Create go-ossf-slsa3-publish.yml #768
Conversation
Signed-off-by: JohnDaWalka <201526231+JohnDaWalka@users.noreply.github.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull Request Overview
This PR introduces a new GitHub Actions workflow for building Go projects with SLSA Level 3 compliance to enhance supply chain security. The workflow generates provenance files that document the build process, leveraging the OpenSSF slsa-framework/slsa-github-generator.
- Adds SLSA3-compliant build workflow for Go projects
- Configures automatic triggering on releases and manual dispatch
- Sets up proper permissions for signing and uploading artifacts
| actions: read # To read workflow path. | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.8.0 | ||
| with: | ||
| go-version: 1.22 |
There was a problem hiding this comment.
The Go version 1.22 specified here conflicts with the Go version 1.17 mentioned in the PR description. Consider verifying which version is intended and updating either the workflow or the description for consistency.
| go-version: 1.22 | |
| go-version: 1.17 |
Copilot uses AI. Check for mistakes.
This pull request introduces a new GitHub Actions workflow for building Go projects using a SLSA3-compliant builder. The workflow is designed to enhance supply chain security by generating a provenance file that describes the steps taken to produce the final binary.
New GitHub Actions Workflow:
.github/workflows/go-ossf-slsa3-publish.yml: Added a workflow named "SLSA Go releaser" to compile Go projects with a SLSA3-compliant builder. This includes generating a provenance file for enhanced supply chain security, leveraging the OpenSSF initiative. The workflow uses theslsa-framework/slsa-github-generatorand supports Go version 1.17.<!--Thank you for contributing to GitHub MCP Server!
Please reference an existing issue:
Closes #NUMBERScreenshots or videos of changed behavior is incredibly helpful and always appreciated.
Consider addressing the following:
-->
Closes: