slsa-github-generator

slsa-github-generator copied to clipboard

This PR contains the following updates: | Package | Change | Age | Adoption | Passing | Confidence | |---|---|---|---|---|---| | [yamllint](https://togithub.com/adrienverge/yamllint) | `==1.33.0` -> `==1.35.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/)...

renovate-bot

feat: Add ability to attest the supplied multi-arch image

2

# Summary When using docker buildx to build multi-arch images, SLSA workflow may need to recursively attest underlying images for the multi-arch build. This is possible using `--recursive=true` according to...

Danil-Grigorev

Update link to example usage of docker builder by Oak Project

3

docs: update link to Oak Project workflow file # Summary Update link to example workflow usage by Oak Project in `README.md` ## Testing Process Visually verified change and followed updated...

thompson-shaun

[bug] Standard discrepancy: `buildInvocationId` versus `buildInvocationID`

7

My colleague @facutuesca observed this bug with the `generator_generic_slsa3.yml` action. **Describe the bug** In SLSA 0.1 and 0.2, `buildInvocationId` is spelled with a lowercase "d": Similarly, it's spelled with a...

woodruffw

[feature] Run `go generate ./...` before build

1

**Is your feature request related to a problem? Please describe.** Some files need to be generated, which will be used in `go build` **Describe the solution you'd like** Add another...

OpenWaygate

Bumps the npm_and_yarn group with 1 update in the / directory: [micromatch](https://github.com/micromatch/micromatch). Updates `micromatch` from 4.0.5 to 4.0.8 Release notes Sourced from micromatch's releases. 4.0.8 Ultimate release that fixes both...

dependabot[bot]

Add functionality to output the UUID for log lookup purposes

7

# Summary Add functionality to [output the UUID](https://github.com/slsa-framework/slsa-github-generator/issues/3741) for log lookup purposes. The `provenance-rekor-uuid` parameter represents the Rekor UUID, a unique identifier that can be used to search for and...

daoauth

[feature][tracking] - SLSA 1.0 support

3

This is a tracking issue for SLSA 1.0 support. Feel free to edit this ticket with issues related to supporting SLSA 1.0 requirements/spec.

mlieberman85

Using UUID Output from “generator/Create and sign provenance” Step in generator_generic_slsa3 Job

4

When using generator_generic_slsa3 in the workflow, the last part of the "generator/Create and sign provenance" step outputs "Uploaded signed attestation to rekor with UUID". I would like to use this...

daoauth