Repository navigation
Reference SLSA generator by tag, label tag commit - #308
Conversation
Release run 42426128759 (dispatch, tag v0.4.0-beta.12) pushed and
signed the image but "provenance / final" failed: the generator's
builder fetch rejects SHA refs ("Expected ref of the form
refs/tags/vX.Y.Z"). No release run has ever passed this job.
Tag v2.1.0 resolves to the same commit f7dd8c54, so the code run is
unchanged.
On workflow_dispatch github.sha is the branch head, so the image
label org.opencontainers.image.revision pointed at main (a137099)
while the tree built was the tag's (4273b4f). Preflight now emits
the checked-out sha and the image job labels it.
Codex Review Summary: ✅ CompletedThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 79af97b6c6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| id-token: write | ||
| packages: write | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0 | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 # f7dd8c54 — generator rejects SHA refs |
There was a problem hiding this comment.
When workflow_dispatch runs from a branch such as main with inputs.tag pointing to a release tag, the image job checks out that tag, but the reusable workflow records the caller's branch ref and SHA in its provenance. With this change, the provenance job can succeed and sign an attestation tying the tag-built image digest to the branch commit; the new image label does not correct the attestation. Ensure provenance uses the selected release ref/SHA, or avoid issuing this attestation for branch-dispatched tag releases.
Useful? React with 👍 / 👎.
Release run 42426128759 (dispatch, tag v0.4.0-beta.12) pushed and
signed the image but "provenance / final" failed: the generator's
builder fetch rejects SHA refs ("Expected ref of the form
refs/tags/vX.Y.Z"). No release run has ever passed this job.
Tag v2.1.0 resolves to the same commit f7dd8c54, so the code run is
unchanged.
On workflow_dispatch github.sha is the branch head, so the image
label org.opencontainers.image.revision pointed at main (a137099)
while the tree built was the tag's (4273b4f). Preflight now emits
the checked-out sha and the image job labels it.
Follow-up to #307. Run: https://github.com/KeiaiLab/postgres-operator/actions/runs/42426128759