Repository navigation
S5: attestgate Builder; provenance -builder - #36
Merged
Merged
Conversation
A step in a reusable workflow signs with a certificate that names that workflow, not its caller. Gate.Builder names it: it must be on: workflow_call alone, every publishing step must be inside it, and a job that calls it must be in a MainOnly workflow and grant id-token: write (a called workflow has at most its caller's permissions). A verifier then pins the builder: the code that built and attested. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
In a called workflow GITHUB_WORKFLOW_REF is still the caller, so the predicate's builder named the dispatched workflow while the certificate names the reusable one. Predicate.BuiltBy(path) sets the builder to that workflow of the same repository at the run's ref; the dispatched one stays the build's workflow. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
aledbf
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
S5's go-tools part. A step in a reusable workflow signs with a certificate naming that workflow (Build Signer URI), not the caller, so pinning it pins the code that built and attested.
attestgate
Gate.Builder(a workflow file name):on: workflow_callalone;NotPublishedmust be inside it: an upload in the caller or any other workflow is a problem;uses: ./.github/workflows/<Builder>must be in aMainOnlyworkflow and grantid-token: write(a called workflow has at most its caller's permissions);Buildernaming no file fails; inside the builder the usual provenance/SBOM rules still apply.provenance
-builder .github/workflows/<file>(Predicate.BuiltBy): in a called workflowGITHUB_WORKFLOW_REFis still the caller, so the predicate'sbuilder.idwould name the dispatched workflow while the certificate names the reusable one.BuiltBysets the builder to that workflow at the run's ref;externalParameters.workflowstays the dispatched one.Tests:
TestABuilderIsWhereEveryUploadIs,TestABuilderIsTheReusableWorkflowAtTheRunsRef, the command's-buildercases.task lint,task mutate(0 survived).🤖 Generated with Claude Code