Skip to content

Commit 5617130

Browse files
matifalimatifali
authored
ci: fix SLSA predicate schema in attestation steps (#23768)
Follow-up to #23763. The custom predicate uses the **SLSA v0.2 schema** (`invocation`, `configSource`, `metadata`) but declares `predicate-type` as v1. GitHub's attestation API rejects the mismatch: ``` Error: Failed to persist attestation: Invalid Argument - predicate is not of type slsa1.ProvenancePredicate ``` This was masked before #23763 because the steps failed earlier on missing `subject-digest`. Now that digests are provided, this is the next error. ## Fix Remove the custom `predicate-type` and `predicate` inputs. Without them, `actions/attest@v4` auto-generates a correct SLSA v1 predicate from the GitHub Actions OIDC token — which is what `gh attestation verify` expects. - `ci.yaml`: 3 attestation steps (main, latest, version-specific) - `release.yaml`: 3 attestation steps (base, main, latest) <details> <summary>Verification (source code trace of actions/attest@v4)</summary> 1. **`detect.ts`**: No `predicate-type`/`predicate` → returns `'provenance'` (not `'custom'`) 2. **`main.ts`**: `getPredicateForType('provenance')` → `generateProvenancePredicate()` 3. **`@actions/toolkit/.../provenance.ts`**: `buildSLSAProvenancePredicate()` fetches OIDC claims, builds correct v1 predicate with `buildDefinition`/`runDetails` </details> > 🤖 This PR was created with the help of Coder Agents, and needs a human review. 🧑💻
1 parent 0b07ce2 commit 5617130

2 files changed

Lines changed: 0 additions & 168 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 0 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1340,34 +1340,6 @@ jobs:
13401340
with:
13411341
subject-name: ghcr.io/coder/coder-preview
13421342
subject-digest: ${{ steps.docker_digests.outputs.main_digest }}
1343-
predicate-type: "https://slsa.dev/provenance/v1"
1344-
predicate: |
1345-
{
1346-
"buildType": "https://github.com/actions/runner-images/",
1347-
"builder": {
1348-
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1349-
},
1350-
"invocation": {
1351-
"configSource": {
1352-
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1353-
"digest": {
1354-
"sha1": "${{ github.sha }}"
1355-
},
1356-
"entryPoint": ".github/workflows/ci.yaml"
1357-
},
1358-
"environment": {
1359-
"github_workflow": "${{ github.workflow }}",
1360-
"github_run_id": "${{ github.run_id }}"
1361-
}
1362-
},
1363-
"metadata": {
1364-
"buildInvocationID": "${{ github.run_id }}",
1365-
"completeness": {
1366-
"environment": true,
1367-
"materials": true
1368-
}
1369-
}
1370-
}
13711343
push-to-registry: true
13721344

13731345
- name: GitHub Attestation for Docker image (latest tag)
@@ -1378,34 +1350,6 @@ jobs:
13781350
with:
13791351
subject-name: ghcr.io/coder/coder-preview
13801352
subject-digest: ${{ steps.docker_digests.outputs.latest_digest }}
1381-
predicate-type: "https://slsa.dev/provenance/v1"
1382-
predicate: |
1383-
{
1384-
"buildType": "https://github.com/actions/runner-images/",
1385-
"builder": {
1386-
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1387-
},
1388-
"invocation": {
1389-
"configSource": {
1390-
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1391-
"digest": {
1392-
"sha1": "${{ github.sha }}"
1393-
},
1394-
"entryPoint": ".github/workflows/ci.yaml"
1395-
},
1396-
"environment": {
1397-
"github_workflow": "${{ github.workflow }}",
1398-
"github_run_id": "${{ github.run_id }}"
1399-
}
1400-
},
1401-
"metadata": {
1402-
"buildInvocationID": "${{ github.run_id }}",
1403-
"completeness": {
1404-
"environment": true,
1405-
"materials": true
1406-
}
1407-
}
1408-
}
14091353
push-to-registry: true
14101354

14111355
- name: GitHub Attestation for version-specific Docker image
@@ -1416,34 +1360,6 @@ jobs:
14161360
with:
14171361
subject-name: ghcr.io/coder/coder-preview
14181362
subject-digest: ${{ steps.docker_digests.outputs.version_digest }}
1419-
predicate-type: "https://slsa.dev/provenance/v1"
1420-
predicate: |
1421-
{
1422-
"buildType": "https://github.com/actions/runner-images/",
1423-
"builder": {
1424-
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
1425-
},
1426-
"invocation": {
1427-
"configSource": {
1428-
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
1429-
"digest": {
1430-
"sha1": "${{ github.sha }}"
1431-
},
1432-
"entryPoint": ".github/workflows/ci.yaml"
1433-
},
1434-
"environment": {
1435-
"github_workflow": "${{ github.workflow }}",
1436-
"github_run_id": "${{ github.run_id }}"
1437-
}
1438-
},
1439-
"metadata": {
1440-
"buildInvocationID": "${{ github.run_id }}",
1441-
"completeness": {
1442-
"environment": true,
1443-
"materials": true
1444-
}
1445-
}
1446-
}
14471363
push-to-registry: true
14481364

14491365
# Report attestation failures but don't fail the workflow

‎.github/workflows/release.yaml‎

Lines changed: 0 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -358,34 +358,6 @@ jobs:
358358
with:
359359
subject-name: ghcr.io/coder/coder-base
360360
subject-digest: ${{ steps.build_base_image.outputs.digest }}
361-
predicate-type: "https://slsa.dev/provenance/v1"
362-
predicate: |
363-
{
364-
"buildType": "https://github.com/actions/runner-images/",
365-
"builder": {
366-
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
367-
},
368-
"invocation": {
369-
"configSource": {
370-
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
371-
"digest": {
372-
"sha1": "${{ github.sha }}"
373-
},
374-
"entryPoint": ".github/workflows/release.yaml"
375-
},
376-
"environment": {
377-
"github_workflow": "${{ github.workflow }}",
378-
"github_run_id": "${{ github.run_id }}"
379-
}
380-
},
381-
"metadata": {
382-
"buildInvocationID": "${{ github.run_id }}",
383-
"completeness": {
384-
"environment": true,
385-
"materials": true
386-
}
387-
}
388-
}
389361
push-to-registry: true
390362

391363
- name: Build Linux Docker images
@@ -493,34 +465,6 @@ jobs:
493465
with:
494466
subject-name: ghcr.io/coder/coder
495467
subject-digest: ${{ steps.docker_digests.outputs.multiarch_digest }}
496-
predicate-type: "https://slsa.dev/provenance/v1"
497-
predicate: |
498-
{
499-
"buildType": "https://github.com/actions/runner-images/",
500-
"builder": {
501-
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
502-
},
503-
"invocation": {
504-
"configSource": {
505-
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
506-
"digest": {
507-
"sha1": "${{ github.sha }}"
508-
},
509-
"entryPoint": ".github/workflows/release.yaml"
510-
},
511-
"environment": {
512-
"github_workflow": "${{ github.workflow }}",
513-
"github_run_id": "${{ github.run_id }}"
514-
}
515-
},
516-
"metadata": {
517-
"buildInvocationID": "${{ github.run_id }}",
518-
"completeness": {
519-
"environment": true,
520-
"materials": true
521-
}
522-
}
523-
}
524468
push-to-registry: true
525469

526470
- name: GitHub Attestation for "latest" Docker image
@@ -531,34 +475,6 @@ jobs:
531475
with:
532476
subject-name: ghcr.io/coder/coder
533477
subject-digest: ${{ steps.docker_digests.outputs.latest_digest }}
534-
predicate-type: "https://slsa.dev/provenance/v1"
535-
predicate: |
536-
{
537-
"buildType": "https://github.com/actions/runner-images/",
538-
"builder": {
539-
"id": "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}"
540-
},
541-
"invocation": {
542-
"configSource": {
543-
"uri": "git+https://github.com/${{ github.repository }}@${{ github.ref }}",
544-
"digest": {
545-
"sha1": "${{ github.sha }}"
546-
},
547-
"entryPoint": ".github/workflows/release.yaml"
548-
},
549-
"environment": {
550-
"github_workflow": "${{ github.workflow }}",
551-
"github_run_id": "${{ github.run_id }}"
552-
}
553-
},
554-
"metadata": {
555-
"buildInvocationID": "${{ github.run_id }}",
556-
"completeness": {
557-
"environment": true,
558-
"materials": true
559-
}
560-
}
561-
}
562478
push-to-registry: true
563479

564480
# Report attestation failures but don't fail the workflow

0 commit comments

Comments
 (0)