1
0
Fork 0
toolkit/packages/attest/src
Meriadec Pillet 717ba9d9a4
Handle tags containing "@" character in `buildSLSAProvenancePredicate`
When using some monorepo-related tools (like [changesets](https://github.com/changesets/changesets)),
the produced tags have a special format that includes `@` character.

For example, a `foo` package on a monorepo will produce Git tags looking
like `foo@1.0.0` if using changesets.

When used in combination with `actions/attest-build-provenance`, the
action was not properly re-crafting the tag in `buildSLSAProvenancePredicate` because
it was always splitting the workflow ref by `@` and taking the second
element.

This result in this error on CI:

```
Error: Error: Failed to persist attestation: Invalid Argument - values do not match: refs/tags/foo != refs/tags/foo@1.0.0 - https://docs.github.com/rest/repos/repos#create-an-attestation
````

This PR slightly update the logic there, and rather take "everything
located after the first '@'". This shouldn't introduce any breaking
change, while giving support for custom tags.

I've added the corresponding test case, it passes, however I couldn't
successfully run the full test suite (neither on `main`). Looking
forward for CI outcome.

Thanks in advance for the review 🙏.
2024-10-30 14:29:42 +01:00
..
attest.ts support for headers param in attest functions 2024-08-15 15:35:32 -07:00
endpoints.ts Fixed a spelling error 2024-05-20 07:57:44 +02:00
index.ts add new @actions/attest package 2024-02-26 08:52:20 -08:00
intoto.ts add new @actions/attest package 2024-02-26 08:52:20 -08:00
oidc.ts fix bug with customized oidc issuer 2024-09-04 10:24:28 -07:00
provenance.ts Handle tags containing "@" character in `buildSLSAProvenancePredicate` 2024-10-30 14:29:42 +01:00
shared.types.ts add new @actions/attest package 2024-02-26 08:52:20 -08:00
sign.ts bump @sigstore/sign from 2.3.2 to 3.0.0 2024-10-14 12:06:26 -07:00
store.ts support for headers param in attest functions 2024-08-15 15:35:32 -07:00