Repository navigation
attestgate: a builder runs only in its own repository - #37
Merged
Merged
Conversation
Any repository can call a public reusable workflow, and the certificate its run gets names the builder at the ref it called: build-release.yml@refs/heads/main over what that other repository checked out. Gate.Repository (required with Builder) holds every builder job to if: github.repository == '<owner/name>', so the builder signs nothing anywhere else; verifiers still pin the source repository. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Any repository can call a public reusable workflow, and the certificate its run gets names the builder at the ref it called (
build-release.yml@refs/heads/main) over what that repository checked out. So after S5 the SAN alone no longer binds the source repository.Gate.Repository(required withBuilder) holds every builder job toif: github.repository == '<owner/name>', so the builder signs nothing anywhere else. Verifiers still pin the source repository as well (cosign--certificate-github-workflow-repository, Fulcio SourceRepositoryURI): that lands in spin-machine and spin next.Tests: the builder fixtures carry the guard; new cases cover no guard, the wrong repository, and no Repository.
task lint,task mutate(0 survived).🤖 Generated with Claude Code
Need help on this PR? Tag
@codesmith-botwith what you need.