diff --git a/.github/actions/checkout-go/action.yml b/.github/actions/checkout-go/action.yml index 9c78308170..9274c37a64 100644 --- a/.github/actions/checkout-go/action.yml +++ b/.github/actions/checkout-go/action.yml @@ -57,7 +57,7 @@ runs: token: "${{ inputs.token }}" - name: Verify checkout - uses: slsa-framework/slsa-github-generator/.github/actions/verify-checkout@96a2f25046e2f517c49c6ab1a258a7dc0c14687a + uses: slsa-framework/slsa-github-generator/.github/actions/verify-checkout@e3220805577deb9d193f64e519abcb3b50851df5 - name: Set up Go environment uses: actions/setup-go@268d8c0ca0432bb2cf416faae41297df9d262d7f # tag=v3.3.0 diff --git a/.github/actions/generate-builder/action.yml b/.github/actions/generate-builder/action.yml index 3af41b5b8d..baefe6292e 100644 --- a/.github/actions/generate-builder/action.yml +++ b/.github/actions/generate-builder/action.yml @@ -34,7 +34,7 @@ runs: using: "composite" steps: - name: Checkout the Go builder repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@e3220805577deb9d193f64e519abcb3b50851df5 with: repository: "${{ inputs.repository }}" ref: "${{ inputs.ref }}" @@ -62,7 +62,7 @@ runs: run: ./.github/actions/generate-builder/generate-builder.sh - name: Compute sha256 of builder - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 id: compute with: path: "${{ inputs.binary }}" diff --git a/.github/actions/secure-download-artifact/action.yml b/.github/actions/secure-download-artifact/action.yml index 98d2765ab6..090fd18291 100644 --- a/.github/actions/secure-download-artifact/action.yml +++ b/.github/actions/secure-download-artifact/action.yml @@ -36,7 +36,7 @@ runs: - name: Compute the hash id: compute - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 with: path: "${{ inputs.path }}" diff --git a/.github/actions/secure-upload-artifact/action.yml b/.github/actions/secure-upload-artifact/action.yml index baff142968..907f3e25dd 100644 --- a/.github/actions/secure-upload-artifact/action.yml +++ b/.github/actions/secure-upload-artifact/action.yml @@ -18,7 +18,7 @@ runs: steps: - name: Compute binary hash id: compute-digest - uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/compute-sha256@e3220805577deb9d193f64e519abcb3b50851df5 with: path: "${{ inputs.path }}" diff --git a/.github/workflows/builder_go_slsa3.yml b/.github/workflows/builder_go_slsa3.yml index b379a12e61..2e1c7e7b39 100644 --- a/.github/workflows/builder_go_slsa3.yml +++ b/.github/workflows/builder_go_slsa3.yml @@ -68,7 +68,7 @@ jobs: steps: - name: Generate random 16-byte value (32-char hex encoded) id: rng - uses: slsa-framework/slsa-github-generator/.github/actions/rng@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/rng@e3220805577deb9d193f64e519abcb3b50851df5 detect-env: outputs: @@ -95,7 +95,7 @@ jobs: steps: - name: Generate builder id: generate - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@e3220805577deb9d193f64e519abcb3b50851df5 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -128,12 +128,12 @@ jobs: needs: [builder, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@e3220805577deb9d193f64e519abcb3b50851df5 with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -166,12 +166,12 @@ jobs: needs: [builder, build-dry, rng] steps: - name: Checkout the Go repository - uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/checkout-go@e3220805577deb9d193f64e519abcb3b50851df5 with: go-version: ${{ inputs.go-version }} - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -217,7 +217,7 @@ jobs: - name: Upload generated binary id: upload - uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" @@ -238,7 +238,7 @@ jobs: go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }} steps: - name: Download builder - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}" path: "${{ env.BUILDER_BINARY }}" @@ -290,14 +290,14 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download binary - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ needs.build-dry.outputs.go-binary-name }}" path: "${{ needs.build-dry.outputs.go-binary-name }}" sha256: "${{ needs.build.outputs.go-binary-sha256 }}" - name: Download provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ needs.provenance.outputs.go-provenance-name }}" path: "${{ needs.provenance.outputs.go-provenance-name }}" diff --git a/.github/workflows/generator_container_slsa3.yml b/.github/workflows/generator_container_slsa3.yml index f2e4d2496a..4c86dfe151 100644 --- a/.github/workflows/generator_container_slsa3.yml +++ b/.github/workflows/generator_container_slsa3.yml @@ -57,7 +57,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@e3220805577deb9d193f64e519abcb3b50851df5 # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -81,7 +81,7 @@ jobs: packages: write steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@e3220805577deb9d193f64e519abcb3b50851df5 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -91,7 +91,7 @@ jobs: # NOTE: We are using the generic generator. directory: "${{ env.BUILDER_DIR }}" - - uses: sigstore/cosign-installer@b3413d484cc23cf8778c3d2aa361568d4eb54679 # tag=v2.5.1 + - uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # tag=v2.6.0 - name: Login env: UNTRUSTED_IMAGE: "${{ inputs.image }}" diff --git a/.github/workflows/generator_generic_slsa3.yml b/.github/workflows/generator_generic_slsa3.yml index 9b49a87fa7..61850e0f6b 100644 --- a/.github/workflows/generator_generic_slsa3.yml +++ b/.github/workflows/generator_generic_slsa3.yml @@ -71,7 +71,7 @@ jobs: steps: - name: Detect the generator ref id: detect - uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@e3220805577deb9d193f64e519abcb3b50851df5 # generator builds the generator binary and runs it to generate SLSA # provenance. @@ -96,7 +96,7 @@ jobs: actions: read steps: - name: Generate builder - uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@e3220805577deb9d193f64e519abcb3b50851df5 with: repository: "${{ needs.detect-env.outputs.repository }}" ref: "${{ needs.detect-env.outputs.ref }}" @@ -157,7 +157,7 @@ jobs: if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true steps: - name: Download the provenance - uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@f9878d18f3c896502bdb5bbb96187fb787d529bb + uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@e3220805577deb9d193f64e519abcb3b50851df5 with: name: "${{ needs.generator.outputs.provenance-name }}" path: "${{ needs.generator.outputs.provenance-name }}" diff --git a/.github/workflows/pre-submit.base-images.yml b/.github/workflows/pre-submit.base-images.yml index 05885605a8..23bc4fa98c 100644 --- a/.github/workflows/pre-submit.base-images.yml +++ b/.github/workflows/pre-submit.base-images.yml @@ -15,6 +15,6 @@ jobs: - name: checkout uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2 - name: install cosign - uses: sigstore/cosign-installer@b3413d484cc23cf8778c3d2aa361568d4eb54679 # tag=v2.5.1 + uses: sigstore/cosign-installer@f3c664df7af409cb4873aa5068053ba9d61a57b6 # tag=v2.6.0 - name: verify images run: ./.github/workflows/scripts/verify-base-images.sh