slsa-framework / github-actions-demo

Proof-of-concept SLSA provenance generator for GitHub Actions
MIT License
99 stars 22 forks source link

Convert create_provenance into an action: #3

Closed loosebazooka closed 3 years ago

loosebazooka commented 3 years ago

Signed-off-by: Appu Goundan appu@google.com

loosebazooka commented 3 years ago

Sample action output:

{
    "_type": "https://in-toto.io/statement/v0.1",
    "subject": [
      {
        "Name": "goose.txt",
        "Digest": {
          "sha256": "1fbc02de3d979c27aff8fc39671d4e07541a475bb49312049a17e05aeed57021"
        }
      }
    ],
    "predicateType": "https://in-toto.io/provenance/v0.1",
    "stmt.Predicate": {
      "builder": {
        "id": "https://github.com/Attestations/GitHubHostedActions@v1"
      },
      "metadata": {
        "buildInvocationId": "926616648",
        "completeness": {
          "arguments": true,
          "environment": true,
          "materials": false
        },
        "reproducible": false,
        "buildFinishedOn": "2021-06-10T21:54:41Z"
      },
      "recipe": {
        "type": "https://github.com/Attestations/GitHubActionsWorkflow@v1",
        "definedInMaterial": 0,
        "entryPoint": "create a sample provenance",
        "arguments": null,
        "environment": {
          "github": {
            "action": "self",
            "action_path": "",
            "actor": "loosebazooka",
            "base_ref": "",
            "event": {
              "inputs": null,
              "ref": "refs/heads/main",
              "repository": {
                "archive_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/{archive_format}{/ref}",
                "archived": false,
                "assignees_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/assignees{/user}",
                "blobs_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/git/blobs{/sha}",
                "branches_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/branches{/branch}",
                "clone_url": "https://github.com/loosebazooka/testing-nonsense.git",
                "collaborators_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/collaborators{/collaborator}",
                "comments_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/comments{/number}",
                "commits_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/commits{/sha}",
                "compare_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/compare/{base}...{head}",
                "contents_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/contents/{+path}",
                "contributors_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/contributors",
                "created_at": "2021-06-10T21:00:59Z",
                "default_branch": "main",
                "deployments_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/deployments",
                "description": "trying to see what I can do",
                "disabled": false,
                "downloads_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/downloads",
                "events_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/events",
                "fork": false,
                "forks": 0,
                "forks_count": 0,
                "forks_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/forks",
                "full_name": "loosebazooka/testing-nonsense",
                "git_commits_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/git/commits{/sha}",
                "git_refs_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/git/refs{/sha}",
                "git_tags_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/git/tags{/sha}",
                "git_url": "git://github.com/loosebazooka/testing-nonsense.git",
                "has_downloads": true,
                "has_issues": true,
                "has_pages": false,
                "has_projects": true,
                "has_wiki": true,
                "homepage": null,
                "hooks_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/hooks",
                "html_url": "https://github.com/loosebazooka/testing-nonsense",
                "id": 375829301,
                "issue_comment_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/issues/comments{/number}",
                "issue_events_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/issues/events{/number}",
                "issues_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/issues{/number}",
                "keys_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/keys{/key_id}",
                "labels_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/labels{/name}",
                "language": "Go",
                "languages_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/languages",
                "license": {
                  "key": "mit",
                  "name": "MIT License",
                  "node_id": "MDc6TGljZW5zZTEz",
                  "spdx_id": "MIT",
                  "url": "https://api.github.com/licenses/mit"
                },
                "merges_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/merges",
                "milestones_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/milestones{/number}",
                "mirror_url": null,
                "name": "testing-nonsense",
                "node_id": "MDEwOlJlcG9zaXRvcnkzNzU4MjkzMDE=",
                "notifications_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/notifications{?since,all,participating}",
                "open_issues": 0,
                "open_issues_count": 0,
                "owner": {
                  "avatar_url": "https://avatars.githubusercontent.com/u/1304826?v=4",
                  "events_url": "https://api.github.com/users/loosebazooka/events{/privacy}",
                  "followers_url": "https://api.github.com/users/loosebazooka/followers",
                  "following_url": "https://api.github.com/users/loosebazooka/following{/other_user}",
                  "gists_url": "https://api.github.com/users/loosebazooka/gists{/gist_id}",
                  "gravatar_id": "",
                  "html_url": "https://github.com/loosebazooka",
                  "id": 1304826,
                  "login": "loosebazooka",
                  "node_id": "MDQ6VXNlcjEzMDQ4MjY=",
                  "organizations_url": "https://api.github.com/users/loosebazooka/orgs",
                  "received_events_url": "https://api.github.com/users/loosebazooka/received_events",
                  "repos_url": "https://api.github.com/users/loosebazooka/repos",
                  "site_admin": false,
                  "starred_url": "https://api.github.com/users/loosebazooka/starred{/owner}{/repo}",
                  "subscriptions_url": "https://api.github.com/users/loosebazooka/subscriptions",
                  "type": "User",
                  "url": "https://api.github.com/users/loosebazooka"
                },
                "private": true,
                "pulls_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/pulls{/number}",
                "pushed_at": "2021-06-10T21:53:42Z",
                "releases_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/releases{/id}",
                "size": 0,
                "ssh_url": "git@github.com:loosebazooka/testing-nonsense.git",
                "stargazers_count": 0,
                "stargazers_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/stargazers",
                "statuses_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/statuses/{sha}",
                "subscribers_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/subscribers",
                "subscription_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/subscription",
                "svn_url": "https://github.com/loosebazooka/testing-nonsense",
                "tags_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/tags",
                "teams_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/teams",
                "trees_url": "https://api.github.com/repos/loosebazooka/testing-nonsense/git/trees{/sha}",
                "updated_at": "2021-06-10T21:53:45Z",
                "url": "https://api.github.com/repos/loosebazooka/testing-nonsense",
                "watchers": 0,
                "watchers_count": 0
              },
              "sender": {
                "avatar_url": "https://avatars.githubusercontent.com/u/1304826?v=4",
                "events_url": "https://api.github.com/users/loosebazooka/events{/privacy}",
                "followers_url": "https://api.github.com/users/loosebazooka/followers",
                "following_url": "https://api.github.com/users/loosebazooka/following{/other_user}",
                "gists_url": "https://api.github.com/users/loosebazooka/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/loosebazooka",
                "id": 1304826,
                "login": "loosebazooka",
                "node_id": "MDQ6VXNlcjEzMDQ4MjY=",
                "organizations_url": "https://api.github.com/users/loosebazooka/orgs",
                "received_events_url": "https://api.github.com/users/loosebazooka/received_events",
                "repos_url": "https://api.github.com/users/loosebazooka/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/loosebazooka/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/loosebazooka/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/loosebazooka"
              },
              "workflow": ".github/workflows/example.yml"
            },
            "event_name": "workflow_dispatch",
            "event_path": "/home/runner/work/_temp/_github_workflow/event.json",
            "head_ref": "",
            "job": "generate_provenance",
            "ref": "refs/heads/main",
            "repository": "loosebazooka/testing-nonsense",
            "repository_owner": "loosebazooka",
            "run_id": "926616648",
            "run_number": "1",
            "sha": "0e038faf1abd95688301a6163ba6fbab6c695719",
            "workflow": "create a sample provenance",
            "workspace": "/home/runner/work/testing-nonsense/testing-nonsense"
          },
          "runner": {
            "os": "Linux",
            "temp": "/home/runner/work/_temp",
            "tool_cache": "/opt/hostedtoolcache"
          }
        }
      },
      "materials": [
        {
          "uri": "https://github.com/loosebazooka/testing-nonsense",
          "digest": {
            "sha1": "0e038faf1abd95688301a6163ba6fbab6c695719"
          }
        }
      ]
    }
  }