feat(ci): add build provenance attestation #22
Conversation
wilsonianb
commented
Aug 21, 2024
wilsonianb
commented
- resolves Add build provenance attestation for deployed workers #21
| workingDirectory: ${{ github.event.inputs.directory }} | ||
| command: deploy --no-bundle --name=${{ github.event.inputs.appId }} --dispatch-namespace ${{ github.event.inputs.dispatchNamespace }} ${{ steps.get-script.outputs.WORKER_SCRIPT }} | ||
|
|
||
| attest: |
There was a problem hiding this comment.
Making this a separate job creates a second set of webhook events
.github/workflows/deploy-worker.yml
Outdated
| - name: Attest Build Provenance | ||
| uses: actions/attest-build-provenance@v1 | ||
| with: | ||
| subject-path: ${{ needs.deploy.outputs.WORKER_SCRIPT }} |
There was a problem hiding this comment.
Upload bundle (& script/artifact) to r2?
https://github.com/actions/attest-build-provenance?tab=readme-ov-file#outputs
Still not sure how to get the attestation url other than via the the script/artifact digest
https://docs.github.com/en/rest/repos/repos?apiVersion=2022-11-28#list-attestations
actions/attest-build-provenance#69 (comment)
Add worker branch to workflow input.
| run: | | ||
| uri="git+https://github.com/${{ github.event.inputs.repo }}@refs/heads/${{ github.event.inputs.branch }}" | ||
| resolved_dependencies=$(jq -n --arg uri "$uri" --arg commit "${{ github.event.inputs.commit }}" '[{"uri": $uri, "digest": {"gitCommit": $commit}}]') | ||
| predicate=$(echo '${{ steps.generate-build-provenance-predicate.outputs.predicate }}' | jq -c '.buildDefinition.externalParameters.resolvedDependencies = $resolved_dependencies' --argjson resolved_dependencies "$resolved_dependencies") |
There was a problem hiding this comment.
Overriding the existing .buildDefinition.resolvedDependencies resulted in
Error: Failed to persist attestation: Invalid Argument - values do not match: git+https://github.com/wilsonianb/php-worker-hello-world@refs/heads/master != git+https://github.com/codius/codius-workers@refs/heads/preview - https://docs.github.com/rest/repos/repos#create-an-attestation
which appears to originate in
https://github.com/actions/toolkit/blob/6c4e082c181a51609197e536ef5255a0c9baeef7/packages/attest/src/store.ts#L28-L42
Specifying the worker's repo in an added resolvedDependencies field under externalParameters appears to work.
However, it isn't displayed in either the GitHub attestation or Rekor entry
It can be found by parsing the attestation file:
jq -r '.dsseEnvelope.payload' codius-codius-workers-attestation-1774723.sigstore.json | base64 -d | jq .
Report appId in separate workflow job. Add workflow_run.completed webhook handler. Add githubWorkflowRunId index in apps table.
