slsa-github-generator

slsa-github-generator copied to clipboard

We may want to provide the name of the tarball created, so that users can download it if they want to.

laurentsimon

Let's think about whether we need to filter out certain build arguments or not, like we do for the go builder.

laurentsimon

Let's try to upload the package tarball to GitHub release assets, in addition to publishing it.

laurentsimon

[discussion] POSIX Environment Variables

11

# Background: For reproducibility, build steps are included in provenance `buildConfig` by some of our workflows. These build steps include information to reproduce the command, such as the working directory...

ianlewis

Set arch key in Environment

11

Get set the architecture for the build. Since the job that built the artifact could be using a different CPU architecture than the job running the provenance generation, this probably...

ianlewis

[doc] Examples of generating provenance for SBOM, Vulnerability Scan Results, etc.

2

Having some examples of generating provenance for artifacts other than packages or binaries would demonstrate that the generic workflow can be used to generate provenance for files like SBOMs, sarif...

ianlewis

[e2e]: delegator-generic release main default slsa3

1

Repo: https://github.com/slsa-framework/example-package/tree/v42.0.261 Run: https://github.com/slsa-framework/example-package/actions/runs/8593555484 Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.delegator-generic.release.main.default.slsa3.yml Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.delegator-generic.release.main.default.slsa3.yml Trigger: release Branch: v42.0.261 Date: Mon Apr 8 02:14:36 UTC 2024

ianlewis

Repo: https://github.com/slsa-framework/example-package/tree/v14.2.11 Run: https://github.com/slsa-framework/example-package/actions/runs/8595341417 Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.go.tag.main.config-ldflags-noassets.slsa3.yml Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.go.tag.main.config-ldflags-noassets.slsa3.yml Trigger: push Branch: v14.2.11 Date: Mon Apr 8 06:11:24 UTC 2024

laurentsimon

[e2e]: nodejs push main custom_publish slsa3

11

Repo: https://github.com/slsa-framework/example-package/tree/main Run: https://github.com/slsa-framework/example-package/actions/runs/8477833021 Workflow file: https://github.com/slsa-framework/example-package/tree/main/.github/workflows/e2e.nodejs.push.main.custom_publish.slsa3.yml Workflow runs: https://github.com/slsa-framework/example-package/actions/workflows/e2e.nodejs.push.main.custom_publish.slsa3.yml Trigger: push Branch: main Date: Fri Mar 29 06:08:00 UTC 2024

ianlewis

[e2e]: sign-attestations schedule

133

Repo: https://github.com/slsa-framework/slsa-github-generator/tree/main Run: https://github.com/slsa-framework/slsa-github-generator/actions/runs/7000552196 Workflow file: https://github.com/slsa-framework/slsa-github-generator/tree/main/.github/workflows/e2e.sign-attestations.schedule.yml Workflow runs: https://github.com/slsa-framework/slsa-github-generator/actions/workflows/e2e.sign-attestations.schedule.yml Trigger: schedule Branch: main Date: Mon Nov 27 04:18:27 UTC 2023

github-actions[bot]