search

slsa-framework / slsa-github-generator

Language-agnostic SLSA provenance generation for Github Actions
Apache License 2.0
417 stars 127 forks source link

Get repository, ref via Github API #124

Open ianlewis opened 2 years ago

ianlewis commented 2 years ago

Currently we have to have special case code to run e2e tests in pull requests due to #131. I'd like to get rid of that code so that pull requests run normally.

I want to see if I can't get the repository and ref via the Github API rather than by creating an OIDC token. Creating an OIDC token requires id-token scope which is not normally given to workflows triggered by the pull_request event.

This wouldn't allow us to sign using sigstore's Github provider, but it would at least solve the problem of getting the reusable workflow repo and ref.

laurentsimon commented 2 years ago

This was done and can be closed?

ianlewis commented 2 years ago

No, this is just an idea I had that I wanted to get the repo and ref via the GitHub API instead of by using job_workflow_ref an OIDC token. I'm not sure it's really possible. It's more of a refactor than a feature and it's not really high priority.

laurentsimon commented 2 years ago

ho right, my bad.

asraa commented 1 year ago

Update here: detect-workflow-js works this way so the remaining item here is to (after ensuring some stability in that new action) to deprecate detect-workflow and replace with detect-workflow-js

ianlewis commented 4 months ago

The old detect-workflow action was removed in #1988 and detect-workflow-js does this already. Closing.

https://github.com/slsa-framework/slsa-github-generator/blob/f8e470688f4d6523b8afa65618cf5e8a1183fcf4/.github/actions/detect-workflow-js/src/main.ts#L42-L60

github-actions[bot] commented 4 months ago

This issue was reopened by the todo-issue-reopener action in the "TODO Issue Reopener" GitHub Actions workflow because there are TODOs referencing this issue:

  1. internal/builders/container/generate.go:55: Remove
  2. internal/builders/container/generate.go:63: Remove
  3. internal/builders/generic/attest.go:87: Remove
  4. internal/builders/generic/attest.go:95: Remove
  5. internal/builders/go/pkg/provenance.go:129: Remove
  6. internal/builders/go/pkg/provenance.go:139: Remove
  7. internal/builders/go/pkg/provenance_test.go:26: Remove
ianlewis commented 4 months ago

So I think the issue is that this is fixed for detect-workflow-js but we only use that for our pre-BYOB builders/generators that were written in Go in order to detect which repo/ref to checkout in order to build the builder binary for pre-submits/e2e tests.

We still need to update the pre-BYOB builder code itself to clean up how we deal with pre-submits and e2e tests.