Add provenance metadata support - Githubissues

in-toto / in-toto-jenkins-plugin

A Jenkins plugin to track steps and create in-toto link metadata

MIT License

5 stars 5 forks source link

Add provenance metadata support #5

Closed lakshya8066 closed 1 year ago

lakshya8066 commented 2 years ago

[x] Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
[x] Ensure that the pull request title represents the desired changelog entry
[x] Please describe what you did This PR adds support for generating Provenance v0.2 metadata for each step of the Jenkins build.
[ ] Link to relevant issues in GitHub or Jira
[ ] Link to relevant pull requests, esp. upstream and downstream changes
[ ] Ensure you have provided tests - that demonstrates feature works or fixes the issue

lakshya8066 commented 2 years ago

@SantiagoTorres This is the work so far, can you take a look? :)

lakshya8066 commented 1 year ago

Is it a good idea to remove the import statements that are not used?

adityasaky commented 1 year ago

@lakshya8066 is this ready for a review again?

lakshya8066 commented 1 year ago

@adityasaky Yes, the updates are ready for review.

lakshya8066 commented 1 year ago

Can we pass in a list of user controlled environment variables to exclude after running through some of the defaults here?

@adityasaky By user controlled, do you mean the user running the plugin through Jenkinsfile? In that case, we can take in the env variables that need to be excluded from the metadata as input in the Jenkinsfile.

lakshya8066 commented 1 year ago

There is a ticked opened for Rekor already, so opened a ticked for Archivist only.

adityasaky commented 1 year ago

By user controlled, do you mean the user running the plugin through Jenkinsfile? In that case, we can take in the env variables that need to be excluded from the metadata as input in the Jenkinsfile.

Yes but on second thought, probably okay to open a ticket for a feature request. Probably a good first issue.

lakshya8066 commented 1 year ago

Yes but on second thought, probably okay to open a ticket for a feature request. Probably a good first issue.

I am working on this, but yeah I think let's get this PR merged and I can push a patch for this afterward. Is that okay?

adityasaky commented 1 year ago

Sounds good, can we still open a ticket for it? You can probably submit that patch directly to jenkinsci as well :)

lakshya8066 commented 1 year ago

Sure!

lakshya8066 commented 1 year ago

@adityasaky This should be ready to merge right?

adityasaky commented 1 year ago

We want to cut a release of -java and bump up the version here, yes?

lakshya8066 commented 1 year ago

Ah yes, correct. Will update the version here once -java is released...

adityasaky commented 1 year ago

Thanks for your work, @lakshya8066!