crashappsec / chalk

Chalk allows you to follow code from development, through builds and into production.
https://crashoverride.com/
GNU General Public License v3.0
322 stars 11 forks source link

annotatated/signed tags are misreported as regular tags #345

Closed miki725 closed 2 weeks ago

miki725 commented 2 weeks ago

When running in GitHub actions when triggering the job from the tag itself, chalk will misreport the tag as not being signed/annotated. This is upstream issue in checkout action:

https://github.com/actions/checkout/issues/290 https://github.com/actions/checkout/issues/882 https://github.com/actions/checkout/pull/697 https://github.com/actions/checkout/pull/1506

Should chalk attempt to automatically git fetch the appropriate tag if git command is present?

As we report signing information I can see how that can be used for compliance however wrong information is not very helpful. I think we should attempt to remedy that officially with chalk to ensure tag information is up to date.