id-token scoped to reflect it being issued within the context of a pull request so that artifacts generated during pull request runs such as OCI images could be uploaded to appropriately access controlled registries.
