Compare commits
3 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
082274a94f | ||
|
|
0f48753020 | ||
|
|
96830cdd3b |
16
RELEASE.md
Normal file
16
RELEASE.md
Normal file
@@ -0,0 +1,16 @@
|
||||
# Release Instructions
|
||||
|
||||
Follow the steps below to tag a new release for the `actions/attest` action.
|
||||
|
||||
1. Merge the latest changes to the `main` branch.
|
||||
1. Create a new release using a tag of the form `vX.X.X` following SemVer
|
||||
conventions:
|
||||
|
||||
```shell
|
||||
gh release create vX.X.X
|
||||
```
|
||||
|
||||
1. As appropriate, update any actions like
|
||||
[`actions/attest-build-provenance`](https://github.com/actions/attest-build-provenance)
|
||||
and [`actions/attest-sbom`](https://github.com/actions/attest-sbom) which
|
||||
have a dependency on `actions/attest`
|
||||
34
dist/index.js
generated
vendored
34
dist/index.js
generated
vendored
@@ -11349,7 +11349,7 @@ const constants_1 = __nccwpck_require__(1319);
|
||||
const error_1 = __nccwpck_require__(64);
|
||||
const registry_1 = __nccwpck_require__(7464);
|
||||
const EMPTY_BLOB = Buffer.from('{}');
|
||||
const DOWNGRADE_REGISTRIES = ['docker.io', 'amazonaws.com'];
|
||||
const DOWNGRADE_REGISTRIES = ['amazonaws.com'];
|
||||
class OCIImage {
|
||||
constructor(image, creds, opts) {
|
||||
_OCIImage_instances.add(this);
|
||||
@@ -11389,15 +11389,12 @@ class OCIImage {
|
||||
});
|
||||
/* istanbul ignore if */
|
||||
if (__classPrivateFieldGet(this, _OCIImage_downgrade, "f")) {
|
||||
delete manifest.subject;
|
||||
delete manifest.artifactType;
|
||||
// ECR can't handle media types with parameters, so we need to strip the
|
||||
// version parameter from the Sigstore bundle media type.
|
||||
manifest.artifactType = manifest.artifactType
|
||||
? manifest.artifactType.replace(/;.*/, '')
|
||||
: undefined;
|
||||
manifest.layers[0].mediaType = manifest.layers[0].mediaType.replace(/;.*/, '');
|
||||
// ECR can't handle the "application/vnd.oci.empty.v1+json" media type
|
||||
// for the config blob defined in OCI 1.1, so we need to use the Docker
|
||||
// V2 API media type
|
||||
manifest.config.mediaType = 'application/vnd.oci.image.config.v1+json';
|
||||
}
|
||||
// Upload artifact manifest
|
||||
artifactDescriptor = await __classPrivateFieldGet(this, _OCIImage_client, "f").uploadManifest(JSON.stringify(manifest));
|
||||
@@ -11423,6 +11420,21 @@ class OCIImage {
|
||||
}
|
||||
return artifactDescriptor;
|
||||
}
|
||||
async getDigest(tag) {
|
||||
try {
|
||||
if (__classPrivateFieldGet(this, _OCIImage_credentials, "f")) {
|
||||
await __classPrivateFieldGet(this, _OCIImage_client, "f").signIn(__classPrivateFieldGet(this, _OCIImage_credentials, "f"));
|
||||
}
|
||||
const imageDescriptor = await __classPrivateFieldGet(this, _OCIImage_client, "f").checkManifest(tag);
|
||||
return imageDescriptor.digest;
|
||||
}
|
||||
catch (err) {
|
||||
throw new error_1.OCIError({
|
||||
message: `Error retrieving image digest from container registry`,
|
||||
cause: err,
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
exports.OCIImage = OCIImage;
|
||||
_OCIImage_client = new WeakMap(), _OCIImage_credentials = new WeakMap(), _OCIImage_downgrade = new WeakMap(), _OCIImage_instances = new WeakSet(), _OCIImage_createReferrersIndexByTag =
|
||||
@@ -11495,7 +11507,7 @@ const digestToTag = (digest) => {
|
||||
"use strict";
|
||||
|
||||
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
||||
exports.attachArtifactToImage = exports.OCIError = exports.getRegistryCredentials = void 0;
|
||||
exports.getImageDigest = exports.attachArtifactToImage = exports.OCIError = exports.getRegistryCredentials = void 0;
|
||||
const image_1 = __nccwpck_require__(9539);
|
||||
const name_1 = __nccwpck_require__(4520);
|
||||
var credentials_1 = __nccwpck_require__(5475);
|
||||
@@ -11510,6 +11522,12 @@ const attachArtifactToImage = async (opts) => {
|
||||
return new image_1.OCIImage(image, opts.credentials, opts.fetchOpts).addArtifact(opts);
|
||||
};
|
||||
exports.attachArtifactToImage = attachArtifactToImage;
|
||||
// Returns the digest of the given image tag in the remote registry.
|
||||
const getImageDigest = async (opts) => {
|
||||
const image = (0, name_1.parseImageName)(opts.imageName);
|
||||
return new image_1.OCIImage(image, opts.credentials, opts.fetchOpts).getDigest(opts.imageTag);
|
||||
};
|
||||
exports.getImageDigest = getImageDigest;
|
||||
|
||||
|
||||
/***/ }),
|
||||
|
||||
2759
package-lock.json
generated
2759
package-lock.json
generated
File diff suppressed because it is too large
Load Diff
13
package.json
13
package.json
@@ -73,18 +73,19 @@
|
||||
"@actions/attest": "^1.0.0",
|
||||
"@actions/core": "^1.10.1",
|
||||
"@actions/glob": "^0.4.0",
|
||||
"@sigstore/oci": "^0.1.0"
|
||||
"@sigstore/oci": "^0.2.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@sigstore/mock": "^0.6.5",
|
||||
"@sigstore/mock": "^0.7.0",
|
||||
"@types/jest": "^29.5.12",
|
||||
"@types/make-fetch-happen": "^10.0.4",
|
||||
"@types/node": "^20.11.24",
|
||||
"@typescript-eslint/parser": "^6.21.0",
|
||||
"@types/node": "^20.11.26",
|
||||
"@typescript-eslint/eslint-plugin": "^7.2.0",
|
||||
"@typescript-eslint/parser": "^7.2.0",
|
||||
"@vercel/ncc": "^0.38.1",
|
||||
"eslint": "^8.57.0",
|
||||
"eslint-plugin-github": "^4.10.2",
|
||||
"eslint-plugin-jest": "^27.8.0",
|
||||
"eslint-plugin-jest": "^27.9.0",
|
||||
"eslint-plugin-jsonc": "^2.13.0",
|
||||
"eslint-plugin-prettier": "^5.1.3",
|
||||
"jest": "^29.7.0",
|
||||
@@ -94,6 +95,6 @@
|
||||
"prettier": "^3.2.5",
|
||||
"prettier-eslint": "^16.3.0",
|
||||
"ts-jest": "^29.1.2",
|
||||
"typescript": "^5.3.3"
|
||||
"typescript": "^5.4.2"
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,59 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
# About:
|
||||
#
|
||||
# This is a helper script to tag and push a new release. GitHub Actions use
|
||||
# release tags to allow users to select a specific version of the action to use.
|
||||
#
|
||||
# See: https://github.com/actions/typescript-action#publishing-a-new-release
|
||||
#
|
||||
# This script will do the following:
|
||||
#
|
||||
# 1. Get the latest release tag
|
||||
# 2. Prompt the user for a new release tag
|
||||
# 3. Tag the new release
|
||||
# 4. Push the new tag to the remote
|
||||
#
|
||||
# Usage:
|
||||
#
|
||||
# script/release
|
||||
|
||||
# Terminal colors
|
||||
OFF='\033[0m'
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
BLUE='\033[0;34m'
|
||||
|
||||
# Get the latest release tag
|
||||
latest_tag=$(git describe --tags "$(git rev-list --tags --max-count=1)")
|
||||
|
||||
if [[ -z "$latest_tag" ]]; then
|
||||
# There are no existing release tags
|
||||
echo -e "No tags found (yet) - Continue to create and push your first tag"
|
||||
latest_tag="[unknown]"
|
||||
fi
|
||||
|
||||
# Display the latest release tag
|
||||
echo -e "The latest release tag is: ${BLUE}${latest_tag}${OFF}"
|
||||
|
||||
# Prompt the user for the new release tag
|
||||
read -r -p 'Enter a new release tag (vX.X.X format): ' new_tag
|
||||
|
||||
# Validate the new release tag
|
||||
tag_regex='v[0-9]+\.[0-9]+\.[0-9]+$'
|
||||
if echo "$new_tag" | grep -q -E "$tag_regex"; then
|
||||
echo -e "Tag: ${BLUE}$new_tag${OFF} is valid"
|
||||
else
|
||||
# Release tag is not `vX.X.X` format
|
||||
echo -e "Tag: ${BLUE}$new_tag${OFF} is ${RED}not valid${OFF} (must be in vX.X.X format)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Tag the new release
|
||||
git tag -a "$new_tag" -m "$new_tag Release"
|
||||
echo -e "${GREEN}Tagged: $new_tag${OFF}"
|
||||
|
||||
# Push the new tag to the remote
|
||||
git push --tags
|
||||
echo -e "${GREEN}Release tag pushed to remote${OFF}"
|
||||
echo -e "${GREEN}Done!${OFF}"
|
||||
Reference in New Issue
Block a user