chainguard-dev / vex

vexctl is a tool to attest VEX impact statements
Apache License 2.0
44 stars 12 forks source link

VEX GitHub Action! #28

Open puerco opened 2 years ago

puerco commented 2 years ago

We need to write an action to enable attesting an image right after building new container images.

The idea is that you can add a step to any pipeline that builds images. It should read known vex data from the golden sample, create an attestation, sign it and attach it to the newly create image.