Add SLSA Provenance and Release Steps - #814
Merged
Merged
Conversation
Add instructions to pin GitHub Actions to specific SHA hashes from jonobr1 forks to satisfy OpenSSF Scorecard pinned-dependencies requirements. The new doc includes a naming convention, a mapping table of common actions to pinned fork SHAs, guidance for pinning npm installs, and steps for adding new actions (including a TODO placeholder for forks). Applies to .github/workflows/**.
Replace forked/third-party action references with official action repositories for security and maintainability. Updated workflows to use actions/checkout, actions/setup-node, actions/cache, github/codeql-action, and ossf/scorecard-action and added inline version comments (e.g. # v5 / # v6 / # v4). Affected files: .github/workflows/codeql.yml, copilot-setup-steps.yml, lint.yml, publish.yml, and scorecard.yml. No behavioral changes beyond switching action sources and annotating versions.
Enable SLSA provenance attestation and attach provenance to releases and npm publishes. Update workflow permissions to include contents: write and attestations: write (keeping id-token: write) so the job can create releases and produce attestations. Make the build step explicit (remove --if-present), run actions/attest-build-provenance to generate an intoto provenance bundle for build/two.js, build/two.module.js and build/two.min.js, stage the bundle as an artifact, create a GitHub Release including the build artifacts and the provenance JSONL, and publish to npm with --provenance.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds release-time supply chain artifacts by generating SLSA provenance for built JS outputs and attaching them to GitHub releases / npm publishes, while also migrating several workflows from jonobr1/* action forks to upstream actions.
Changes:
- Update multiple workflows to use upstream GitHub/OSSF actions instead of
jonobr1/*forks. - Enhance the publish workflow to build explicitly, generate SLSA provenance attestation, create a GitHub Release with artifacts + provenance, and publish to npm with
--provenance. - Adjust publish workflow permissions to allow attestations and release creation.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
.github/workflows/scorecard.yml |
Switches to upstream actions/checkout, ossf/scorecard-action, and github/codeql-action/upload-sarif. |
.github/workflows/publish.yml |
Adds SLSA provenance attestation + GitHub Release creation + npm publish provenance, and updates permissions. |
.github/workflows/lint.yml |
Switches checkout action reference (but currently breaks YAML structure). |
.github/workflows/copilot-setup-steps.yml |
Switches checkout/setup-node action references to upstream. |
.github/workflows/codeql.yml |
Switches checkout/setup-node/cache/codeql-action references to upstream. |
Comments suppressed due to low confidence (1)
.github/workflows/lint.yml:15
- The
stepslist items are not indented understeps:(e.g.,- uses,- name,run). As written, this YAML will not parse as a valid GitHub Actions workflow. Indent each step by two additional spaces so the list is a child ofsteps:.
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
- name: Install modules
run: npm install
- name: Run ESLint
run: npm run lint
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Up to standards ✅🟢 Issues
|
Add a step to upload the generated provenance bundle as a GitHub Actions artifact and run `npm publish --provenance` earlier in the workflow. The upload-artifact action is pinned to a specific commit (v4.6.2) and names the artifact `provenance-bundle-${{ github.ref_name }}` using the produced `two.js-${{ github.ref_name }}.intoto.jsonl` file. Remove the duplicate `npm publish --provenance` step at the end of the job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enable SLSA provenance attestation and attach provenance to releases and npm publishes. Update workflow permissions to include contents: write and attestations: write (keeping id-token: write) so the job can create releases and produce attestations. Make the build step explicit (remove --if-present), run actions/attest-build-provenance to generate an intoto provenance bundle for build/two.js, build/two.module.js and build/two.min.js, stage the bundle as an artifact, create a GitHub Release including the build artifacts and the provenance JSONL, and publish to npm with --provenance.