From 921bfa1c304f3adc597c69e6d64f3a9ca34080a0 Mon Sep 17 00:00:00 2001 From: asraa Date: Mon, 5 Jun 2023 18:29:00 -0500 Subject: [PATCH] chore: release candidate v1.7.0-rc.0 (#2219) #label:release v1.7.0-rc.0 Signed-off-by: Asra Ali --- .github/actions/generate-builder/action.yml | 2 +- .../secure-download-artifact/action.yml | 2 +- .../actions/secure-download-folder/action.yml | 4 ++-- .../actions/secure-upload-artifact/action.yml | 2 +- .../actions/secure-upload-folder/action.yml | 2 +- .../builder_container-based_slsa3.yml | 14 +++++------ .github/workflows/builder_go_slsa3.yml | 14 +++++------ .github/workflows/builder_gradle_slsa3.yml | 4 ++-- .github/workflows/builder_maven_slsa3.yml | 4 ++-- .github/workflows/builder_nodejs_slsa3.yml | 4 ++-- .github/workflows/delegator_generic_slsa3.yml | 24 +++++++++---------- .../delegator_lowperms-generic_slsa3.yml | 24 +++++++++---------- ...ate-container_based-predicate.schedule.yml | 2 +- .../workflows/e2e.verify-token.schedule.yml | 2 +- .../workflows/generator_container_slsa3.yml | 4 ++-- .github/workflows/generator_generic_slsa3.yml | 6 ++--- .github/workflows/release.yml | 8 +++---- .../secure-attestations-download/action.yml | 2 +- actions/nodejs/publish/action.yml | 6 ++--- .../secure-attestations-download/action.yml | 2 +- 20 files changed, 66 insertions(+), 66 deletions(-) diff --git a/.github/actions/generate-builder/action.yml b/.github/actions/generate-builder/action.yml index 5e8d6a8fce..06cb10b744 100644 --- a/.github/actions/generate-builder/action.yml +++ b/.github/actions/generate-builder/action.yml @@ -62,7 +62,7 @@ runs: using: "composite" steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: ${{ inputs.repository }} ref: ${{ inputs.ref }} diff --git a/.github/actions/secure-download-artifact/action.yml b/.github/actions/secure-download-artifact/action.yml index ebc53e47a6..59b04ad3b9 100644 --- a/.github/actions/secure-download-artifact/action.yml +++ b/.github/actions/secure-download-artifact/action.yml @@ -85,7 +85,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@main + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.7.0-rc.0 with: path: "${{ steps.validate-path.outputs.file_path }}" diff --git a/.github/actions/secure-download-folder/action.yml b/.github/actions/secure-download-folder/action.yml index 9fb5174b14..caf8970b1c 100644 --- a/.github/actions/secure-download-folder/action.yml +++ b/.github/actions/secure-download-folder/action.yml @@ -31,7 +31,7 @@ runs: steps: - name: Compute a random value id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@main + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.7.0-rc.0 - name: Download the artifact uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -41,7 +41,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@main + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.7.0-rc.0 with: path: "${{ steps.rng.outputs.random }}/folder.tgz" diff --git a/.github/actions/secure-upload-artifact/action.yml b/.github/actions/secure-upload-artifact/action.yml index c4d54ad604..99ca6b252c 100644 --- a/.github/actions/secure-upload-artifact/action.yml +++ b/.github/actions/secure-upload-artifact/action.yml @@ -32,7 +32,7 @@ runs: steps: - name: Compute binary hash id: compute-digest - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@main + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.7.0-rc.0 with: path: "${{ inputs.path }}" diff --git a/.github/actions/secure-upload-folder/action.yml b/.github/actions/secure-upload-folder/action.yml index 11294b3be6..a35e7691ea 100644 --- a/.github/actions/secure-upload-folder/action.yml +++ b/.github/actions/secure-upload-folder/action.yml @@ -60,7 +60,7 @@ runs: - name: Upload the artifact id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.7.0-rc.0 with: name: "${{ inputs.name }}" path: "${{ steps.create.outputs.tarball-path }}" diff --git a/.github/workflows/builder_container-based_slsa3.yml b/.github/workflows/builder_container-based_slsa3.yml index 2ff9b04abc..8d296ffd3c 100644 --- a/.github/workflows/builder_container-based_slsa3.yml +++ b/.github/workflows/builder_container-based_slsa3.yml @@ -165,7 +165,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@main + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.7.0-rc.0 # This detects the repository and ref of the reusable workflow. # For pull request, this gets the referenced slsa-github-generator workflow. @@ -180,7 +180,7 @@ jobs: steps: - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.7.0-rc.0 ################################################################### # # @@ -197,7 +197,7 @@ jobs: steps: - name: Generate builder binary id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -230,7 +230,7 @@ jobs: steps: - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -357,7 +357,7 @@ jobs: docker login "${untrusted_registry}" -u "${username}" -p "${password}" - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -485,7 +485,7 @@ jobs: provenance-sha256: ${{ steps.upload-signed.outputs.sha256 }} steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -575,7 +575,7 @@ jobs: if: inputs.upload-assets && (startsWith(github.ref, 'refs/tags/') || inputs.upload-tag-name != '') steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/builder_go_slsa3.yml b/.github/workflows/builder_go_slsa3.yml index 8ed81f4dd1..e51b98760f 100644 --- a/.github/workflows/builder_go_slsa3.yml +++ b/.github/workflows/builder_go_slsa3.yml @@ -130,7 +130,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@main + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.7.0-rc.0 detect-env: outputs: @@ -142,7 +142,7 @@ jobs: steps: - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.7.0-rc.0 ################################################################### # # @@ -157,7 +157,7 @@ jobs: steps: - name: Generate builder binary id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -191,7 +191,7 @@ jobs: needs: [builder, rng, detect-env] steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -238,7 +238,7 @@ jobs: needs: [builder, build-dry, rng, detect-env] steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -320,7 +320,7 @@ jobs: go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -378,7 +378,7 @@ jobs: if: inputs.upload-assets && (startsWith(github.ref, 'refs/tags/') || inputs.upload-tag-name != '') steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/builder_gradle_slsa3.yml b/.github/workflows/builder_gradle_slsa3.yml index 4f7315b5b5..70a5e677ad 100644 --- a/.github/workflows/builder_gradle_slsa3.yml +++ b/.github/workflows/builder_gradle_slsa3.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@main + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.7.0-rc.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -56,7 +56,7 @@ jobs: contents: read # For asset uploads. actions: read # For the entrypoint. packages: write # To publish to GitHub packages. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.7.0-rc.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} diff --git a/.github/workflows/builder_maven_slsa3.yml b/.github/workflows/builder_maven_slsa3.yml index 76deca85dd..db922b828d 100644 --- a/.github/workflows/builder_maven_slsa3.yml +++ b/.github/workflows/builder_maven_slsa3.yml @@ -41,7 +41,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@main + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.7.0-rc.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -56,7 +56,7 @@ jobs: contents: read # For asset uploads. actions: read # For the entrypoint. packages: write # To publish to GitHub packages. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.7.0-rc.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} diff --git a/.github/workflows/builder_nodejs_slsa3.yml b/.github/workflows/builder_nodejs_slsa3.yml index 93cd9c2bbd..1f259a0af7 100644 --- a/.github/workflows/builder_nodejs_slsa3.yml +++ b/.github/workflows/builder_nodejs_slsa3.yml @@ -89,7 +89,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@main + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.7.0-rc.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -104,6 +104,6 @@ jobs: id-token: write # For signing. contents: read # For repo checkout of private repos. actions: read # For getting workflow run on private repos. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.7.0-rc.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} diff --git a/.github/workflows/delegator_generic_slsa3.yml b/.github/workflows/delegator_generic_slsa3.yml index 2abad46abf..2fcb7eabd5 100644 --- a/.github/workflows/delegator_generic_slsa3.yml +++ b/.github/workflows/delegator_generic_slsa3.yml @@ -85,7 +85,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@main + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.7.0-rc.0 # verify-token verifies the slsa token. verify-token: @@ -101,7 +101,7 @@ jobs: steps: - name: Verify token id: verify - uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@main + uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@v1.7.0-rc.0 with: slsa-workflow-recipient: "delegator_generic_slsa3.yml" slsa-unverified-token: ${{ inputs.slsa-token }} @@ -110,7 +110,7 @@ jobs: - name: Upload predicate id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -121,7 +121,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@main + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@v1.7.0-rc.0 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).builder.rekor_log_public }} @@ -148,7 +148,7 @@ jobs: echo "$RUNNER: $RUNNER" - name: Checkout the tool repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: ${{ needs.verify-token.outputs.tool-repository }} ref: ${{ needs.verify-token.outputs.tool-ref }} @@ -172,7 +172,7 @@ jobs: tree - name: Checkout the project repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.7.0-rc.0 with: fetch-depth: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).source.checkout.fetch_depth }} @@ -213,7 +213,7 @@ jobs: - name: Upload artifact layout file id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" @@ -229,14 +229,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Download the artifact layout file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" sha256: ${{ needs.build-artifacts-ubuntu.outputs.artifacts-layout-sha256 }} - name: Download the predicate file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -266,7 +266,7 @@ jobs: - name: Generate attestations id: attestations - uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@main + uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@v1.7.0-rc.0 with: slsa-layout-file: ${{ env.SLSA_ARTIFACTS_FILE }} predicate-type: ${{ steps.predicate-type.outputs.predicate-type }} @@ -275,14 +275,14 @@ jobs: - name: Sign attestations id: sign - uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@main + uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@v1.7.0-rc.0 with: attestations: attestations output-folder: "${{ needs.rng.outputs.value }}-slsa-attestations" - name: Upload attestations id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-slsa-attestations" path: "${{ needs.rng.outputs.value }}-slsa-attestations" diff --git a/.github/workflows/delegator_lowperms-generic_slsa3.yml b/.github/workflows/delegator_lowperms-generic_slsa3.yml index a3678c8bdb..80badb6d2a 100644 --- a/.github/workflows/delegator_lowperms-generic_slsa3.yml +++ b/.github/workflows/delegator_lowperms-generic_slsa3.yml @@ -90,7 +90,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@main + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.7.0-rc.0 # verify-token verifies the slsa token. verify-token: @@ -106,7 +106,7 @@ jobs: steps: - name: Verify token id: verify - uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@main + uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@v1.7.0-rc.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-unverified-token: ${{ inputs.slsa-token }} @@ -115,7 +115,7 @@ jobs: - name: Upload predicate id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -126,7 +126,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@main + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@v1.7.0-rc.0 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).builder.rekor_log_public }} @@ -151,7 +151,7 @@ jobs: echo "$RUNNER: $RUNNER" - name: Checkout the tool repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: ${{ needs.verify-token.outputs.tool-repository }} ref: ${{ needs.verify-token.outputs.tool-ref }} @@ -175,7 +175,7 @@ jobs: tree - name: Checkout the project repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.7.0-rc.0 with: fetch-depth: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).source.checkout.fetch_depth }} @@ -216,7 +216,7 @@ jobs: - name: Upload artifact layout file id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" @@ -232,14 +232,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Download the artifact layout file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" sha256: ${{ needs.build-artifacts-ubuntu.outputs.artifacts-layout-sha256 }} - name: Download the predicate file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -269,7 +269,7 @@ jobs: - name: Generate attestations id: attestations - uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@main + uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@v1.7.0-rc.0 with: slsa-layout-file: ${{ env.SLSA_ARTIFACTS_FILE }} predicate-type: ${{ steps.predicate-type.outputs.predicate-type }} @@ -278,14 +278,14 @@ jobs: - name: Sign attestations id: sign - uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@main + uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@v1.7.0-rc.0 with: attestations: attestations output-folder: "${{ needs.rng.outputs.value }}-slsa-attestations" - name: Upload attestations id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.7.0-rc.0 with: name: "${{ needs.rng.outputs.value }}-slsa-attestations" path: "${{ needs.rng.outputs.value }}-slsa-attestations" diff --git a/.github/workflows/e2e.create-container_based-predicate.schedule.yml b/.github/workflows/e2e.create-container_based-predicate.schedule.yml index 13d3b0bac5..aec4f9219d 100644 --- a/.github/workflows/e2e.create-container_based-predicate.schedule.yml +++ b/.github/workflows/e2e.create-container_based-predicate.schedule.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2 - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.7.0-rc.0 - name: Update the build definition # We use a build definition hard-coded in testadata. To ensure validation against # workflow context, we must update the source references. diff --git a/.github/workflows/e2e.verify-token.schedule.yml b/.github/workflows/e2e.verify-token.schedule.yml index 48c1d0fbfb..c45d2b0326 100644 --- a/.github/workflows/e2e.verify-token.schedule.yml +++ b/.github/workflows/e2e.verify-token.schedule.yml @@ -34,4 +34,4 @@ jobs: issues: write # NOTE: must call @main is required rather than using a "same repo" call so # that the job_workflow_ref is correctly set to the reusable workflow. - uses: slsa-framework/slsa-github-generator/.github/workflows/e2e.verify-token.reusable.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/e2e.verify-token.reusable.yml@v1.7.0-rc.0 diff --git a/.github/workflows/generator_container_slsa3.yml b/.github/workflows/generator_container_slsa3.yml index dad9f5bf6d..b7d01ba4f8 100644 --- a/.github/workflows/generator_container_slsa3.yml +++ b/.github/workflows/generator_container_slsa3.yml @@ -94,7 +94,7 @@ jobs: - name: Detect the generator ref id: detect continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.7.0-rc.0 - name: Final outcome id: final @@ -126,7 +126,7 @@ jobs: - name: Generate builder id: generate-builder continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/generator_generic_slsa3.yml b/.github/workflows/generator_generic_slsa3.yml index ea0f774242..fd203a7c07 100644 --- a/.github/workflows/generator_generic_slsa3.yml +++ b/.github/workflows/generator_generic_slsa3.yml @@ -121,7 +121,7 @@ jobs: - name: Detect the generator ref id: detect continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.7.0-rc.0 - name: Final outcome id: final @@ -155,7 +155,7 @@ jobs: - name: Generate builder id: generate-builder continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -230,7 +230,7 @@ jobs: - name: Checkout builder repository id: checkout-builder continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.7.0-rc.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 77c0faf2df..cf3046eff7 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -60,7 +60,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.7.0-rc.0 with: go-version: "1.20" config-file: .github/workflows/configs-container/config-release.yml @@ -73,7 +73,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.7.0-rc.0 with: go-version: "1.20" config-file: .github/workflows/configs-generic/config-release.yml @@ -86,7 +86,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.7.0-rc.0 with: go-version: "1.20" config-file: .github/workflows/configs-go/config-release.yml @@ -99,7 +99,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@main + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.7.0-rc.0 with: go-version: "1.20" config-file: .github/workflows/configs-docker/config-release.yml diff --git a/actions/delegator/secure-attestations-download/action.yml b/actions/delegator/secure-attestations-download/action.yml index bc0ba8e63d..b5b7a6c873 100644 --- a/actions/delegator/secure-attestations-download/action.yml +++ b/actions/delegator/secure-attestations-download/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Download the attestations - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.7.0-rc.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/nodejs/publish/action.yml b/actions/nodejs/publish/action.yml index cf9a663fff..7738222c46 100644 --- a/actions/nodejs/publish/action.yml +++ b/actions/nodejs/publish/action.yml @@ -50,7 +50,7 @@ runs: # TODO(#1897): Use upstream version of npm - name: Setup npm id: setup-npm - uses: slsa-framework/slsa-github-generator/actions/nodejs/setup-npm@main + uses: slsa-framework/slsa-github-generator/actions/nodejs/setup-npm@v1.7.0-rc.0 - name: Create temp dir id: temp-dir @@ -62,14 +62,14 @@ runs: echo "path=${temp_dir}" >>"${GITHUB_OUTPUT}" - name: Download tarball - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.7.0-rc.0 with: name: ${{ inputs.package-download-name }} path: "${{ steps.temp-dir.outputs.path }}/${{ inputs.package-name }}" sha256: ${{ inputs.package-download-sha256 }} - name: Download provenance - uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@main + uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.7.0-rc.0 with: name: ${{ inputs.provenance-download-name }} path: "${{ steps.temp-dir.outputs.path }}" diff --git a/actions/nodejs/secure-attestations-download/action.yml b/actions/nodejs/secure-attestations-download/action.yml index eeaa067c81..9dcf85f6ce 100644 --- a/actions/nodejs/secure-attestations-download/action.yml +++ b/actions/nodejs/secure-attestations-download/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Download the attestations - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@main + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.7.0-rc.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }}