Add task results to SLSA 1.0 predicate for pipeline runs
Open
Nobody has claimed this yet.
good first issue
- Dominant language
- Go
- Stars
- 277
- Forks
- 164
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 61
Description
Currently, for pipeline runs, we only capture the pipelineRunResults under byProducts. The underlying task results are not surfaced in the provenance. https://github.com/tektoncd/chains/issues/824 has a use case for this and surfacing this information will help with validation.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading issue 824 for the use case and locating the pipeline-run provenance generation in this repository. Verify how pipelineRunResults are currently placed under byProducts, then ensure task results are surfaced in the SLSA 1.0 predicate and validate the resulting provenance.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100