fix: use @sigstore/cli in e2e.sign-attestations.schedule.yml #3572
Conversation
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
ramonpetgrave64
requested review from
laurentsimon,
joshuagl and
kpk47
as code owners
| @@ -44,13 +44,13 @@ jobs: | |||
| with: | |||
| node-version: 16 | |||
| - name: install sigstore-js | |||
| run: npm ci | |||
| run: npm install -g @sigstore/cli@^0.8.0 | |||
There was a problem hiding this comment.
Does npm have a concept of latest? Then you don't have to worry about updating to the latest sigstore-js CLI
There was a problem hiding this comment.
Yes we could always install the latest
npm install -g @sigstore/cli
, though we generally like to pin versions when we can. But I guess if the signer's version is already pinned, it could be okay to leave the verifier unpinned. @ianlewis wdyk?
There was a problem hiding this comment.
Let's keep pinning, this is useful for determinism. A better way to do to use a lock file, so that dependabot / renovatebot sends us PR. renovatebot supports custom regex to let it know it should interpret this ^0.8.0 as a version to update. I think it's easier to use a lock file to pin the dep.
There was a problem hiding this comment.
Any reason why we don't pin in the package.json in the project root? I managed the versions for dev dependencies there so that renovate could send PRs to update them etc.
https://github.com/slsa-framework/slsa-github-generator/blob/main/package.json
There was a problem hiding this comment.
Thanks, that's a better place for this.
| @@ -44,13 +44,13 @@ jobs: | |||
| with: | |||
| node-version: 16 | |||
| - name: install sigstore-js | |||
| run: npm ci | |||
| run: npm install -g @sigstore/cli@^0.8.0 | |||
There was a problem hiding this comment.
Any reason why we don't pin in the package.json in the project root? I managed the versions for dev dependencies there so that renovate could send PRs to update them etc.
https://github.com/slsa-framework/slsa-github-generator/blob/main/package.json
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
Summary
Addresses #3002
Fixes the .github/workflows/e2e.sign-attestations.schedule.yml workflow.
sigstore-js now has its cli tools in a separate package, to be installed with
install -g @sigstore/cli.Testing Process
Invoked the workflow from my personal fork
We can't add this to a pre-submit, because it requires token permissions that are not available to forks' PR runs.
Checklist