wrap actions/attest-build-provenance #211
Conversation
bdehamer
force-pushed
the
bdehamer/wrap-public-action
branch
from
4a80625 to
bf2e88e
Compare
bdehamer
force-pushed
the
bdehamer/wrap-public-action
branch
2 times, most recently
from
26aef12 to
2db573f
Compare
Signed-off-by: Brian DeHamer <[email protected]>
bdehamer
force-pushed
the
bdehamer/wrap-public-action
branch
from
2db573f to
3b758b9
Compare
| - id: translate-output | ||
| if: runner.os != 'Windows' | ||
| shell: bash | ||
| run: | | ||
| read -r line < ${{ steps.attest.outputs.bundle-path }} | ||
| echo "bundle=$line" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
The primary difference between the early-access action and the public action is the way the action output is handled:
- In the early-access action, the JSON-serialized bundle is passed back in the
bundleoutput variable. - In the new action, any attestation bundles are written to a file and the path to that file is passed back in the
bundle-pathoutput variable.
This bit translates the new scheme to the old one for backward compatibility. We don't handle Windows cause there's no easy way to handle file paths on both Windows and non-Windows runners.
There was a problem hiding this comment.
The only user I'd worry about for the Windows platform is Homebrew... but I believe yesterday they switched to actions/attest-build-provenance so I think we can proceed!
There was a problem hiding this comment.
Also, I checked and they are not using the action output
| - id: translate-output | ||
| if: runner.os != 'Windows' | ||
| shell: bash | ||
| run: | | ||
| read -r line < ${{ steps.attest.outputs.bundle-path }} | ||
| echo "bundle=$line" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
The only user I'd worry about for the Windows platform is Homebrew... but I believe yesterday they switched to actions/attest-build-provenance so I think we can proceed!
Signed-off-by: Brian DeHamer <[email protected]>
Replace local implementation with a call to the public
actions/attest-build-provenanceaction.This will ensure that anyone who is still referencing the private beta version of the action is getting all of the updates and bug fixes of the public action.
Also includes a deprecation warning in the job summary:
