Skip to content

Add SLSA generic generator workflow #6788

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add SLSA generic generator workflow #6788

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions .github/workflows/generator-generic-ossf-slsa3-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow lets you generate SLSA provenance file for your project.
# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements
# The project is an initiative of the OpenSSF (openssf.org) and is developed at
# https://github.com/slsa-framework/slsa-github-generator.
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.

name: SLSA generic generator
on:
workflow_dispatch:
release:
types: [created]

jobs:
build:
runs-on: ubuntu-latest
Copy link

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent runner version. All other workflows in this repository use specific Ubuntu versions like ubuntu-24.04 instead of ubuntu-latest. Using a specific version ensures more predictable and reproducible builds.

Suggested change
runs-on: ubuntu-latest
runs-on: ubuntu-24.04

Copilot uses AI. Check for mistakes.
outputs:
digests: ${{ steps.hash.outputs.digests }}

steps:
- uses: actions/checkout@v4
Copy link

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inconsistent action version. All other workflows in this repository use actions/checkout@v5. Update to v5 for consistency.

Suggested change
- uses: actions/checkout@v4
- uses: actions/checkout@v5

Copilot uses AI. Check for mistakes.

# ========================================================
#
# Step 1: Build your artifacts.
#
# ========================================================
- name: Build artifacts
run: |
# These are some amazing artifacts.
Copy link

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'Build artifacts' step contains placeholder/example code. The comments indicate this should be replaced with actual build commands (see line 30 comment 'Step 1: Build your artifacts'). Consider adding a clearer TODO or FIXME comment to make it explicit that this needs customization, or provide more specific guidance on what should replace this section.

Suggested change
# These are some amazing artifacts.
# TODO: Replace the following example commands with your actual build steps.
# These are placeholder artifacts for demonstration purposes.

Copilot uses AI. Check for mistakes.
echo "artifact1" > artifact1
echo "artifact2" > artifact2
# ========================================================
#
# Step 2: Add a step to generate the provenance subjects
# as shown below. Update the sha256 sum arguments
# to include all binaries that you generate
# provenance for.
#
# ========================================================
- name: Generate subject for provenance
id: hash
run: |
set -euo pipefail
# List the artifacts the provenance will refer to.
files=$(ls artifact*)
Copy link

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using ls with a glob pattern can fail if no files match, causing the workflow to fail ungracefully. Consider using a more robust approach like files=$(find . -maxdepth 1 -name 'artifact*' -type f) or add error handling to check if files exist before processing.

Suggested change
files=$(ls artifact*)
files=$(find . -maxdepth 1 -name 'artifact*' -type f)
if [ -z "$files" ]; then
echo "No artifact files found. Exiting." >&2
exit 1
fi

Copilot uses AI. Check for mistakes.
# Generate the subjects (base64 encoded).
echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"
Copy link

Copilot AI Nov 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Variable name mismatch. The output is set to 'hashes' but line 23 declares the job output as 'digests', which is referenced in line 65. Change 'hashes' to 'digests' to match the expected output name.

Suggested change
echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"
echo "digests=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"

Copilot uses AI. Check for mistakes.
provenance:
needs: [build]
permissions:
actions: read # To read the workflow path.
id-token: write # To sign the provenance.
contents: write # To add assets to a release.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0
with:
base64-subjects: "${{ needs.build.outputs.digests }}"
upload-assets: true # Optional: Upload to a new release