From c747fe7769adf3656dc7d588b161cb614d7abfee Mon Sep 17 00:00:00 2001 From: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Date: Thu, 21 Mar 2024 03:01:39 -0700 Subject: [PATCH] chore: Update ref for v1.10.0 release (#3420) #label:release v1.10.0 --------- Signed-off-by: laurentsimon --- .github/actions/generate-builder/action.yml | 2 +- .../secure-download-artifact/action.yml | 2 +- .../actions/secure-download-folder/action.yml | 4 +- .../actions/secure-upload-artifact/action.yml | 2 +- .../actions/secure-upload-folder/action.yml | 2 +- .github/workflows/builder_bazel_slsa3.yml | 4 +- .../builder_container-based_slsa3.yml | 14 ++--- .github/workflows/builder_go_slsa3.yml | 14 ++--- .github/workflows/builder_gradle_slsa3.yml | 4 +- .github/workflows/builder_maven_slsa3.yml | 4 +- .github/workflows/builder_nodejs_slsa3.yml | 4 +- .github/workflows/delegator_generic_slsa3.yml | 24 ++++----- .../delegator_lowperms-generic_slsa3.yml | 24 ++++----- ...ate-container_based-predicate.schedule.yml | 2 +- .../workflows/generator_container_slsa3.yml | 4 +- .github/workflows/generator_generic_slsa3.yml | 8 +-- .github/workflows/release.yml | 8 +-- BYOB.md | 8 +-- actions/delegator/random/action.yml | 2 +- .../secure-attestations-download/action.yml | 2 +- .../secure-download-folder/action.yml | 2 +- .../delegator/secure-upload-folder/action.yml | 2 +- .../action.yml | 4 +- actions/gradle/publish/README.md | 4 +- actions/gradle/publish/action.yml | 4 +- .../secure-download-attestations/action.yml | 2 +- .../gradle/secure-download-target/action.yml | 2 +- actions/maven/publish/README.md | 4 +- actions/maven/publish/action.yml | 10 ++-- .../secure-download-attestations/action.yml | 2 +- .../maven/secure-download-target/action.yml | 2 +- actions/nodejs/publish/README.md | 4 +- actions/nodejs/publish/action.yml | 4 +- .../secure-attestations-download/README.md | 4 +- .../secure-attestations-download/action.yml | 2 +- .../nodejs/secure-package-download/README.md | 4 +- .../nodejs/secure-package-download/action.yml | 2 +- internal/builders/bazel/README.md | 6 +-- internal/builders/bazel/action.yml | 4 +- internal/builders/container/README.md | 8 +-- internal/builders/docker/README.md | 2 +- internal/builders/generic/README.md | 54 +++++++++---------- internal/builders/go/README.md | 6 +-- internal/builders/gradle/README.md | 2 +- internal/builders/gradle/action.yml | 4 +- internal/builders/maven/README.md | 2 +- internal/builders/maven/action.yml | 8 +-- internal/builders/nodejs/README.md | 8 +-- internal/builders/nodejs/action.yml | 4 +- 49 files changed, 152 insertions(+), 152 deletions(-) diff --git a/.github/actions/generate-builder/action.yml b/.github/actions/generate-builder/action.yml index bfeaab79da..066d7c64a2 100644 --- a/.github/actions/generate-builder/action.yml +++ b/.github/actions/generate-builder/action.yml @@ -62,7 +62,7 @@ runs: using: "composite" steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: ${{ inputs.repository }} ref: ${{ inputs.ref }} diff --git a/.github/actions/secure-download-artifact/action.yml b/.github/actions/secure-download-artifact/action.yml index 6eeae3f4be..4dacf15821 100644 --- a/.github/actions/secure-download-artifact/action.yml +++ b/.github/actions/secure-download-artifact/action.yml @@ -85,7 +85,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.10.0 with: path: "${{ steps.validate-path.outputs.file_path }}" diff --git a/.github/actions/secure-download-folder/action.yml b/.github/actions/secure-download-folder/action.yml index af5e4c9e7f..4dce15b592 100644 --- a/.github/actions/secure-download-folder/action.yml +++ b/.github/actions/secure-download-folder/action.yml @@ -31,7 +31,7 @@ runs: steps: - name: Compute a random value id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 - name: Download the artifact uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 @@ -41,7 +41,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.10.0 with: path: "${{ steps.rng.outputs.random }}/folder.tgz" diff --git a/.github/actions/secure-upload-artifact/action.yml b/.github/actions/secure-upload-artifact/action.yml index b306e17430..c367454bb4 100644 --- a/.github/actions/secure-upload-artifact/action.yml +++ b/.github/actions/secure-upload-artifact/action.yml @@ -32,7 +32,7 @@ runs: steps: - name: Compute binary hash id: compute-digest - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v1.10.0 with: path: "${{ inputs.path }}" diff --git a/.github/actions/secure-upload-folder/action.yml b/.github/actions/secure-upload-folder/action.yml index ae3adaaab4..c5a0a25d58 100644 --- a/.github/actions/secure-upload-folder/action.yml +++ b/.github/actions/secure-upload-folder/action.yml @@ -60,7 +60,7 @@ runs: - name: Upload the artifact id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 with: name: "${{ inputs.name }}" path: "${{ steps.create.outputs.tarball-path }}" diff --git a/.github/workflows/builder_bazel_slsa3.yml b/.github/workflows/builder_bazel_slsa3.yml index 1fd080d074..24a6de6f97 100644 --- a/.github/workflows/builder_bazel_slsa3.yml +++ b/.github/workflows/builder_bazel_slsa3.yml @@ -86,7 +86,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -100,6 +100,6 @@ jobs: id-token: write # For signing. contents: read # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} diff --git a/.github/workflows/builder_container-based_slsa3.yml b/.github/workflows/builder_container-based_slsa3.yml index 3e71ca1d59..0cd38f11a7 100644 --- a/.github/workflows/builder_container-based_slsa3.yml +++ b/.github/workflows/builder_container-based_slsa3.yml @@ -165,7 +165,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 # This detects the repository and ref of the reusable workflow. # For pull request, this gets the referenced slsa-github-generator workflow. @@ -180,7 +180,7 @@ jobs: steps: - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0 ################################################################### # # @@ -197,7 +197,7 @@ jobs: steps: - name: Generate builder binary id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -230,7 +230,7 @@ jobs: steps: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -357,7 +357,7 @@ jobs: docker login "${untrusted_registry}" -u "${username}" -p "${password}" - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -485,7 +485,7 @@ jobs: provenance-sha256: ${{ steps.upload-signed.outputs.sha256 }} steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -575,7 +575,7 @@ jobs: if: inputs.upload-assets && (startsWith(github.ref, 'refs/tags/') || inputs.upload-tag-name != '') steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/builder_go_slsa3.yml b/.github/workflows/builder_go_slsa3.yml index 87c0183b7a..bb5248e353 100644 --- a/.github/workflows/builder_go_slsa3.yml +++ b/.github/workflows/builder_go_slsa3.yml @@ -130,7 +130,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 detect-env: outputs: @@ -142,7 +142,7 @@ jobs: steps: - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0 ################################################################### # # @@ -157,7 +157,7 @@ jobs: steps: - name: Generate builder binary id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -191,7 +191,7 @@ jobs: needs: [builder, rng, detect-env] steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -238,7 +238,7 @@ jobs: needs: [builder, build-dry, rng, detect-env] steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -320,7 +320,7 @@ jobs: go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -378,7 +378,7 @@ jobs: if: inputs.upload-assets && (startsWith(github.ref, 'refs/tags/') || inputs.upload-tag-name != '') steps: - name: Checkout builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/builder_gradle_slsa3.yml b/.github/workflows/builder_gradle_slsa3.yml index 9746d39242..f279d1d277 100644 --- a/.github/workflows/builder_gradle_slsa3.yml +++ b/.github/workflows/builder_gradle_slsa3.yml @@ -71,7 +71,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -85,7 +85,7 @@ jobs: id-token: write # For signing. contents: read # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} diff --git a/.github/workflows/builder_maven_slsa3.yml b/.github/workflows/builder_maven_slsa3.yml index 58a217526a..2fe62cd581 100644 --- a/.github/workflows/builder_maven_slsa3.yml +++ b/.github/workflows/builder_maven_slsa3.yml @@ -67,7 +67,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: "${{ inputs.rekor-log-public }}" @@ -81,7 +81,7 @@ jobs: id-token: write # For signing. contents: read # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0 with: slsa-token: "${{ needs.slsa-setup.outputs.slsa-token }}" diff --git a/.github/workflows/builder_nodejs_slsa3.yml b/.github/workflows/builder_nodejs_slsa3.yml index ad8fb8bc12..7384657bca 100644 --- a/.github/workflows/builder_nodejs_slsa3.yml +++ b/.github/workflows/builder_nodejs_slsa3.yml @@ -89,7 +89,7 @@ jobs: steps: - name: Generate the token id: generate - uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -104,6 +104,6 @@ jobs: id-token: write # For signing. contents: read # For repo checkout of private repos. actions: read # For getting workflow run on private repos. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_lowperms-generic_slsa3.yml@v1.10.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} diff --git a/.github/workflows/delegator_generic_slsa3.yml b/.github/workflows/delegator_generic_slsa3.yml index a199b8e4e1..be7553a1d1 100644 --- a/.github/workflows/delegator_generic_slsa3.yml +++ b/.github/workflows/delegator_generic_slsa3.yml @@ -84,7 +84,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 # verify-token verifies the slsa token. verify-token: @@ -100,7 +100,7 @@ jobs: steps: - name: Verify token id: verify - uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@v1.10.0 with: slsa-workflow-recipient: "delegator_generic_slsa3.yml" slsa-unverified-token: ${{ inputs.slsa-token }} @@ -109,7 +109,7 @@ jobs: - name: Upload predicate id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -120,7 +120,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@v1.10.0 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).builder.rekor_log_public }} @@ -147,7 +147,7 @@ jobs: echo "$RUNNER: $RUNNER" - name: Checkout the tool repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: ${{ needs.verify-token.outputs.tool-repository }} ref: ${{ needs.verify-token.outputs.tool-ref }} @@ -171,7 +171,7 @@ jobs: tree - name: Checkout the project repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.10.0 with: fetch-depth: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).source.checkout.fetch_depth }} checkout-sha1: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).source.checkout.sha1 }} @@ -213,7 +213,7 @@ jobs: - name: Upload artifact layout file id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" @@ -229,14 +229,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Download the artifact layout file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" sha256: ${{ needs.build-artifacts-ubuntu.outputs.artifacts-layout-sha256 }} - name: Download the predicate file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -266,7 +266,7 @@ jobs: - name: Generate attestations id: attestations - uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@v1.10.0 with: slsa-layout-file: ${{ env.SLSA_ARTIFACTS_FILE }} predicate-type: ${{ steps.predicate-type.outputs.predicate-type }} @@ -275,14 +275,14 @@ jobs: - name: Sign attestations id: sign - uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@v1.10.0 with: attestations: attestations output-folder: "${{ needs.rng.outputs.value }}-slsa-attestations" - name: Upload attestations id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-slsa-attestations" path: "${{ needs.rng.outputs.value }}-slsa-attestations" diff --git a/.github/workflows/delegator_lowperms-generic_slsa3.yml b/.github/workflows/delegator_lowperms-generic_slsa3.yml index 881378b5a0..394d5c39d6 100644 --- a/.github/workflows/delegator_lowperms-generic_slsa3.yml +++ b/.github/workflows/delegator_lowperms-generic_slsa3.yml @@ -89,7 +89,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 # verify-token verifies the slsa token. verify-token: @@ -105,7 +105,7 @@ jobs: steps: - name: Verify token id: verify - uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/verify-token@v1.10.0 with: slsa-workflow-recipient: "delegator_lowperms-generic_slsa3.yml" slsa-unverified-token: ${{ inputs.slsa-token }} @@ -114,7 +114,7 @@ jobs: - name: Upload predicate id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -125,7 +125,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Check private repos - uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@v1.10.0 with: error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override." override: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).builder.rekor_log_public }} @@ -150,7 +150,7 @@ jobs: echo "$RUNNER: $RUNNER" - name: Checkout the tool repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: ${{ needs.verify-token.outputs.tool-repository }} ref: ${{ needs.verify-token.outputs.tool-ref }} @@ -174,7 +174,7 @@ jobs: tree - name: Checkout the project repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.10.0 with: fetch-depth: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).source.checkout.fetch_depth }} checkout-sha1: ${{ fromJson(needs.verify-token.outputs.slsa-verified-token).source.checkout.sha1 }} @@ -216,7 +216,7 @@ jobs: - name: Upload artifact layout file id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" @@ -232,14 +232,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Download the artifact layout file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_ARTIFACTS_FILE }}" path: "${{ env.SLSA_ARTIFACTS_FILE }}" sha256: ${{ needs.build-artifacts-ubuntu.outputs.artifacts-layout-sha256 }} - name: Download the predicate file - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-${{ env.SLSA_PREDICATE_FILE }}" path: ${{ env.SLSA_PREDICATE_FILE }} @@ -269,7 +269,7 @@ jobs: - name: Generate attestations id: attestations - uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-attestations@v1.10.0 with: slsa-layout-file: ${{ env.SLSA_ARTIFACTS_FILE }} predicate-type: ${{ steps.predicate-type.outputs.predicate-type }} @@ -278,14 +278,14 @@ jobs: - name: Sign attestations id: sign - uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/sign-attestations@v1.10.0 with: attestations: attestations output-folder: "${{ needs.rng.outputs.value }}-slsa-attestations" - name: Upload attestations id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0 with: name: "${{ needs.rng.outputs.value }}-slsa-attestations" path: "${{ needs.rng.outputs.value }}-slsa-attestations" diff --git a/.github/workflows/e2e.create-container_based-predicate.schedule.yml b/.github/workflows/e2e.create-container_based-predicate.schedule.yml index 18371eb5d9..5622659a72 100644 --- a/.github/workflows/e2e.create-container_based-predicate.schedule.yml +++ b/.github/workflows/e2e.create-container_based-predicate.schedule.yml @@ -42,7 +42,7 @@ jobs: - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 - name: Detect the builder ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0 - name: Update the build definition # We use a build definition hard-coded in testadata. To ensure validation against # workflow context, we must update the source references. diff --git a/.github/workflows/generator_container_slsa3.yml b/.github/workflows/generator_container_slsa3.yml index 09211092f5..6af03b6bf3 100644 --- a/.github/workflows/generator_container_slsa3.yml +++ b/.github/workflows/generator_container_slsa3.yml @@ -112,7 +112,7 @@ jobs: - name: Detect the generator ref id: detect continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0 - name: Final outcome id: final @@ -144,7 +144,7 @@ jobs: - name: Generate builder id: generate-builder continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/generator_generic_slsa3.yml b/.github/workflows/generator_generic_slsa3.yml index 9203c1e227..09b0200b41 100644 --- a/.github/workflows/generator_generic_slsa3.yml +++ b/.github/workflows/generator_generic_slsa3.yml @@ -128,7 +128,7 @@ jobs: - name: Detect the generator ref id: detect continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v1.10.0 - name: Final outcome id: final @@ -163,7 +163,7 @@ jobs: - name: Generate builder id: generate-builder continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -196,7 +196,7 @@ jobs: id: download-file continue-on-error: true if: inputs.base64-subjects-as-file != '' - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: "${{ steps.metadata.outputs.artifact_name }}" path: "${{ steps.metadata.outputs.filename }}" @@ -281,7 +281,7 @@ jobs: - name: Checkout builder repository id: checkout-builder continue-on-error: true - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 19e7ef3d97..518cbae389 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -62,7 +62,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 with: go-version: "1.21" config-file: .github/workflows/configs-container/config-release.yml @@ -75,7 +75,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 with: go-version: "1.21" config-file: .github/workflows/configs-generic/config-release.yml @@ -88,7 +88,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 with: go-version: "1.21" config-file: .github/workflows/configs-go/config-release.yml @@ -101,7 +101,7 @@ jobs: id-token: write # For signing. contents: write # For asset uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 with: go-version: "1.21" config-file: .github/workflows/configs-docker/config-release.yml diff --git a/BYOB.md b/BYOB.md index 6a8769730e..a6a0fb73a1 100644 --- a/BYOB.md +++ b/BYOB.md @@ -80,7 +80,7 @@ The [slsa-github-generator](https://github.com/slsa-framework/slsa-github-genera The [setup-generic](https://github.com/slsa-framework/slsa-github-generator/blob/main/actions/delegator/setup-generic) Action is used to initialize the BYOB framework. It returns a so-called "SLSA token" which is used in later steps: ```yaml -- uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.9.0 +- uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0 ``` #### SLSA Reusable Workflow (SRW) @@ -88,7 +88,7 @@ The [setup-generic](https://github.com/slsa-framework/slsa-github-generator/blob The SLSA Reuseable Workflow (SRW) acts as the build's orchestrator. It calls the TCA, generates provenance, and returns the provenance to its TRW caller. A TRW would typically call the SRW as follows: ```yaml -- uses: slsa-framework/slsa-github-generator/.github/workflow/delegator_generic_slsa3.yml@v1.9.0 +- uses: slsa-framework/slsa-github-generator/.github/workflow/delegator_generic_slsa3.yml@v1.10.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} ``` @@ -159,7 +159,7 @@ One key difference between the Action and reusable workflow is isolation. The SR Our next step is to initialize the SRW framework. To do this, the TRW must invoke the [setup-generic Action](https://github.com/slsa-framework/slsa-github-generator/blob/main/actions/delegator/setup-generic/action.yml). The [relevant code](https://github.com/laurentsimon/byob-doc/blob/v0.0.1/.github/workflows/builder_example_slsa3.yml#L85-L94) calls the SSA as follows: ```yaml -uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.9.0 +uses: slsa-framework/slsa-github-generator/actions/delegator/setup-generic@v1.10.0 with: slsa-workflow-recipient: "delegator_generic_slsa3.yml" slsa-rekor-log-public: ${{ inputs.rekor-log-public }} @@ -190,7 +190,7 @@ slsa-run: contents: write # For asset uploads. packages: write # For package uploads. actions: read # For the entrypoint. - uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/delegator_generic_slsa3.yml@v1.10.0 with: slsa-token: ${{ needs.slsa-setup.outputs.slsa-token }} secrets: diff --git a/actions/delegator/random/action.yml b/actions/delegator/random/action.yml index 482e22d278..aed6b5a9e3 100644 --- a/actions/delegator/random/action.yml +++ b/actions/delegator/random/action.yml @@ -31,4 +31,4 @@ runs: steps: - name: Generate random value id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 diff --git a/actions/delegator/secure-attestations-download/action.yml b/actions/delegator/secure-attestations-download/action.yml index 0a3534ed1a..15683dc45c 100644 --- a/actions/delegator/secure-attestations-download/action.yml +++ b/actions/delegator/secure-attestations-download/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Download the attestations - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/delegator/secure-download-folder/action.yml b/actions/delegator/secure-download-folder/action.yml index 6bcb7b5e1c..c3ab84f584 100644 --- a/actions/delegator/secure-download-folder/action.yml +++ b/actions/delegator/secure-download-folder/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Download the folder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/delegator/secure-upload-folder/action.yml b/actions/delegator/secure-upload-folder/action.yml index 22d954fdb4..2ce80aad23 100644 --- a/actions/delegator/secure-upload-folder/action.yml +++ b/actions/delegator/secure-upload-folder/action.yml @@ -34,7 +34,7 @@ runs: steps: - name: Upload the folder id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/generator/generic/create-base64-subjects-from-file/action.yml b/actions/generator/generic/create-base64-subjects-from-file/action.yml index e4dd90fc56..48106674f6 100644 --- a/actions/generator/generic/create-base64-subjects-from-file/action.yml +++ b/actions/generator/generic/create-base64-subjects-from-file/action.yml @@ -28,7 +28,7 @@ runs: steps: - name: Generate random value id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 - name: Generate random name id: name @@ -49,7 +49,7 @@ runs: - name: Upload file id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 with: name: "${{ steps.name.outputs.artifact_name }}" path: "${{ inputs.path }}" diff --git a/actions/gradle/publish/README.md b/actions/gradle/publish/README.md index 7afc9c6b7d..ca692afa72 100644 --- a/actions/gradle/publish/README.md +++ b/actions/gradle/publish/README.md @@ -237,7 +237,7 @@ jobs: contents: read actions: read packages: read - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.10.0 with: rekor-log-public: true artifact-list: build/libs/artifact1-0.1.18.jar,build/libs/artifact-0.1.18-javadoc.jar,build/libs/artifact-0.1.18-sources.jar @@ -256,7 +256,7 @@ publish: steps: - name: publish id: publish - uses: slsa-framework/slsa-github-generator/actions/gradle/publish@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/gradle/publish@v1.10.0 with: provenance-download-name: "${{ needs.build.outputs.provenance-download-name }}" provenance-download-sha256: "${{ needs.build.outputs.provenance-download-sha256 }}" diff --git a/actions/gradle/publish/action.yml b/actions/gradle/publish/action.yml index ca6941ae09..84d94c5875 100644 --- a/actions/gradle/publish/action.yml +++ b/actions/gradle/publish/action.yml @@ -66,14 +66,14 @@ runs: gpg-private-key: ${{ inputs.gpg-private-key }} gpg-passphrase: GPG_KEY_PASS - name: Download the slsa attestation - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: "${{ inputs.provenance-download-name }}" path: ./ sha256: "${{ inputs.provenance-download-sha256 }}" - name: Download the build dir - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: "${{ inputs.build-download-name }}" path: ./ diff --git a/actions/gradle/secure-download-attestations/action.yml b/actions/gradle/secure-download-attestations/action.yml index d61ab305be..8cf9978200 100644 --- a/actions/gradle/secure-download-attestations/action.yml +++ b/actions/gradle/secure-download-attestations/action.yml @@ -29,7 +29,7 @@ runs: using: "composite" steps: - name: Download the attestation directory - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/gradle/secure-download-target/action.yml b/actions/gradle/secure-download-target/action.yml index 8b55eaef90..605c8e87c8 100644 --- a/actions/gradle/secure-download-target/action.yml +++ b/actions/gradle/secure-download-target/action.yml @@ -29,7 +29,7 @@ runs: using: "composite" steps: - name: Download the target directory - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/maven/publish/README.md b/actions/maven/publish/README.md index 4b254ce4b2..5672c8baf9 100644 --- a/actions/maven/publish/README.md +++ b/actions/maven/publish/README.md @@ -27,7 +27,7 @@ jobs: id-token: write contents: read actions: read - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@v1.10.0 with: rekor-log-public: true ``` @@ -45,7 +45,7 @@ publish: steps: - name: publish id: publish - uses: slsa-framework/slsa-github-generator/actions/maven/publish@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/maven/publish@v1.10.0 with: provenance-download-name: "${{ needs.build.outputs.provenance-download-name }}" provenance-download-sha256: "${{ needs.build.outputs.provenance-download-sha256 }}" diff --git a/actions/maven/publish/action.yml b/actions/maven/publish/action.yml index b5ad51a2dd..53d1e31288 100644 --- a/actions/maven/publish/action.yml +++ b/actions/maven/publish/action.yml @@ -45,7 +45,7 @@ runs: using: "composite" steps: - name: Checkout the project repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.10.0-rc.0 # needed because we run javadoc and sources. + uses: slsa-framework/slsa-github-generator/.github/actions/secure-project-checkout@v1.10.0 # needed because we run javadoc and sources. - name: Set up Java for publishing to Maven Central Repository uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0 env: @@ -62,24 +62,24 @@ runs: gpg-passphrase: GPG_KEY_PASS - name: Download the slsa attestation - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: "${{ inputs.provenance-download-name }}" path: slsa-attestations sha256: "${{ inputs.provenance-download-sha256 }}" - name: Download the target dir - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: "${{ inputs.target-download-name }}" path: ./ sha256: "${{ inputs.target-download-sha256 }}" - name: Checkout the framework repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: slsa-framework/slsa-github-generator - ref: v1.10.0-rc.0 + ref: v1.10.0 path: __BUILDER_CHECKOUT_DIR__ - name: Publish to the Maven Central Repository diff --git a/actions/maven/secure-download-attestations/action.yml b/actions/maven/secure-download-attestations/action.yml index d61ab305be..8cf9978200 100644 --- a/actions/maven/secure-download-attestations/action.yml +++ b/actions/maven/secure-download-attestations/action.yml @@ -29,7 +29,7 @@ runs: using: "composite" steps: - name: Download the attestation directory - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/maven/secure-download-target/action.yml b/actions/maven/secure-download-target/action.yml index 8b55eaef90..605c8e87c8 100644 --- a/actions/maven/secure-download-target/action.yml +++ b/actions/maven/secure-download-target/action.yml @@ -29,7 +29,7 @@ runs: using: "composite" steps: - name: Download the target directory - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/nodejs/publish/README.md b/actions/nodejs/publish/README.md index 253b755a5e..e1bfd56808 100644 --- a/actions/nodejs/publish/README.md +++ b/actions/nodejs/publish/README.md @@ -18,7 +18,7 @@ jobs: contents: read actions: read if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.10.0 with: run-scripts: "ci, build" @@ -34,7 +34,7 @@ jobs: - name: publish id: publish - uses: slsa-framework/slsa-github-generator/actions/nodejs/publish@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/publish@v1.10.0 with: access: public node-auth-token: ${{ secrets.NPM_TOKEN }} diff --git a/actions/nodejs/publish/action.yml b/actions/nodejs/publish/action.yml index a6d7e6297c..fd30b63c34 100644 --- a/actions/nodejs/publish/action.yml +++ b/actions/nodejs/publish/action.yml @@ -56,14 +56,14 @@ runs: echo "path=${temp_dir}" >>"${GITHUB_OUTPUT}" - name: Download tarball - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: ${{ inputs.package-download-name }} path: "${{ steps.temp-dir.outputs.path }}/${{ inputs.package-name }}" sha256: ${{ inputs.package-download-sha256 }} - name: Download provenance - uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.10.0 with: name: ${{ inputs.provenance-download-name }} path: "${{ steps.temp-dir.outputs.path }}" diff --git a/actions/nodejs/secure-attestations-download/README.md b/actions/nodejs/secure-attestations-download/README.md index 07129564fd..7725f60682 100644 --- a/actions/nodejs/secure-attestations-download/README.md +++ b/actions/nodejs/secure-attestations-download/README.md @@ -15,7 +15,7 @@ jobs: contents: read actions: read if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.10.0 with: run-scripts: "ci, build" @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download provenance - uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.10.0 with: name: ${{ needs.build.outputs.provenance-download-name }} path: "attestations" diff --git a/actions/nodejs/secure-attestations-download/action.yml b/actions/nodejs/secure-attestations-download/action.yml index e5a6a20c6a..f98372a5c1 100644 --- a/actions/nodejs/secure-attestations-download/action.yml +++ b/actions/nodejs/secure-attestations-download/action.yml @@ -30,7 +30,7 @@ runs: using: "composite" steps: - name: Download the attestations - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-folder@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/actions/nodejs/secure-package-download/README.md b/actions/nodejs/secure-package-download/README.md index 2eacf99f6e..39e628ca3d 100644 --- a/actions/nodejs/secure-package-download/README.md +++ b/actions/nodejs/secure-package-download/README.md @@ -15,7 +15,7 @@ jobs: contents: read actions: read if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.10.0 with: run-scripts: "ci, build" @@ -24,7 +24,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download tarball - uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-package-download@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-package-download@v1.10.0 with: name: ${{ needs.build.outputs.package-download-name }} path: ${{ needs.build.outputs.package-name }} diff --git a/actions/nodejs/secure-package-download/action.yml b/actions/nodejs/secure-package-download/action.yml index 2144a09ec2..c7261b3a56 100644 --- a/actions/nodejs/secure-package-download/action.yml +++ b/actions/nodejs/secure-package-download/action.yml @@ -29,7 +29,7 @@ runs: using: "composite" steps: - name: Download the package - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@v1.10.0 with: name: ${{ inputs.name }} path: ${{ inputs.path }} diff --git a/internal/builders/bazel/README.md b/internal/builders/bazel/README.md index 3cbafcc2e1..3f8cb39da6 100644 --- a/internal/builders/bazel/README.md +++ b/internal/builders/bazel/README.md @@ -87,7 +87,7 @@ jobs: contents: read # For repo checkout. actions: read # For getting workflow run info. if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_bazel_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_bazel_slsa3.yml@v1.10.0 with: targets: "//src:fib //src:hello" flags: "--strip=always" @@ -113,7 +113,7 @@ jobs: contents: read # For repo checkout. actions: read # For getting workflow run info. if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_bazel_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_bazel_slsa3.yml@v1.10.0 with: targets: "//src:fib //src:hello" flags: "--strip=always" @@ -137,7 +137,7 @@ jobs: contents: read # For repo checkout. actions: read # For getting workflow run info. if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_bazel_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_bazel_slsa3.yml@v1.10.0 with: targets: "//src:fib //src:hello" flags: "--strip=always" diff --git a/internal/builders/bazel/action.yml b/internal/builders/bazel/action.yml index f1c28c9be3..5b541963e8 100644 --- a/internal/builders/bazel/action.yml +++ b/internal/builders/bazel/action.yml @@ -71,11 +71,11 @@ runs: # when multiple workflows run concurrently. - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 - name: Generate Artifacts id: generate-artifacts - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0 with: name: "${{ steps.rng.outputs.random }}-binaries" path: "./bazel_builder_binaries_to_upload_to_gh_7bc972367cb286b7f36ab4457f06e369" # path-to-artifact(s) diff --git a/internal/builders/container/README.md b/internal/builders/container/README.md index be173bc3ba..ff3bd58080 100644 --- a/internal/builders/container/README.md +++ b/internal/builders/container/README.md @@ -73,7 +73,7 @@ provenance: id-token: write # for creating OIDC tokens for signing. packages: write # for uploading attestations. if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0 with: image: ${{ needs.build.outputs.image }} digest: ${{ needs.build.outputs.digest }} @@ -144,7 +144,7 @@ jobs: id-token: write # for creating OIDC tokens for signing. packages: write # for uploading attestations. if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0 with: image: ${{ needs.build.outputs.image }} digest: ${{ needs.build.outputs.digest }} @@ -373,7 +373,7 @@ This section explains how to generate non-forgeable SLSA provenance with existin # contents: read packages: write if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0 with: image: ${{ needs.build.outputs.image }} digest: ${{ needs.build.outputs.digest }} @@ -438,7 +438,7 @@ This section explains how to generate non-forgeable SLSA provenance with existin # contents: read packages: write if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.10.0 with: image: ${{ needs.build.outputs.image }} digest: ${{ needs.build.outputs.digest }} diff --git a/internal/builders/docker/README.md b/internal/builders/docker/README.md index 51ecbfc878..b84956ad43 100644 --- a/internal/builders/docker/README.md +++ b/internal/builders/docker/README.md @@ -204,7 +204,7 @@ jobs: contents: write # To upload assets to release. actions: read # To read the workflow path. needs: args - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_container-based_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_container-based_slsa3.yml@v1.10.0 with: builder-image: "bash" builder-digest: "sha256:9e2ba52487d945504d250de186cb4fe2e3ba023ed2921dd6ac8b97ed43e76af9" diff --git a/internal/builders/generic/README.md b/internal/builders/generic/README.md index 1e809fff43..6724a972d0 100644 --- a/internal/builders/generic/README.md +++ b/internal/builders/generic/README.md @@ -96,7 +96,7 @@ provenance: actions: read # Needed for detection of GitHub Actions environment. id-token: write # Needed for provenance signing and ID contents: write # Needed for release uploads - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" ``` @@ -114,7 +114,7 @@ build: outputs: subjects-as-file: ${{ steps.hashes.outputs.handle }} ... - uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file@v1.10.0 id: hashes with: path: large_digests_file.text @@ -123,7 +123,7 @@ provenance: actions: read # Needed for detection of GitHub Actions environment. id-token: write # Needed for provenance signing and ID contents: write # Needed for release uploads - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects-as-file: "${{ needs.build.outputs.subjects-as-file }}" ``` @@ -180,7 +180,7 @@ jobs: actions: read id-token: write contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" # Upload provenance to a new release @@ -422,7 +422,7 @@ generate SLSA3 provenance by updating your existing workflow with the steps indi actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.goreleaser.outputs.hashes }}" upload-assets: true # upload to a new release @@ -464,7 +464,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.goreleaser.outputs.hashes }}" upload-assets: true # upload to a new release @@ -526,7 +526,7 @@ generate SLSA3 provenance by updating your existing workflow with the steps indi actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: ${{ needs.release.outputs.hashes }} upload-assets: true # upload to a new release @@ -574,7 +574,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: ${{ needs.release.outputs.hashes }} upload-assets: true # upload to a new release @@ -631,7 +631,7 @@ If you use [Bazel](https://bazel.build/) to generate your artifacts, you can eas actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -673,7 +673,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -731,7 +731,7 @@ steps indicated in the workflow below: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -778,7 +778,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -827,7 +827,7 @@ jobs: actions: read id-token: write contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -870,7 +870,7 @@ Jobs: actions: read id-token: write contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -921,7 +921,7 @@ steps indicated in the workflow below: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -960,7 +960,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1017,7 +1017,7 @@ workflow with the steps indicated in the workflow below. actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1062,7 +1062,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1127,7 +1127,7 @@ steps indicated in the workflow below: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1174,7 +1174,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1265,7 +1265,7 @@ Regardless of your choice, there's unfortunately a bit of necessary boilerplate. actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.combine_hashes.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1318,7 +1318,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.combine_hashes.outputs.hashes }}" upload-assets: true # Optional: Upload to a new release @@ -1358,7 +1358,7 @@ provenance: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs[format('hash-{0}-{1}', matrix.color, matrix.flavor)] }}" upload-assets: true # Optional: Upload to a new release @@ -1403,7 +1403,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs[format('hash-{0}-{1}', matrix.color, matrix.flavor)] }}" upload-assets: true # Optional: Upload to a new release @@ -1506,7 +1506,7 @@ jobs: actions: read id-token: write contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.build.outputs[format('hash-{0}', matrix.os)] }}" upload-assets: true # NOTE: This does nothing unless 'upload-tag-name' parameter is also set to an existing tag @@ -1571,7 +1571,7 @@ jobs: actions: read id-token: write contents: write - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 with: base64-subjects: "${{ needs.combine_hashes.outputs.hashes }}" upload-assets: true # NOTE: This does nothing unless 'upload-tag-name' parameter is also set to an existing tag @@ -1636,7 +1636,7 @@ downloading the latest release. Make sure you continue to reference the workflow using a release tag in order to allow verification by `slsa-verifier`. ```yaml -uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0 +uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.10.0 ``` ### Compatibility with `actions/download-artifact` diff --git a/internal/builders/go/README.md b/internal/builders/go/README.md index 2106c4d64d..0753b0c168 100644 --- a/internal/builders/go/README.md +++ b/internal/builders/go/README.md @@ -174,7 +174,7 @@ build: arch: - amd64 - arm64 - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 with: go-version: 1.19 config-file: .slsa-goreleaser/${{matrix.os}}-${{matrix.arch}}.yml @@ -251,7 +251,7 @@ jobs: contents: write # To upload assets to release. actions: read # To read the workflow path. needs: args - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 with: go-version: 1.17 # Optional: only needed if using ldflags. @@ -420,7 +420,7 @@ the latest release. Make sure you continue to reference the workflow using a release tag in order to allow verification by `slsa-verifier`. ```yaml -uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.9.0 +uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.10.0 ``` ### Compatibility with `actions/download-artifact` diff --git a/internal/builders/gradle/README.md b/internal/builders/gradle/README.md index f2160597b9..1da6c17c39 100644 --- a/internal/builders/gradle/README.md +++ b/internal/builders/gradle/README.md @@ -83,7 +83,7 @@ jobs: id-token: write contents: read actions: read - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.10.0 with: artifact-list: >- ./build/artifact1.jar, diff --git a/internal/builders/gradle/action.yml b/internal/builders/gradle/action.yml index 223ab95344..238307f397 100644 --- a/internal/builders/gradle/action.yml +++ b/internal/builders/gradle/action.yml @@ -101,7 +101,7 @@ runs: # when multiple workflows run concurrently. - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 - name: Put release artifacts in one directory shell: bash @@ -128,7 +128,7 @@ runs: [[ "${PROJECT_ROOT}" -ef "${GITHUB_WORKSPACE}" ]] || mv "${PROJECT_ROOT}"/build "${GITHUB_WORKSPACE}"/ - name: Upload build dir id: upload-build-dir - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0 with: name: "${{ steps.rng.outputs.random }}-build" path: build diff --git a/internal/builders/maven/README.md b/internal/builders/maven/README.md index bc1937c3fe..b65e803295 100644 --- a/internal/builders/maven/README.md +++ b/internal/builders/maven/README.md @@ -83,7 +83,7 @@ jobs: id-token: write contents: read actions: read - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@v1.10.0 ``` Now, when you invoke this workflow, the Maven builder will build both your artifacts and the provenance files for them. diff --git a/internal/builders/maven/action.yml b/internal/builders/maven/action.yml index 5de77a3532..df252f6cd4 100644 --- a/internal/builders/maven/action.yml +++ b/internal/builders/maven/action.yml @@ -63,10 +63,10 @@ runs: distribution: temurin java-version: ${{ fromJson(inputs.slsa-workflow-inputs).jdk-version }} - name: Checkout the tool repository - uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.10.0 with: repository: slsa-framework/slsa-github-generator - ref: v1.10.0-rc.0 + ref: v1.10.0 path: __BUILDER_CHECKOUT_DIR__ - name: Run mvn package shell: bash @@ -113,11 +113,11 @@ runs: # when multiple workflows run concurrently. - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 - name: Upload target id: upload-target - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@v1.10.0 with: name: "${{ steps.rng.outputs.random }}-target" path: target diff --git a/internal/builders/nodejs/README.md b/internal/builders/nodejs/README.md index e26d51fdf3..6c1f4f655d 100644 --- a/internal/builders/nodejs/README.md +++ b/internal/builders/nodejs/README.md @@ -121,7 +121,7 @@ jobs: contents: read # For repo checkout. actions: read # For getting workflow run info. if: startsWith(github.ref, 'refs/tags/') - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_nodejs_slsa3.yml@v1.10.0 with: run-scripts: "ci, test, build" ``` @@ -154,7 +154,7 @@ publish: - name: publish id: publish - uses: slsa-framework/slsa-github-generator/actions/nodejs/publish@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/publish@v1.10.0 with: access: public node-auth-token: ${{ secrets.NPM_TOKEN }} @@ -197,14 +197,14 @@ jobs: registry-url: "https://registry.npmjs.org" - name: Download tarball - uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-package-download@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-package-download@v1.10.0 with: name: ${{ needs.build.outputs.package-download-name }} path: ${{ needs.build.outputs.package-name }} sha256: ${{ needs.build.outputs.package-download-sha256 }} - name: Download provenance - uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.9.0 + uses: slsa-framework/slsa-github-generator/actions/nodejs/secure-attestations-download@v1.10.0 with: name: ${{ needs.build.outputs.provenance-download-name }} path: "attestations" diff --git a/internal/builders/nodejs/action.yml b/internal/builders/nodejs/action.yml index 6d51221a2c..449b9da5de 100644 --- a/internal/builders/nodejs/action.yml +++ b/internal/builders/nodejs/action.yml @@ -85,9 +85,9 @@ runs: # when multiple workflows run concurrently. - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0-rc.0 + uses: slsa-framework/slsa-github-generator/.github/actions/rng@v1.10.0 - - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0-rc.0 + - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0 id: upload with: name: "${{ steps.rng.outputs.random }}-package.tgz"