slsa-github-generator
slsa-github-generator copied to clipboard
slsa-framework
chore(deps): update github-actions
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| actions/checkout | action | minor | v3.0.2 -> v3.1.0 |
| actions/checkout | action | minor | v2.4.2 -> v2.5.0 |
| actions/download-artifact | action | patch | v3.0.0 -> v3.0.1 |
| actions/setup-go | action | patch | v3.3.0 -> v3.3.1 |
| actions/setup-node | action | minor | v3.4.1 -> v3.5.1 |
| actions/upload-artifact | action | patch | v3.1.0 -> v3.1.1 |
| actions/upload-artifact | action | digest | 3cea537 -> 83fd05a |
| github/codeql-action | action | patch | v2.1.22 -> v2.1.28 |
| sigstore/cosign-installer | action | minor | v2.6.0 -> v2.8.1 |
| slsa-framework/slsa-github-generator | action | digest | 923a5a2 -> ce2408f |
Release Notes
actions/checkout
v3.1.0
actions/setup-go
v3.3.1
In scope of this release we fixed the issue with the correct generation of the cache key when the go-version-file input is set (https://github.com/actions/setup-go/pull/267). Moreover, we fixed an issue when the cache folder was not found. Besides, we updated actions/core to 1.10.0 version (https://github.com/actions/setup-go/pull/273).
actions/setup-node
v3.5.1
In scope of this release we updated actions/core to 1.10.0. Moreover, we added logic to print Nodejs, Npm, Yarn versions after installation.
v3.5.0
In scope of this release we add support for engines.node. The action will be able to grab the version form package.json#engines.node. https://github.com/actions/setup-node/pull/485. Moreover, we added support for Volta
Besides, we updated @actions/core to 1.9.1 and @actions/cache to 3.0.4
actions/upload-artifact
v3.1.1
- Update actions/core package to latest version to remove
set-outputdeprecation warning #351
sigstore/cosign-installer
v2.8.1
What's Changed
- bump cosign install to use release v1.13.1 by @cpanato in https://github.com/sigstore/cosign-installer/pull/98
Full Changelog: https://github.com/sigstore/cosign-installer/compare/v2...v2.8.1
v2.8.0
What's Changed
- bump cosign to v1.13.0 by @cpanato in https://github.com/sigstore/cosign-installer/pull/95
Full Changelog: https://github.com/sigstore/cosign-installer/compare/v2.7.0...v2.8.0
v2.7.0
What's Changed
- bump cosign to v1.12.1 by @cpanato in https://github.com/sigstore/cosign-installer/pull/94
Full Changelog: https://github.com/sigstore/cosign-installer/compare/v2...v2.7.0
Configuration
📅 Schedule: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
- [ ] If you want to rebase/retry this PR, click this checkbox.
This PR has been generated by Mend Renovate. View repository job log here.
/cc @ianlewis we may have updated the ncc dependency.. I'm curious why it was not caught during an early pre-submit. Maybe another problem?
check-dist-matrix is covered in #883.
For others it seems that building the builder is failing on verify-checkout. I'm not sure why.
mismatch git sha 81e7de69c1ac2722c5e0f48de5158e1738290b76 != 895fca8cfd55bd11d27ee394ae2eeb486328f9da
Maybe because of some change that happened to verify-checkout that happened between commits e3220805577deb9d193f64e519abcb3b50851df5 and de4491844e9be4184f786666af40f5b1b8e7ddc0?
So it seems like we had been referencing generate-builder at e3220805577deb9d193f64e519abcb3b50851df5 https://github.com/slsa-framework/slsa-github-generator/blob/main/.github/workflows/generator_generic_slsa3.yml#L111
Which uses checkout-go at f9878d18f3c896502bdb5bbb96187fb787d529bb https://github.com/slsa-framework/slsa-github-generator/blob/e3220805577deb9d193f64e519abcb3b50851df5/.github/actions/generate-builder/action.yml#L37
which doesn't call verify-checkout https://github.com/slsa-framework/slsa-github-generator/blob/f9878d18f3c896502bdb5bbb96187fb787d529bb/.github/actions/checkout-go/action.yml
But when I update the generate-builder to use my test release per the release instructions it now includes the verify-checkout check and fails.
I think verify-checkout is maybe assuming that GITHUB_SHA and the locally checked out workspace will always be the same repo? In normal cases the GITHUB_SHA will be a digest from the user's repo and the local checkout will likely be the slsa-github-generator repo. e.g. when building the builder/generator.
renovate-bot is trying to update some of the references back to the v1.2.0 tag to match the tag=v1.2.0 comments and that's causing failures.
fyi, im going to try to clean up the reference problem in https://github.com/slsa-framework/slsa-github-generator/issues/880