Use @actions/attest and @sigstore/oci libraries

github-early-access / generate-build-provenance

Publish a signed build provenance from your GitHub Actions workflow

MIT License

64 stars 32 forks source link

Use @actions/attest and @sigstore/oci libraries #164

Closed bdehamer closed 5 months ago

bdehamer commented 5 months ago

Updates the action logic to use the @actions/attest and @sigstore/oci libraries instead of the local implementation.

Among other things, this brings-in the logic which generates the provenance statement from the GHA OIDC token instead of from the runtime environment.