Skip to content

Create generator-generic-ossf-slsa3-publish.yml #1640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Kushmanmb wants to merge 2 commits into
base: master
Choose a base branch
from
+66 −0
Open

Create generator-generic-ossf-slsa3-publish.yml #1640

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1e3b3a1
Create generator-generic-ossf-slsa3-publish.yml
Kushmanmb Feb 26, 2026
c640f85
Merge branch 'master' into master
Kushmanmb Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 66 additions & 0 deletions .github/workflows/generator-generic-ossf-slsa3-publish.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow lets you generate SLSA provenance file for your project.
# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements
# The project is an initiative of the OpenSSF (openssf.org) and is developed at
# https://github.com/slsa-framework/slsa-github-generator.
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.

name: SLSA generic generator
on:
workflow_dispatch:
release:
types: [created]
Comment on lines +13 to +17
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow doesn’t set a default permissions: block, so the build job may run with broader GITHUB_TOKEN permissions than necessary (depending on repo/org defaults). Other workflows here scope permissions explicitly (e.g., contents: read). Consider adding a top-level permissions: contents: read and only granting id-token: write / contents: write on the provenance job.

Copilot uses AI. Check for mistakes.

jobs:
build:
runs-on: ubuntu-latest
outputs:
digests: ${{ steps.hash.outputs.digests }}

Comment on lines +22 to +24
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

outputs.digests references ${{ steps.hash.outputs.digests }}, but the hashing step writes hashes=... to $GITHUB_OUTPUT. This mismatch will leave needs.build.outputs.digests empty. Align the output name (either emit digests=... or update the references to use hashes).

Copilot uses AI. Check for mistakes.
steps:
- uses: actions/checkout@v4

# ========================================================
#
# Step 1: Build your artifacts.
#
# ========================================================
- name: Build artifacts
run: |
# These are some amazing artifacts.
echo "artifact1" > artifact1
echo "artifact2" > artifact2
Comment on lines +33 to +37
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Build artifacts step currently creates placeholder files (artifact1/artifact2) instead of building the project’s real artifacts. That means the provenance generated here won’t correspond to the binaries users actually consume. Update the build step (and subsequent hash/glob) to produce and hash the real release outputs (e.g., the bin/gh-ost produced by script/cibuild).

Copilot uses AI. Check for mistakes.
# ========================================================
#
# Step 2: Add a step to generate the provenance subjects
# as shown below. Update the sha256 sum arguments
# to include all binaries that you generate
# provenance for.
#
# ========================================================
- name: Generate subject for provenance
id: hash
run: |
set -euo pipefail
# List the artifacts the provenance will refer to.
files=$(ls artifact*)
# Generate the subjects (base64 encoded).
echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}"
provenance:
needs: [build]
permissions:
actions: read # To read the workflow path.
id-token: write # To sign the provenance.
contents: write # To add assets to a release.
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0
with:
base64-subjects: "${{ needs.build.outputs.digests }}"
upload-assets: true # Optional: Upload to a new release
Comment on lines +64 to +66
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says uploading provenance as release assets is “optional”, but the workflow hard-codes upload-assets: true. If this should be optional, consider making it a workflow_dispatch input (or defaulting to false for manual runs) so maintainers can choose whether to attach assets to the release.

Copilot uses AI. Check for mistakes.
Comment on lines +63 to +66
Copy link

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The provenance job consumes ${{ needs.build.outputs.digests }} via base64-subjects, but the build job currently doesn’t produce that output due to the output name mismatch in the hash step. After fixing the output name, double-check that base64-subjects points at the same value the build job exports.

Copilot uses AI. Check for mistakes.