set workflow.ref provenance field from ref claim #1969

bdehamer · 2025-02-26T16:46:44Z

Updates the buildSLSAProvenancePredicate function in the @actions/attest package to populate the workflow.ref field from the ref claim in the OIDC token.

For most events which trigger a workflow run (push, release, workflow_dispatch, etc) this will have no impact on generated predicate statement. For other events which may be triggered from ref-less commits, this will ensure that the populated value more accurately reflects the state of the workflow run.

Updates the `buildSLSAProvenancePredicate` function to populate the `workflow.ref` field from the `ref` claim in the OIDC token. Signed-off-by: Brian DeHamer <bdehamer@github.com>

bdehamer · 2025-02-26T17:24:39Z

packages/attest/__tests__/provenance.test.ts

-
-    it('handle tags including "@" character', async () => {
-      nock.cleanAll()
-      await mockIssuer({
-        ...claims,
-        workflow_ref: 'owner/repo/.github/workflows/main.yml@foo@1.0.0'
-      })
-      const predicate = await buildSLSAProvenancePredicate()
-      expect(predicate).toMatchSnapshot()
-    })


This test was specifically handling the scenario where the ref was parsed from the workflow_ref claim and is no longer necessary since we no longer need to extract this value.

ejahnGithub

LGTM!

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [actions/attest-build-provenance](https://redirect.github.com/actions/attest-build-provenance) | action | minor | `v2` -> `v2.4.0` | --- ### Release Notes <details> <summary>actions/attest-build-provenance (actions/attest-build-provenance)</summary> ### [`v2.4.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.4.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.3.0...v2.4.0) #### What's Changed - Bump undici from 5.28.5 to 5.29.0 by [@dependabot](https://redirect.github.com/dependabot) in [#633](https://redirect.github.com/actions/attest-build-provenance/pull/633) - Bump actions/attest from 2.3.0 to [2.4.0](https://redirect.github.com/actions/attest/releases/tag/v2.4.0) by [@bdehamer](https://redirect.github.com/bdehamer) in [#654](https://redirect.github.com/actions/attest-build-provenance/pull/654) - Includes support for the new well-known summary file which will accumulate paths to all attestations generated in a given workflow run **Full Changelog**: <actions/attest-build-provenance@v2.3.0...v2.4.0> ### [`v2.3.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.3.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.3...v2.3.0) #### What's Changed - Bump `actions/attest` from 2.2.1 to 2.3.0 by [@bdehamer](https://redirect.github.com/bdehamer) in [#615](https://redirect.github.com/actions/attest-build-provenance/pull/615) - Updates `@sigstore/oci` from 0.4.0 to 0.5.0 **Full Changelog**: <actions/attest-build-provenance@v2.2.3...v2.3.0> ### [`v2.2.3`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.3) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.2...v2.2.3) #### What's Changed - Pin actions/attest reference by commit SHA by [@bdehamer](https://redirect.github.com/bdehamer) in [#493](https://redirect.github.com/actions/attest-build-provenance/pull/493) **Full Changelog**: <actions/attest-build-provenance@v2.2.2...v2.2.3> ### [`v2.2.2`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.2) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.1...v2.2.2) #### What's Changed - Bump predicate action from 1.1.4 to 1.1.5 by [@bdehamer](https://redirect.github.com/bdehamer) in [#485](https://redirect.github.com/actions/attest-build-provenance/pull/485) - Bump [@actions/attest](https://redirect.github.com/actions/attest) from 1.5.0 to 1.6.0 by [@bdehamer](https://redirect.github.com/bdehamer) in [#484](https://redirect.github.com/actions/attest-build-provenance/pull/484) - Update buildSLSAProvenancePredicate to populate `workflow.ref` field from the `ref` claim in the OIDC token ([actions/toolkit#1969](https://redirect.github.com/actions/toolkit/pull/1969)) **Full Changelog**: <actions/attest-build-provenance@v2.2.1...v2.2.2> ### [`v2.2.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.1) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.2.0...v2.2.1) #### What's Changed - Bump undici from 5.28.4 to 5.28.5 by [@dependabot](https://redirect.github.com/dependabot) in [#457](https://redirect.github.com/actions/attest-build-provenance/pull/457) - Bump [@octokit/request-error](https://redirect.github.com/octokit/request-error) from 5.0.1 to 5.1.1 by [@dependabot](https://redirect.github.com/dependabot) in [#469](https://redirect.github.com/actions/attest-build-provenance/pull/469) - Bump [@octokit/request](https://redirect.github.com/octokit/request) from 8.2.0 to 8.4.1 by [@dependabot](https://redirect.github.com/dependabot) in [#478](https://redirect.github.com/actions/attest-build-provenance/pull/478) - Bump actions/attest from 2.2.0 to 2.2.1 by [@bdehamer](https://redirect.github.com/bdehamer) in [#481](https://redirect.github.com/actions/attest-build-provenance/pull/481) - Includes `@actions/attest` [v1.6.0](https://redirect.github.com/actions/toolkit/blob/main/packages/attest/RELEASES.md#160) **Full Changelog**: <actions/attest-build-provenance@v2.2.0...v2.2.1> ### [`v2.2.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.2.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.1.0...v2.2.0) #### What's Changed - Bump actions/attest from v2.1.0 to v2.2.0 by [@bdehamer](https://redirect.github.com/bdehamer) in [#449](https://redirect.github.com/actions/attest-build-provenance/pull/449) - Includes support for now `subject-checksums` input parameter **Full Changelog**: <actions/attest-build-provenance@v2.1.0...v2.2.0> ### [`v2.1.0`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.1.0) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2.0.1...v2.1.0) #### What's Changed - Update README w/ note about GH plans supporting attestations by [@bdehamer](https://redirect.github.com/bdehamer) in [#414](https://redirect.github.com/actions/attest-build-provenance/pull/414) - Add `attestation-id` and `attestation-url` outputs by [@bdehamer](https://redirect.github.com/bdehamer) in [#415](https://redirect.github.com/actions/attest-build-provenance/pull/415) **Full Changelog**: <actions/attest-build-provenance@v2.0.1...v2.1.0> ### [`v2.0.1`](https://redirect.github.com/actions/attest-build-provenance/releases/tag/v2.0.1) [Compare Source](https://redirect.github.com/actions/attest-build-provenance/compare/v2...v2.0.1) #### What's Changed - Bump actions/attest from 2.0.0 to 2.0.1 by [@bdehamer](https://redirect.github.com/bdehamer) in [#406](https://redirect.github.com/actions/attest-build-provenance/pull/406) - Deduplicate subjects before adding to in-toto statement **Full Changelog**: <actions/attest-build-provenance@v2.0.0...v2.0.1> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "every weekend" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/munich-quantum-toolkit/qusat).  Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

set workflow.ref provenance field from ref claim

0bc338a

Updates the `buildSLSAProvenancePredicate` function to populate the `workflow.ref` field from the `ref` claim in the OIDC token. Signed-off-by: Brian DeHamer <bdehamer@github.com>

bdehamer force-pushed the bdehamer/workflow-ref branch from c59c9d5 to 0bc338a Compare February 26, 2025 16:47

bdehamer marked this pull request as ready for review February 26, 2025 16:48

bdehamer requested a review from a team as a code owner February 26, 2025 16:48

bdehamer commented Feb 26, 2025

View reviewed changes

ejahnGithub approved these changes Feb 26, 2025

View reviewed changes

bdehamer merged commit ec9716b into main Feb 26, 2025
16 of 17 checks passed

bdehamer deleted the bdehamer/workflow-ref branch February 26, 2025 17:50

This was referenced Feb 26, 2025

bump @actions/attest from 1.5.0 to 1.6.0 actions/attest#217

Merged

Bump actions/attest from 2.2.0 to 2.2.1 actions/attest-build-provenance#481

Merged

bump @actions/attest from 1.5.0 to 1.6.0 actions/attest-build-provenance#484

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

set workflow.ref provenance field from ref claim #1969

set workflow.ref provenance field from ref claim #1969

Uh oh!

bdehamer commented Feb 26, 2025 •

edited

Loading

Uh oh!

bdehamer Feb 26, 2025

Uh oh!

ejahnGithub left a comment

Uh oh!

Uh oh!

Uh oh!

set workflow.ref provenance field from ref claim #1969

set workflow.ref provenance field from ref claim #1969

Uh oh!

Conversation

bdehamer commented Feb 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bdehamer Feb 26, 2025

Choose a reason for hiding this comment

Uh oh!

ejahnGithub left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bdehamer commented Feb 26, 2025 •

edited

Loading