@actions/attest buildSLSAProvenancePredicate should add inputs into externalParameters
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 5.9k
- Forks
- 1.8k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the enhancement
The build result depends on the workflow inputs and these would need to be attested as well.
It would also be useful to be able to add any other external values that contribute into the artifact being attested.
This comes from https://github.com/actions/attest-build-provenance/issues/55. As the actions/attest-build-provenance/predicate action has been discontinued, it has become more difficult to patch this information into the predicate.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names buildSLSAProvenancePredicate and the discontinued actions/attest-build-provenance/predicate action; start by locating that predicate builder and reviewing the linked provenance issue. Define how workflow inputs and other artifact-affecting values are represented in externalParameters, then verify the predicate includes them.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, typescript
- Domain
- devops, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100