Add SLSA provenance generation workflow #448
Conversation
This workflow generates SLSA provenance files for projects, satisfying level 3 requirements.
There was a problem hiding this comment.
Pull request overview
This PR adds a GitHub Actions workflow to generate SLSA (Supply chain Levels for Software Artifacts) provenance for the download-artifact action, enabling level 3 provenance requirements compliance. The workflow demonstrates how to generate cryptographic attestations for build artifacts using the SLSA framework.
Key Changes:
- Adds a reusable SLSA provenance generation workflow that triggers on releases and manual dispatch
- Implements a two-job workflow: building artifacts with hash generation, and provenance creation
- Configures permissions for OIDC token signing and release asset uploading
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # List the artifacts the provenance will refer to. | ||
| files=$(ls artifact*) | ||
| # Generate the subjects (base64 encoded). | ||
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" |
There was a problem hiding this comment.
The output variable name is inconsistent. Line 55 sets hashes but line 23 references digests. This will cause the provenance job to receive an empty value. Change hashes to digests to match the job output declaration.
| echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" | |
| echo "digests=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" |
| # ======================================================== | ||
| - name: Build artifacts | ||
| run: | | ||
| # These are some amazing artifacts. |
There was a problem hiding this comment.
[nitpick] Inconsistent indentation detected. This line has 12 spaces of indentation while the standard for multi-line run blocks in this file is 10 spaces (see line 36-37, 50-55). Adjust to 10 spaces for consistency.
| # These are some amazing artifacts. | |
| # These are some amazing artifacts. |
This workflow generates SLSA provenance files for projects, satisfying level 3 requirements.