Skip to content

Commit 78de664

Browse files
authored
Update generator-generic-ossf-slsa3-publish.yml
To update the `generator-generic-ossf-slsa3-publish.yml` workflow for enhanced security and SLSA Level 3 compliance, follow these key improvements: ```yaml name: SLSA Level 3 Generic Generator + Publish on: push: branches: [main] pull_request: release: types: [published] workflow_dispatch: permissions: id-token: write # Required for OIDC token contents: write # Required for release uploads jobs: build: runs-on: ubuntu-latest outputs: base64-subjects: ${{ steps.subjects.outputs.base64_subjects }} upload-artifacts-name: artifacts-${{ github.run_id }} steps: - name: Checkout code uses: actions/checkout@v4 # Your existing build steps here (e.g., npm build, make, etc.) - name: Build artifacts run: | # Example build commands ./build.sh mkdir -p artifacts cp output/* artifacts/ - name: Generate artifact hashes id: subjects run: | cd artifacts subjects="[]" for file in *; do hash=$(sha256sum "$file" | awk '{print $1}') subjects=$(jq -c --arg name "$file" --arg hash "$hash" \ '. += [{"name": $name, "digest": ("sha256:" + $hash)}]' \ <<< "$subjects") done base64_subjects=$(echo -n "$subjects" | base64 -w0) echo "base64_subjects=$base64_subjects" >> $GITHUB_OUTPUT - name: Upload artifacts uses: actions/upload-artifact@v4 with: name: ${{ steps.subjects.outputs.upload-artifacts-name }} path: artifacts/ provenance: needs: [build] uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] permissions: id-token: write # For OIDC token contents: write # For release assets with: base64-subjects: ${{ needs.build.outputs.base64-subjects }} upload-artifacts-name: ${{ needs.build.outputs.upload-artifacts-name }} upload-assets: ${{ github.event_name == 'release' && github.event.action == 'published' }} secrets: inherit ``` ### Key Improvements: 1. **Enhanced Security**: - Explicit `permissions` scoping (least privilege) - Unique artifact names using `${{ github.run_id }}` to prevent tampering - Isolated provenance generation via reusable workflow 2. **SLSA Level 3 Compliance**: - Uses official SLSA generator (`v1.9.0`) - Full non-falsifiable provenance attestation - Build/release separation 3. **Trigger Flexibility**: - Supports automated releases (`release: published`) - Manual triggers (`workflow_dispatch`) - Branch/pull request validation 4. **Artifact Verification**: - Generates SHA256 hashes during build - Base64-encoded subject manifest - Automatic artifact validation in provenance job 5. **Release Safety**: - Auto-uploads assets only for release events - Prevents accidental publish during PRs ### Upgrade Notes: 1. Replace `./build.sh` with your actual build commands 2. Adjust artifact paths in "Build artifacts" and "Generate artifact hashes" steps 3. Update SLSA generator version in `provenance` job if newer exists 4. Requires `jq` in build environment (included in Ubuntu runner) This update ensures your workflow meets strict supply-chain security standards while maintaining release flexibility. The provenance includes cryptographic proof of build integrity and source origin.
1 parent b35bbdc commit 78de664

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

.github/workflows/generator-generic-ossf-slsa3-publish.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# It seems like you've shared a URL to a GitHub Actions workflow badge for a specific event (`create`) in your repository, `Sazwanismail/codespaces-react`. This badge likely shows the status (e.g., passing or failing) of the workflow defined in `generator-generic-ossf-slsa3-publish.yml`.
22

33
If you'd like assistance with:
4+
45
1. Understanding what the workflow does,
56
2. Troubleshooting issues in the workflow,
67
3. Modifying the workflow,

0 commit comments

Comments
 (0)