OpenZeppelin / OpenZeppelin/compact-tools
Add Provenance section to README when applicable.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 4
- Forks
- 5
- Avg merge
- 15h 28m
- Merged PRs (30d)
- 31
Description
A new section of the README should be added to document provenance status. It should include links to the source commit, build workflow and sigstore log entry. Doing so will improve security posture against supply chain attacks and align ourselves with modern security best practices.
Ideally, we create an automation that runs after a successful release to update these values automatically
Example:
Provenance (SLSA)
Built and published from GitHub Actions with npm provenance.
- Source commit: link to commit
- Build workflow: link to workflow run
- Sigstore Transparency Log: link to log entry
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the README and the release automation that runs after a successful release. Trace how the source commit, GitHub Actions workflow run, and Sigstore Transparency Log entry are exposed, then define how those links should be inserted into the Provenance section. Done means the README shows current provenance links after releases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- ci-cd, documentation, release, security
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100