updates

Signed-off-by: laurentsimon <[email protected]>

.github/workflows/pr-title.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
+permissions: read-all
+
 jobs:
   validate:
     runs-on: ubuntu-latest

verifiers/internal/gha/provenance.go

@@ -285,17 +285,22 @@ func isValidDelegatorBuilderID(prov iface.Provenance) error {
 	return utils.IsValidBuilderTag(parts[1], false)
 }
 
-// BuilderID returns the full builder ID from the provenance.
-func BuilderID(env *dsselib.Envelope, trustedBuilderID *utils.TrustedBuilderID) (string, error){
-	prov, err := slsaprovenance.ProvenanceFromEnvelope(trustedBuilderID.Name(), env)
+// builderID returns the trusted builder ID from the provenance.
+// The certTrustedBuilderID input is from the Fulcio certificate.
+func builderID(env *dsselib.Envelope, certTrustedBuilderID *utils.TrustedBuilderID) (*utils.TrustedBuilderID, error) {
+	prov, err := slsaprovenance.ProvenanceFromEnvelope(certTrustedBuilderID.Name(), env)
 	if err != nil {
-		return "", err
+		return nil, err
 	}
 	id, err := prov.BuilderID()
 	if err != nil {
-		return "", err
+		return nil, err
+	}
+	verifiedBuilderID, err := utils.TrustedBuilderIDNew(id, true)
+	if err != nil {
+		return nil, err
 	}
-	return id, nil
+	return verifiedBuilderID, nil
 }
 
 // VerifyProvenance verifies the provenance for the given DSSE envelope.

verifiers/internal/gha/verifier.go

@@ -41,20 +41,6 @@ func (v *GHAVerifier) IsAuthoritativeFor(builderID string) bool {
 	return strings.HasPrefix(builderID, httpsGithubCom)
 }
 
-// builderID retrieves the builder ID from the provenance via the DSSE envelope.
-func builderID(env *dsse.Envelope, trustedBuilderID *utils.TrustedBuilderID) (*utils.TrustedBuilderID, error) {
-	id, err := BuilderID(env, trustedBuilderID)
-	if err != nil {
-		return nil, err
-	}
-
-	verifiedBuilderID, err := utils.TrustedBuilderIDNew(id, true)
-	if err != nil {
-		return nil, err
-	}
-	return verifiedBuilderID, nil
-}
-
 func verifyEnvAndCert(env *dsse.Envelope,
 	cert *x509.Certificate,
 	provenanceOpts *options.ProvenanceOpts,