|
| 1 | +# This workflow uses actions that are not certified by GitHub. |
| 2 | +# They are provided by a third-party and are governed by |
| 3 | +# separate terms of service, privacy policy, and support |
| 4 | +# documentation. |
| 5 | + |
| 6 | +# This workflow lets you generate SLSA provenance file for your project. |
| 7 | +# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements |
| 8 | +# The project is an initiative of the OpenSSF (openssf.org) and is developed at |
| 9 | +# https://github.com/slsa-framework/slsa-github-generator. |
| 10 | +# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier. |
| 11 | +# For more information about SLSA and how it improves the supply-chain, visit slsa.dev. |
| 12 | + |
| 13 | +name: SLSA generic generator |
| 14 | +on: |
| 15 | + workflow_dispatch: |
| 16 | + release: |
| 17 | + types: [created] |
| 18 | + |
| 19 | +jobs: |
| 20 | + build: |
| 21 | + runs-on: ubuntu-latest |
| 22 | + outputs: |
| 23 | + digests: ${{ steps.hash.outputs.digests }} |
| 24 | + |
| 25 | + steps: |
| 26 | + - uses: actions/checkout@v3 |
| 27 | + |
| 28 | + # ======================================================== |
| 29 | + # |
| 30 | + # Step 1: Build your artifacts. |
| 31 | + # |
| 32 | + # ======================================================== |
| 33 | + - name: Build artifacts |
| 34 | + run: | |
| 35 | + # These are some amazing artifacts. |
| 36 | + echo "artifact1" > artifact1 |
| 37 | + echo "artifact2" > artifact2 |
| 38 | + |
| 39 | + # ======================================================== |
| 40 | + # |
| 41 | + # Step 2: Add a step to generate the provenance subjects |
| 42 | + # as shown below. Update the sha256 sum arguments |
| 43 | + # to include all binaries that you generate |
| 44 | + # provenance for. |
| 45 | + # |
| 46 | + # ======================================================== |
| 47 | + - name: Generate subject for provenance |
| 48 | + id: hash |
| 49 | + run: | |
| 50 | + set -euo pipefail |
| 51 | + |
| 52 | + # List the artifacts the provenance will refer to. |
| 53 | + files=$(ls artifact*) |
| 54 | + # Generate the subjects (base64 encoded). |
| 55 | + echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" |
| 56 | + |
| 57 | + provenance: |
| 58 | + needs: [build] |
| 59 | + permissions: |
| 60 | + actions: read # To read the workflow path. |
| 61 | + id-token: write # To sign the provenance. |
| 62 | + contents: write # To add assets to a release. |
| 63 | + uses: slsa-framework/slsa-github-generator/.github/workflows/ [email protected] |
| 64 | + with: |
| 65 | + base64-subjects: "${{ needs.build.outputs.digests }}" |
| 66 | + upload-assets: true # Optional: Upload to a new release |
| 67 | + - name: Close Stale Issues |
| 68 | + |
| 69 | + with: |
| 70 | + # Token for the repository. Can be passed in using `{{ secrets.GITHUB_TOKEN }}`. |
| 71 | + repo-token: # optional, default is ${{ github.token }} |
| 72 | + # The message to post on the issue when tagging it. If none provided, will not mark issues stale. |
| 73 | + stale-issue-message: # optional |
| 74 | + # The message to post on the pull request when tagging it. If none provided, will not mark pull requests stale. |
| 75 | + stale-pr-message: # optional |
| 76 | + # The message to post on the issue when closing it. If none provided, will not comment when closing an issue. |
| 77 | + close-issue-message: # optional |
| 78 | + # The message to post on the pull request when closing it. If none provided, will not comment when closing a pull requests. |
| 79 | + close-pr-message: # optional |
| 80 | + # The number of days old an issue or a pull request can be before marking it stale. Set to -1 to never mark issues or pull requests as stale automatically. |
| 81 | + days-before-stale: # optional, default is 60 |
| 82 | + # The number of days old an issue can be before marking it stale. Set to -1 to never mark issues as stale automatically. Override "days-before-stale" option regarding only the issues. |
| 83 | + days-before-issue-stale: # optional |
| 84 | + # The number of days old a pull request can be before marking it stale. Set to -1 to never mark pull requests as stale automatically. Override "days-before-stale" option regarding only the pull requests. |
| 85 | + days-before-pr-stale: # optional |
| 86 | + # The number of days to wait to close an issue or a pull request after it being marked stale. Set to -1 to never close stale issues or pull requests. |
| 87 | + days-before-close: # optional, default is 7 |
| 88 | + # The number of days to wait to close an issue after it being marked stale. Set to -1 to never close stale issues. Override "days-before-close" option regarding only the issues. |
| 89 | + days-before-issue-close: # optional |
| 90 | + # The number of days to wait to close a pull request after it being marked stale. Set to -1 to never close stale pull requests. Override "days-before-close" option regarding only the pull requests. |
| 91 | + days-before-pr-close: # optional |
| 92 | + # The label to apply when an issue is stale. |
| 93 | + stale-issue-label: # optional, default is Stale |
| 94 | + # The label to apply when an issue is closed. |
| 95 | + close-issue-label: # optional |
| 96 | + # The labels that mean an issue is exempt from being marked stale. Separate multiple labels with commas (eg. "label1,label2"). |
| 97 | + exempt-issue-labels: # optional, default is |
| 98 | + # The label to apply when a pull request is stale. |
| 99 | + stale-pr-label: # optional, default is Stale |
| 100 | + # The label to apply when a pull request is closed. |
| 101 | + close-pr-label: # optional |
| 102 | + # The labels that mean a pull request is exempt from being marked as stale. Separate multiple labels with commas (eg. "label1,label2"). |
| 103 | + exempt-pr-labels: # optional, default is |
| 104 | + # The milestones that mean an issue or a pull request is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). |
| 105 | + exempt-milestones: # optional, default is |
| 106 | + # The milestones that mean an issue is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). Override "exempt-milestones" option regarding only the issues. |
| 107 | + exempt-issue-milestones: # optional, default is |
| 108 | + # The milestones that mean a pull request is exempt from being marked as stale. Separate multiple milestones with commas (eg. "milestone1,milestone2"). Override "exempt-milestones" option regarding only the pull requests. |
| 109 | + exempt-pr-milestones: # optional, default is |
| 110 | + # Exempt all issues and pull requests with milestones from being marked as stale. Default to false. |
| 111 | + exempt-all-milestones: # optional, default is false |
| 112 | + # Exempt all issues with milestones from being marked as stale. Override "exempt-all-milestones" option regarding only the issues. |
| 113 | + exempt-all-issue-milestones: # optional, default is |
| 114 | + # Exempt all pull requests with milestones from being marked as stale. Override "exempt-all-milestones" option regarding only the pull requests. |
| 115 | + exempt-all-pr-milestones: # optional, default is |
| 116 | + # Only issues or pull requests with all of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. |
| 117 | + only-labels: # optional, default is |
| 118 | + # Only issues or pull requests with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. |
| 119 | + any-of-labels: # optional, default is |
| 120 | + # Only issues with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. Override "any-of-labels" option regarding only the issues. |
| 121 | + any-of-issue-labels: # optional, default is |
| 122 | + # Only pull requests with at least one of these labels are checked if stale. Defaults to `` (disabled) and can be a comma-separated list of labels. Override "any-of-labels" option regarding only the pull requests. |
| 123 | + any-of-pr-labels: # optional, default is |
| 124 | + # Only issues with all of these labels are checked if stale. Defaults to `[]` (disabled) and can be a comma-separated list of labels. Override "only-labels" option regarding only the issues. |
| 125 | + only-issue-labels: # optional, default is |
| 126 | + # Only pull requests with all of these labels are checked if stale. Defaults to `[]` (disabled) and can be a comma-separated list of labels. Override "only-labels" option regarding only the pull requests. |
| 127 | + only-pr-labels: # optional, default is |
| 128 | + # The maximum number of operations per run, used to control rate limiting (GitHub API CRUD related). |
| 129 | + operations-per-run: # optional, default is 30 |
| 130 | + # Remove stale labels from issues and pull requests when they are updated or commented on. |
| 131 | + remove-stale-when-updated: # optional, default is true |
| 132 | + # Remove stale labels from issues when they are updated or commented on. Override "remove-stale-when-updated" option regarding only the issues. |
| 133 | + remove-issue-stale-when-updated: # optional, default is |
| 134 | + # Remove stale labels from pull requests when they are updated or commented on. Override "remove-stale-when-updated" option regarding only the pull requests. |
| 135 | + remove-pr-stale-when-updated: # optional, default is |
| 136 | + # Run the processor in debug mode without actually performing any operations on live issues. |
| 137 | + debug-only: # optional, default is false |
| 138 | + # The order to get issues or pull requests. Defaults to false, which is descending. |
| 139 | + ascending: # optional, default is false |
| 140 | + # Delete the git branch after closing a stale pull request. |
| 141 | + delete-branch: # optional, default is false |
| 142 | + # The date used to skip the stale action on issue/pull request created before it (ISO 8601 or RFC 2822). |
| 143 | + start-date: # optional, default is |
| 144 | + # The assignees which exempt an issue or a pull request from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). |
| 145 | + exempt-assignees: # optional, default is |
| 146 | + # The assignees which exempt an issue from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). Override "exempt-assignees" option regarding only the issues. |
| 147 | + exempt-issue-assignees: # optional, default is |
| 148 | + # The assignees which exempt a pull request from being marked as stale. Separate multiple assignees with commas (eg. "user1,user2"). Override "exempt-assignees" option regarding only the pull requests. |
| 149 | + exempt-pr-assignees: # optional, default is |
| 150 | + # Exempt all issues and pull requests with assignees from being marked as stale. Default to false. |
| 151 | + exempt-all-assignees: # optional, default is false |
| 152 | + # Exempt all issues with assignees from being marked as stale. Override "exempt-all-assignees" option regarding only the issues. |
| 153 | + exempt-all-issue-assignees: # optional, default is |
| 154 | + # Exempt all pull requests with assignees from being marked as stale. Override "exempt-all-assignees" option regarding only the pull requests. |
| 155 | + exempt-all-pr-assignees: # optional, default is |
| 156 | + # Exempt draft pull requests from being marked as stale. Default to false. |
| 157 | + exempt-draft-pr: # optional, default is false |
| 158 | + # Display some statistics at the end regarding the stale workflow (only when the logs are enabled). |
| 159 | + enable-statistics: # optional, default is true |
| 160 | + # A comma delimited list of labels to add when a stale issue or pull request receives activity and has the stale-issue-label or stale-pr-label removed from it. |
| 161 | + labels-to-add-when-unstale: # optional, default is |
| 162 | + # A comma delimited list of labels to remove when a stale issue or pull request receives activity and has the stale-issue-label or stale-pr-label removed from it. |
| 163 | + labels-to-remove-when-unstale: # optional, default is |
| 164 | + # Any update (update/comment) can reset the stale idle time on the issues and pull requests. |
| 165 | + ignore-updates: # optional, default is false |
| 166 | + # Any update (update/comment) can reset the stale idle time on the issues. Override "ignore-updates" option regarding only the issues. |
| 167 | + ignore-issue-updates: # optional, default is |
| 168 | + # Any update (update/comment) can reset the stale idle time on the pull requests. Override "ignore-updates" option regarding only the pull requests. |
| 169 | + ignore-pr-updates: # optional, default is |
| 170 | + |
0 commit comments