Bump @actions/attest from 1.3.1 to 1.4.1 (#127)

Signed-off-by: Brian DeHamer <bdehamer@github.com>

.github/linters/.eslintrc.yml

@@ -41,6 +41,7 @@ rules:
     'eslint-comments/no-unused-disable': 'off',
     'i18n-text/no-en': 'off',
     'import/no-namespace': 'off',
+    'import/no-unresolved': ['error', { 'ignore': ['csv-parse/sync'] }],
     'no-console': 'off',
     'no-unused-vars': 'off',
     'prettier/prettier': 'error',

.github/workflows/ci.yml

@@ -50,7 +50,8 @@ jobs:
     name: Test attest action
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: read
+      attestations: write
       id-token: write
     env:
       SUBJECT: /repos/${{ github.repository }}/tarball/${{ github.sha }}

.github/workflows/linter.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Lint Codebase
         id: super-linter
-        uses: super-linter/super-linter/slim@v6
+        uses: super-linter/super-linter/slim@v7
         env:
           DEFAULT_BRANCH: main
           FILTER_REGEX_EXCLUDE: dist/**/*
@@ -46,4 +46,5 @@ jobs:
           TYPESCRIPT_DEFAULT_STYLE: prettier
           VALIDATE_ALL_CODEBASE: true
           VALIDATE_JAVASCRIPT_STANDARD: false
+          VALIDATE_TYPESCRIPT_STANDARD: false
           VALIDATE_JSCPD: false

README.md

@@ -18,9 +18,12 @@ Once the attestation has been created and signed, it will be uploaded to the GH
 attestations API and associated with the repository from which the workflow was
 initiated.
 
-Attestations can be verified using the `attestation` command in the [GitHub
+Attestations can be verified using the [`attestation` command in the GitHub
 CLI][5].
 
+See [Using artifact attestations to establish provenance for builds][9] for more
+information on artifact attestations.
+
 ## Usage
 
 Within the GitHub Actions workflow which builds some artifact you would like to
@@ -31,11 +34,11 @@ attest:
    ```yaml
    permissions:
      id-token: write
-     contents: write # TODO: Update this
+     attestations: write
    ```
 
    The `id-token` permission gives the action the ability to mint the OIDC token
-   necessary to request a Sigstore signing certificate. The `contents`
+   necessary to request a Sigstore signing certificate. The `attestations`
    permission is necessary to persist the attestation.
 
 1. Add the following to your workflow after your artifact has been built:
@@ -48,7 +51,7 @@ attest:
        predicate-path: '<PATH TO PREDICATE>'
    ```
 
-   The `subject-path` parameter should identity the artifact for which you want
+   The `subject-path` parameter should identify the artifact for which you want
    to generate an attestation. The `predicate-type` can be any of the the
    [vetted predicate types][3] or a custom value. The `predicate-path`
    identifies a file containg the JSON-encoded predicate parameters.
@@ -61,10 +64,11 @@ See [action.yml](action.yml)
 - uses: actions/attest@v1
   with:
     # Path to the artifact serving as the subject of the attestation. Must
-    # specify exactly one of "subject-path" or "subject-digest".
+    # specify exactly one of "subject-path" or "subject-digest". May contain
+    # a glob pattern or list of paths (total subject count cannot exceed 2500).
     subject-path:
 
-    # SHA256 digest of the subject for for the attestation. Must be in the form
+    # SHA256 digest of the subject for the attestation. Must be in the form
     # "sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one
     # of "subject-path" or "subject-digest".
     subject-digest:
@@ -77,12 +81,14 @@ See [action.yml](action.yml)
     # URI identifying the type of the predicate.
     predicate-type:
 
-    # JSON string containing the value for the attestation predicate. Must
-    # supply exactly one of "predicate-path" or "predicate".
+    # String containing the value for the attestation predicate. String length
+    # cannot exceed 16MB. Must supply exactly one of "predicate-path" or
+    # "predicate".
     predicate:
 
-    # Path to the file which contains the JSON content for the attestation
-    # predicate. Must supply exactly one of "predicate-path" or "predicate".
+    # Path to the file which contains the content for the attestation predicate.
+    # File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
+    # or "predicate".
     predicate-path:
 
     # Whether to push the attestation to the image registry. Requires that the
@@ -90,6 +96,10 @@ See [action.yml](action.yml)
     # the "subject-digest" parameter be specified. Defaults to false.
     push-to-registry:
 
+    # Whether to attach a list of generated attestations to the workflow run
+    # summary page. Defaults to true.
+    show-summary:
+
     # The GitHub token used to make authenticated API requests. Default is
     # ${{ github.token }}
     github-token:
@@ -111,6 +121,20 @@ If multiple subjects are being attested at the same time, each attestation will
 be written to the output file on a separate line (using the [JSON Lines][7]
 format).
 
+## Attestation Limits
+
+### Subject Limits
+
+No more than 2500 subjects can be attested at the same time. Subjects will be
+processed in batches 50. After the initial group of 50, each subsequent batch
+will incur an exponentially increasing amount of delay (capped at 1 minute of
+delay per batch) to avoid overwhelming the attestation API.
+
+### Predicate Limits
+
+Whether supplied via the `predicate` or `predicatePath` input, the predicate
+string cannot exceed 16MB.
+
 ## Examples
 
 ### Identify Subject by Path
@@ -128,7 +152,8 @@ jobs:
   build:
     permissions:
       id-token: write
-      contents: write
+      contents: read
+      attestations: write
 
     steps:
       - name: Checkout
@@ -143,7 +168,7 @@ jobs:
           predicate: '{}'
 ```
 
-### Identify Subjects by Wildcard
+### Identify Multiple Subjects
 
 If you are generating multiple artifacts, you can generate an attestation for
 each by using a wildcard in the `subject-path` input.
@@ -159,6 +184,23 @@ each by using a wildcard in the `subject-path` input.
 For supported wildcards along with behavior and documentation, see
 [@actions/glob][8] which is used internally to search for files.
 
+Alternatively, you can explicitly list multiple subjects with either a comma or
+newline delimited list:
+
+```yaml
+- uses: actions/attest@v1
+  with:
+    subject-path: 'dist/foo, dist/bar'
+```
+
+```yaml
+- uses: actions/attest@v1
+  with:
+    subject-path: |
+      dist/foo
+      dist/bar
+```
+
 ### Container Image
 
 When working with container images you can invoke the action with the
@@ -170,8 +212,8 @@ fully-qualified image name (e.g. "ghcr.io/user/app" or
 "acme.azurecr.io/user/app"). Do NOT include a tag as part of the image name --
 the specific image being attested is identified by the supplied digest.
 
-> **NOTE**: When pushing to Docker Hub, please use "index.docker.io" as the
-> registry portion of the image name.
+> **NOTE**: When pushing to Docker Hub, please use "docker.io" as the registry
+> portion of the image name.
 
 ```yaml
 name: build-attested-image
@@ -186,7 +228,8 @@ jobs:
     permissions:
       id-token: write
       packages: write
-      contents: write
+      contents: read
+      attestations: write
     env:
       REGISTRY: ghcr.io
       IMAGE_NAME: ${{ github.repository }}
@@ -223,8 +266,10 @@ jobs:
 [3]:
   https://github.com/in-toto/attestation/tree/main/spec/predicates#in-toto-attestation-predicates
 [4]: https://www.sigstore.dev/
-[5]: https://cli.github.com/
+[5]: https://cli.github.com/manual/gh_attestation_verify
 [6]:
   https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto
 [7]: https://jsonlines.org/
 [8]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns
+[9]:
+  https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds

RELEASE.md

@@ -2,6 +2,7 @@
 
 Follow the steps below to tag a new release for the `actions/attest` action.
 
+1. Update the `version` field in package.json.
 1. Merge the latest changes to the `main` branch.
 1. Create a new release using a tag of the form `vX.X.X` following SemVer
    conventions:
@@ -10,6 +11,14 @@ Follow the steps below to tag a new release for the `actions/attest` action.
    gh release create vX.X.X
    ```
 
+1. Move (or create) the major version tag to point to the same commit tagged
+   above:
+
+   ```shell
+   git tag -fa vX -m "vX"
+   git push origin vX --force
+   ```
+
 1. As appropriate, update any actions like
    [`actions/attest-build-provenance`](https://github.com/actions/attest-build-provenance)
    and [`actions/attest-sbom`](https://github.com/actions/attest-sbom) which

__tests__/index.test.ts

@@ -2,12 +2,17 @@
  * Unit tests for the action's entrypoint, src/index.ts
  */
 
+import * as core from '@actions/core'
 import * as main from '../src/main'
 
 // Mock the action's entrypoint
 const runMock = jest.spyOn(main, 'run').mockImplementation()
+const getBooleanInputMock = jest.spyOn(core, 'getBooleanInput')
 
 describe('index', () => {
+  beforeEach(() => {
+    getBooleanInputMock.mockImplementation(() => false)
+  })
   it('calls run when imported', async () => {
     // eslint-disable-next-line @typescript-eslint/no-require-imports
     require('../src/index')

__tests__/main.test.ts

@@ -5,20 +5,21 @@
  * Specifically, the inputs listed in `action.yml` should be set as environment
  * variables following the pattern `INPUT_<INPUT_NAME>`.
  */
-
 import * as core from '@actions/core'
 import * as github from '@actions/github'
 import { mockFulcio, mockRekor, mockTSA } from '@sigstore/mock'
 import * as oci from '@sigstore/oci'
+import fs from 'fs/promises'
 import nock from 'nock'
+import os from 'os'
+import path from 'path'
+import { MockAgent, setGlobalDispatcher } from 'undici'
 import { SEARCH_PUBLIC_GOOD_URL } from '../src/endpoints'
 import * as main from '../src/main'
 
 // Mock the GitHub Actions core library
 const infoMock = jest.spyOn(core, 'info')
 const startGroupMock = jest.spyOn(core, 'startGroup')
-const getInputMock = jest.spyOn(core, 'getInput')
-const getBooleanInputMock = jest.spyOn(core, 'getBooleanInput')
 const setOutputMock = jest.spyOn(core, 'setOutput')
 const setFailedMock = jest.spyOn(core, 'setFailed')
 
@@ -31,12 +32,33 @@ summaryWriteMock.mockImplementation(async () => Promise.resolve(core.summary))
 // Mock the action's main function
 const runMock = jest.spyOn(main, 'run')
 
+// MockAgent for mocking @actions/github
+const mockAgent = new MockAgent()
+setGlobalDispatcher(mockAgent)
+
+const defaultInputs: main.RunInputs = {
+  predicate: '',
+  predicateType: '',
+  predicatePath: '',
+  subjectName: '',
+  subjectDigest: '',
+  subjectPath: '',
+  pushToRegistry: false,
+  showSummary: true,
+  githubToken: '',
+  privateSigning: false,
+  batchSize: 50
+}
+
 describe('action', () => {
   // Capture original environment variables and GitHub context so we can restore
   // them after each test
   const originalEnv = process.env
   const originalContext = { ...github.context }
 
+  // Mock OIDC token endpoint
+  const tokenURL = 'https://token.url'
+
   // Fake an OIDC token
   const oidcSubject = 'foo@bar.com'
   const oidcPayload = { sub: oidcSubject, iss: '' }
@@ -55,16 +77,17 @@ describe('action', () => {
   beforeEach(() => {
     jest.clearAllMocks()
 
-    // Mock OIDC token endpoint
-    const tokenURL = 'https://token.url'
-
     nock(tokenURL)
       .get('/')
       .query({ audience: 'sigstore' })
       .reply(200, { value: oidcToken })
 
-    nock('https://api.github.com')
-      .post(/^\/repos\/.*\/.*\/attestations$/)
+    mockAgent
+      .get('https://api.github.com')
+      .intercept({
+        path: /^\/repos\/.*\/.*\/attestations$/,
+        method: 'post'
+      })
       .reply(201, { id: attestationID })
 
     process.env = {
@@ -84,56 +107,51 @@ describe('action', () => {
   })
 
   describe('when ACTIONS_ID_TOKEN_REQUEST_URL is not set', () => {
-    const inputs = {
-      'subject-digest': subjectDigest,
-      'subject-name': subjectName,
-      'predicate-type': predicateType,
+    const inputs: main.RunInputs = {
+      ...defaultInputs,
+      subjectDigest,
+      subjectName,
+      predicateType,
       predicate,
-      'github-token': 'gh-token'
+      githubToken: 'gh-token'
     }
 
     beforeEach(() => {
       // Nullify the OIDC token URL
       process.env.ACTIONS_ID_TOKEN_REQUEST_URL = ''
-
-      getInputMock.mockImplementation(mockInput(inputs))
-      getBooleanInputMock.mockImplementation(() => false)
     })
 
     it('sets a failed status', async () => {
-      await main.run()
+      await main.run(inputs)
 
       expect(runMock).toHaveReturned()
       expect(setFailedMock).toHaveBeenCalledWith(
-        expect.stringMatching(/missing "id-token" permission/)
-      )
-    })
-  })
-
-  describe('when no inputs are provided', () => {
-    beforeEach(() => {
-      getInputMock.mockImplementation(() => '')
-    })
-
-    it('sets a failed status', async () => {
-      await main.run()
-
-      expect(runMock).toHaveReturned()
-      expect(setFailedMock).toHaveBeenCalledWith(
-        expect.stringMatching(
-          /one of subject-path or subject-digest must be provided/i
+        new Error(
+          'missing "id-token" permission. Please add "permissions: id-token: write" to your workflow.'
         )
       )
     })
   })
 
+  describe('when no inputs are provided', () => {
+    it('sets a failed status', async () => {
+      await main.run(defaultInputs)
+
+      expect(runMock).toHaveReturned()
+      expect(setFailedMock).toHaveBeenCalledWith(
+        new Error('One of subject-path or subject-digest must be provided')
+      )
+    })
+  })
+
   describe('when the repository is private', () => {
-    const inputs = {
-      'subject-digest': subjectDigest,
-      'subject-name': subjectName,
-      'predicate-type': predicateType,
+    const inputs: main.RunInputs = {
+      ...defaultInputs,
+      subjectDigest,
+      subjectName,
+      predicateType,
       predicate,
-      'github-token': 'gh-token'
+      githubToken: 'gh-token'
     }
 
     beforeEach(async () => {
@@ -143,9 +161,6 @@ describe('action', () => {
         repo: { owner: 'foo', repo: 'bar' }
       })
 
-      getInputMock.mockImplementation(mockInput(inputs))
-      getBooleanInputMock.mockImplementation(() => false)
-
       await mockFulcio({
         baseURL: 'https://fulcio.githubapp.com',
         strict: false
@@ -154,7 +169,7 @@ describe('action', () => {
     })
 
     it('invokes the action w/o error', async () => {
-      await main.run()
+      await main.run(inputs)
 
       expect(runMock).toHaveReturned()
       expect(setFailedMock).not.toHaveBeenCalledWith()
@@ -193,12 +208,14 @@ describe('action', () => {
     const getRegCredsSpy = jest.spyOn(oci, 'getRegistryCredentials')
     const attachArtifactSpy = jest.spyOn(oci, 'attachArtifactToImage')
 
-    const inputs = {
-      'subject-digest': subjectDigest,
-      'subject-name': subjectName,
-      'predicate-type': predicateType,
+    const inputs: main.RunInputs = {
+      ...defaultInputs,
+      subjectDigest,
+      subjectName,
+      predicateType,
       predicate,
-      'github-token': 'gh-token'
+      githubToken: 'gh-token',
+      pushToRegistry: true
     }
 
     beforeEach(async () => {
@@ -208,11 +225,6 @@ describe('action', () => {
         repo: { owner: 'foo', repo: 'bar' }
       })
 
-      // Mock the action's inputs
-      getInputMock.mockImplementation(mockInput(inputs))
-      // This is where we mock the push-to-registry input
-      getBooleanInputMock.mockImplementation(() => true)
-
       await mockFulcio({
         baseURL: 'https://fulcio.sigstore.dev',
         strict: false
@@ -233,7 +245,7 @@ describe('action', () => {
     })
 
     it('invokes the action w/o error', async () => {
-      await main.run()
+      await main.run(inputs)
 
       expect(runMock).toHaveReturned()
       expect(setFailedMock).not.toHaveBeenCalled()
@@ -277,16 +289,142 @@ describe('action', () => {
       expect(setFailedMock).not.toHaveBeenCalled()
     })
   })
-})
 
-function mockInput(inputs: Record<string, string>): typeof core.getInput {
-  return (name: string): string => {
-    if (name in inputs) {
-      return inputs[name]
-    }
-    return ''
-  }
-}
+  describe('when the subject count exceeds the batch size', () => {
+    let dir = ''
+    const filename = 'subject'
+    let scope: nock.Scope
+
+    beforeEach(async () => {
+      // Start from scratch
+      nock.cleanAll()
+
+      const subjectCount = 5
+      const content = 'file content'
+
+      // Set-up temp directory
+      const tmpDir = await fs.realpath(os.tmpdir())
+      dir = await fs.mkdtemp(tmpDir + path.sep)
+
+      // Add files for glob testing
+      for (let i = 0; i < subjectCount; i++) {
+        await fs.writeFile(path.join(dir, `${filename}-${i}`), content)
+
+        // Set-up a Fulcio mock for each subject
+        await mockFulcio({
+          baseURL: 'https://fulcio.githubapp.com',
+          strict: false
+        })
+
+        // Set-up a TSA mock for each subject
+        await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
+
+        // Set-up a GH API mock for each subject
+        mockAgent
+          .get('https://api.github.com')
+          .intercept({
+            path: /^\/repos\/.*\/.*\/attestations$/,
+            method: 'post'
+          })
+          .reply(201, { id: attestationID })
+      }
+
+      // Set-up a OIDC token mock for each subject
+      scope = nock(tokenURL)
+        .get('/')
+        .query({ audience: 'sigstore' })
+        .times(subjectCount)
+        .reply(200, { value: oidcToken })
+
+      // Set the GH context with private repository visibility and a repo owner.
+      setGHContext({
+        payload: { repository: { visibility: 'private' } },
+        repo: { owner: 'foo', repo: 'bar' }
+      })
+    })
+
+    afterEach(async () => {
+      // Clean-up temp directory
+      await fs.rm(dir, { recursive: true })
+    })
+
+    it('invokes the action w/o error', async () => {
+      const inputs: main.RunInputs = {
+        ...defaultInputs,
+        subjectPath: path.join(dir, `${filename}-*`),
+        predicateType,
+        predicate,
+        githubToken: 'gh-token',
+        batchSize: 2
+      }
+      await main.run(inputs)
+
+      expect(runMock).toHaveReturned()
+      expect(setFailedMock).not.toHaveBeenCalled()
+      expect(infoMock).toHaveBeenNthCalledWith(
+        1,
+        expect.stringMatching('Processing subject batch 1/3')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        10,
+        expect.stringMatching('Processing subject batch 2/3')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        19,
+        expect.stringMatching('Processing subject batch 3/3')
+      )
+      expect(scope.isDone()).toBe(true)
+    })
+  })
+
+  describe('when the subject count exceeds the max', () => {
+    let dir = ''
+    const filename = 'subject'
+
+    beforeEach(async () => {
+      const subjectCount = 2501
+      const content = 'file content'
+
+      // Set-up temp directory
+      const tmpDir = await fs.realpath(os.tmpdir())
+      dir = await fs.mkdtemp(tmpDir + path.sep)
+
+      // Add files for glob testing
+      for (let i = 0; i < subjectCount; i++) {
+        await fs.writeFile(path.join(dir, `${filename}-${i}`), content)
+      }
+
+      // Set the GH context with private repository visibility and a repo owner.
+      setGHContext({
+        payload: { repository: { visibility: 'private' } },
+        repo: { owner: 'foo', repo: 'bar' }
+      })
+    })
+
+    afterEach(async () => {
+      // Clean-up temp directory
+      await fs.rm(dir, { recursive: true })
+    })
+
+    it('sets a failed status', async () => {
+      const inputs: main.RunInputs = {
+        ...defaultInputs,
+        subjectPath: path.join(dir, `${filename}-*`),
+        predicateType,
+        predicate,
+        githubToken: 'gh-token'
+      }
+      await main.run(inputs)
+
+      expect(runMock).toHaveReturned()
+      expect(setFailedMock).toHaveBeenCalledWith(
+        new Error(
+          'Too many subjects specified. The maximum number of subjects is 2500.'
+        )
+      )
+    })
+  })
+})
 
 // Stubbing the GitHub context is a bit tricky. We need to use
 // `Object.defineProperty` because `github.context` is read-only.

__tests__/predicate.test.ts

@@ -1,92 +1,129 @@
 import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'
-import { predicateFromInputs } from '../src/predicate'
+import { predicateFromInputs, PredicateInputs } from '../src/predicate'
 
 describe('subjectFromInputs', () => {
-  afterEach(() => {
-    process.env['INPUT_PREDICATE'] = ''
-    process.env['INPUT_PREDICATE-PATH'] = ''
-    process.env['INPUT_PREDICATE-TYPE'] = ''
-  })
+  const blankInputs: PredicateInputs = {
+    predicateType: '',
+    predicate: '',
+    predicatePath: ''
+  }
 
   describe('when no inputs are provided', () => {
     it('throws an error', () => {
-      expect(() => predicateFromInputs()).toThrow(/predicate-type/i)
+      expect(() => predicateFromInputs(blankInputs)).toThrow(/predicate-type/i)
     })
   })
 
   describe('when neither predicate path nor predicate are provided', () => {
-    beforeEach(() => {
-      process.env['INPUT_PREDICATE-TYPE'] = 'https://example.com/predicate'
-    })
-
     it('throws an error', () => {
-      expect(() => predicateFromInputs()).toThrow(
+      const inputs: PredicateInputs = {
+        ...blankInputs,
+        predicateType: 'https://example.com/predicate'
+      }
+
+      expect(() => predicateFromInputs(inputs)).toThrow(
         /one of predicate-path or predicate must be provided/i
       )
     })
   })
 
   describe('when both predicate path and predicate are provided', () => {
-    beforeEach(() => {
-      process.env['INPUT_PREDICATE-PATH'] = 'path/to/predicate'
-      process.env['INPUT_PREDICATE'] = '{}'
-      process.env['INPUT_PREDICATE-TYPE'] = 'https://example.com/predicate'
-    })
-
     it('throws an error', () => {
-      expect(() => predicateFromInputs()).toThrow(
+      const inputs: PredicateInputs = {
+        predicateType: 'https://example.com/predicate',
+        predicate: '{}',
+        predicatePath: 'path/to/predicate'
+      }
+
+      expect(() => predicateFromInputs(inputs)).toThrow(
         /only one of predicate-path or predicate may be provided/i
       )
     })
   })
 
   describe('when specifying a predicate path', () => {
-    let dir = ''
-    const filename = 'subject'
+    const predicateType = 'https://example.com/predicate'
     const content = '{}'
+    let predicatePath = ''
 
     beforeEach(async () => {
       // Set-up temp directory
       const tmpDir = await fs.realpath(os.tmpdir())
-      dir = await fs.mkdtemp(tmpDir + path.sep)
+      const dir = await fs.mkdtemp(tmpDir + path.sep)
+
+      const filename = 'subject'
+      predicatePath = path.join(dir, filename)
 
       // Write file to temp directory
-      await fs.writeFile(path.join(dir, filename), content)
+      await fs.writeFile(predicatePath, content)
     })
 
     afterEach(async () => {
       // Clean-up temp directory
-      await fs.rm(dir, { recursive: true })
-    })
-
-    beforeEach(() => {
-      process.env['INPUT_PREDICATE-PATH'] = path.join(dir, filename)
-      process.env['INPUT_PREDICATE-TYPE'] = 'https://example.com/predicate'
+      await fs.rm(path.parse(predicatePath).dir, { recursive: true })
     })
 
     it('returns the predicate', () => {
-      expect(predicateFromInputs()).toEqual({
-        type: 'https://example.com/predicate',
-        params: {}
+      const inputs: PredicateInputs = {
+        ...blankInputs,
+        predicateType,
+        predicatePath
+      }
+      expect(predicateFromInputs(inputs)).toEqual({
+        type: predicateType,
+        params: JSON.parse(content)
       })
     })
   })
 
+  describe('when specifying a predicate path that does not exist', () => {
+    const predicateType = 'https://example.com/predicate'
+    const predicatePath = 'foo'
+
+    it('returns the predicate', () => {
+      const inputs: PredicateInputs = {
+        ...blankInputs,
+        predicateType,
+        predicatePath
+      }
+      expect(() => predicateFromInputs(inputs)).toThrow(/file not found/)
+    })
+  })
+
   describe('when specifying a predicate value', () => {
+    const predicateType = 'https://example.com/predicate'
     const content = '{}'
 
-    beforeEach(() => {
-      process.env['INPUT_PREDICATE'] = content
-      process.env['INPUT_PREDICATE-TYPE'] = 'https://example.com/predicate'
-    })
-
     it('returns the predicate', () => {
-      expect(predicateFromInputs()).toEqual({
-        type: 'https://example.com/predicate',
-        params: {}
+      const inputs: PredicateInputs = {
+        ...blankInputs,
+        predicateType,
+        predicate: content
+      }
+
+      expect(predicateFromInputs(inputs)).toEqual({
+        type: predicateType,
+        params: JSON.parse(content)
       })
     })
   })
+
+  describe('when specifying a predicate value exceeding the max size', () => {
+    const predicateType = 'https://example.com/predicate'
+    const content = JSON.stringify({ a: 'a'.repeat(16 * 1024 * 1024) })
+
+    it('throws an error', () => {
+      const inputs: PredicateInputs = {
+        ...blankInputs,
+        predicateType,
+        predicate: content
+      }
+
+      expect(() => predicateFromInputs(inputs)).toThrow(
+        /predicate string exceeds maximum/
+      )
+    })
+  })
 })

__tests__/style.test.ts

@@ -0,0 +1,15 @@
+import { highlight, mute } from '../src/style'
+
+describe('style', () => {
+  describe('highlight', () => {
+    it('adds cyan color to the string', () => {
+      expect(highlight('foo')).toBe('\x1B[36mfoo\x1B[39m')
+    })
+  })
+
+  describe('mute', () => {
+    it('adds gray color to the string', () => {
+      expect(mute('foo')).toBe('\x1B[38;5;244mfoo\x1B[39m')
+    })
+  })
+})

__tests__/subject.test.ts

@@ -2,85 +2,90 @@ import crypto from 'crypto'
 import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'
-import { subjectFromInputs } from '../src/subject'
+import { subjectFromInputs, SubjectInputs } from '../src/subject'
 
 describe('subjectFromInputs', () => {
-  afterEach(() => {
-    process.env['INPUT_SUBJECT-PATH'] = ''
-    process.env['INPUT_SUBJECT-DIGEST'] = ''
-    process.env['INPUT_SUBJECT-NAME'] = ''
-  })
+  const blankInputs: SubjectInputs = {
+    subjectPath: '',
+    subjectName: '',
+    subjectDigest: ''
+  }
 
   describe('when no inputs are provided', () => {
     it('throws an error', async () => {
-      await expect(subjectFromInputs()).rejects.toThrow(
+      await expect(subjectFromInputs(blankInputs)).rejects.toThrow(
         /one of subject-path or subject-digest must be provided/i
       )
     })
   })
 
   describe('when both subject path and subject digest are provided', () => {
-    beforeEach(() => {
-      process.env['INPUT_SUBJECT-PATH'] = 'path/to/subject'
-      process.env['INPUT_SUBJECT-DIGEST'] = 'digest'
-    })
-
     it('throws an error', async () => {
-      await expect(subjectFromInputs()).rejects.toThrow(
+      const inputs: SubjectInputs = {
+        subjectName: 'foo',
+        subjectPath: 'path/to/subject',
+        subjectDigest: 'digest'
+      }
+
+      await expect(subjectFromInputs(inputs)).rejects.toThrow(
         /only one of subject-path or subject-digest may be provided/i
       )
     })
   })
 
   describe('when subject digest is provided but not the name', () => {
-    beforeEach(() => {
-      process.env['INPUT_SUBJECT-DIGEST'] = 'digest'
-    })
-
     it('throws an error', async () => {
-      await expect(subjectFromInputs()).rejects.toThrow(
+      const inputs: SubjectInputs = {
+        ...blankInputs,
+        subjectDigest: 'digest'
+      }
+
+      await expect(subjectFromInputs(inputs)).rejects.toThrow(
         /subject-name must be provided when using subject-digest/i
       )
     })
   })
 
   describe('when specifying a subject digest', () => {
-    const name = 'subject'
+    const name = 'Subject'
 
     describe('when the digest is malformed', () => {
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-DIGEST'] = 'digest'
-        process.env['INPUT_SUBJECT-NAME'] = 'subject'
-      })
-
       it('throws an error', async () => {
-        await expect(subjectFromInputs()).rejects.toThrow(
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectDigest: 'digest',
+          subjectName: name
+        }
+
+        await expect(subjectFromInputs(inputs)).rejects.toThrow(
           /subject-digest must be in the format "sha256:<hex-digest>"/i
         )
       })
     })
 
     describe('when the alogrithm is not supported', () => {
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-DIGEST'] = 'md5:deadbeef'
-        process.env['INPUT_SUBJECT-NAME'] = 'subject'
-      })
-
       it('throws an error', async () => {
-        await expect(subjectFromInputs()).rejects.toThrow(
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectDigest: 'md5:deadbeef',
+          subjectName: name
+        }
+
+        await expect(subjectFromInputs(inputs)).rejects.toThrow(
           /subject-digest must be in the format "sha256:<hex-digest>"/i
         )
       })
     })
 
     describe('when the sha256 digest is malformed', () => {
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-DIGEST'] = 'sha256:deadbeef'
-        process.env['INPUT_SUBJECT-NAME'] = 'subject'
-      })
-
       it('throws an error', async () => {
-        await expect(subjectFromInputs()).rejects.toThrow(
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectDigest: 'sha256:deadbeef',
+          subjectName: name
+        }
+
+        await expect(subjectFromInputs(inputs)).rejects.toThrow(
           /subject-digest must be in the format "sha256:<hex-digest>"/i
         )
       })
@@ -91,13 +96,14 @@ describe('subjectFromInputs', () => {
       const digest =
         '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
 
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-DIGEST'] = `${alg}:${digest}`
-        process.env['INPUT_SUBJECT-NAME'] = name
-      })
-
       it('returns the subject', async () => {
-        const subject = await subjectFromInputs()
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectDigest: `${alg}:${digest}`,
+          subjectName: name
+        }
+
+        const subject = await subjectFromInputs(inputs)
 
         expect(subject).toBeDefined()
         expect(subject).toHaveLength(1)
@@ -105,23 +111,47 @@ describe('subjectFromInputs', () => {
         expect(subject[0].digest).toEqual({ [alg]: digest })
       })
     })
+
+    describe('when the downcaseName is true', () => {
+      const imageName = 'ghcr.io/FOO/bar'
+      const alg = 'sha256'
+      const digest =
+        '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+
+      it('returns the subject (with name downcased)', async () => {
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectDigest: `${alg}:${digest}`,
+          subjectName: imageName,
+          downcaseName: true
+        }
+
+        const subject = await subjectFromInputs(inputs)
+
+        expect(subject).toBeDefined()
+        expect(subject).toHaveLength(1)
+        expect(subject[0].name).toEqual(imageName.toLowerCase())
+        expect(subject[0].digest).toEqual({ [alg]: digest })
+      })
+    })
   })
 
   describe('when specifying a subject path', () => {
     describe('when the file does NOT exist', () => {
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-PATH'] = '/f/a/k/e'
-      })
-
       it('throws an error', async () => {
-        await expect(subjectFromInputs()).rejects.toThrow(
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: '/f/a/k/e'
+        }
+
+        await expect(subjectFromInputs(inputs)).rejects.toThrow(
           /could not find subject at path/i
         )
       })
     })
   })
 
-  describe('when the file eixts', () => {
+  describe('when the file exists', () => {
     let dir = ''
     const filename = 'subject'
     const content = 'file content'
@@ -142,6 +172,7 @@ describe('subjectFromInputs', () => {
       // Add files for glob testing
       for (let i = 0; i < 3; i++) {
         await fs.writeFile(path.join(dir, `${filename}-${i}`), content)
+        await fs.writeFile(path.join(dir, `other-${i}`), content)
       }
     })
 
@@ -151,12 +182,13 @@ describe('subjectFromInputs', () => {
     })
 
     describe('when no name is provided', () => {
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-PATH'] = path.join(dir, filename)
-      })
-
       it('returns the subject', async () => {
-        const subject = await subjectFromInputs()
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: path.join(dir, filename)
+        }
+
+        const subject = await subjectFromInputs(inputs)
 
         expect(subject).toBeDefined()
         expect(subject).toHaveLength(1)
@@ -168,13 +200,14 @@ describe('subjectFromInputs', () => {
     describe('when a name is provided', () => {
       const name = 'mysubject'
 
-      beforeEach(() => {
-        process.env['INPUT_SUBJECT-PATH'] = path.join(dir, filename)
-        process.env['INPUT_SUBJECT-NAME'] = name
-      })
-
       it('returns the subject', async () => {
-        const subject = await subjectFromInputs()
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: path.join(dir, filename),
+          subjectName: name
+        }
+
+        const subject = await subjectFromInputs(inputs)
 
         expect(subject).toBeDefined()
         expect(subject).toHaveLength(1)
@@ -184,12 +217,13 @@ describe('subjectFromInputs', () => {
     })
 
     describe('when a file glob is supplied', () => {
-      beforeEach(async () => {
-        process.env['INPUT_SUBJECT-PATH'] = path.join(dir, 'subject-*')
-      })
-
       it('returns the multiple subjects', async () => {
-        const subjects = await subjectFromInputs()
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: path.join(dir, 'subject-*')
+        }
+
+        const subjects = await subjectFromInputs(inputs)
 
         expect(subjects).toBeDefined()
         expect(subjects).toHaveLength(3)
@@ -201,5 +235,128 @@ describe('subjectFromInputs', () => {
         })
       })
     })
+
+    describe('when a file glob is supplied which also matches non-files', () => {
+      it('returns the subjects (excluding non-files)', async () => {
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: `${dir}*`
+        }
+
+        const subjects = await subjectFromInputs(inputs)
+
+        expect(subjects).toBeDefined()
+        expect(subjects).toHaveLength(7)
+      })
+    })
+
+    describe('when a comma-separated list is supplied', () => {
+      it('returns the multiple subjects', async () => {
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: `${path.join(dir, 'subject-1')},${path.join(dir, 'subject-2')}`
+        }
+
+        const subjects = await subjectFromInputs(inputs)
+
+        expect(subjects).toBeDefined()
+        expect(subjects).toHaveLength(2)
+
+        expect(subjects).toContainEqual({
+          name: 'subject-1',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'subject-2',
+          digest: { sha256: expectedDigest }
+        })
+      })
+    })
+
+    describe('when a multi-line list is supplied', () => {
+      it('returns the multiple subjects', async () => {
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: `${path.join(dir, 'subject-0')}\n${path.join(dir, 'subject-2')}`
+        }
+
+        const subjects = await subjectFromInputs(inputs)
+
+        expect(subjects).toBeDefined()
+        expect(subjects).toHaveLength(2)
+
+        expect(subjects).toContainEqual({
+          name: 'subject-0',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'subject-2',
+          digest: { sha256: expectedDigest }
+        })
+      })
+    })
+
+    describe('when an excluding glob is supplied', () => {
+      it('returns the multiple subjects', async () => {
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: `${path.join(dir, 'subject-*')},!${path.join(dir, 'subject-1')}`
+        }
+
+        const subjects = await subjectFromInputs(inputs)
+
+        expect(subjects).toBeDefined()
+        expect(subjects).toHaveLength(2)
+
+        expect(subjects).toContainEqual({
+          name: 'subject-0',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'subject-2',
+          digest: { sha256: expectedDigest }
+        })
+      })
+    })
+
+    describe('when a multi-line glob list is supplied', () => {
+      it('returns the multiple subjects', async () => {
+        const inputs: SubjectInputs = {
+          ...blankInputs,
+          subjectPath: `${path.join(dir, 'subject-*')}\n  ${path.join(dir, 'other-*')} `
+        }
+
+        const subjects = await subjectFromInputs(inputs)
+
+        expect(subjects).toBeDefined()
+        expect(subjects).toHaveLength(6)
+
+        expect(subjects).toContainEqual({
+          name: 'subject-0',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'subject-1',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'subject-2',
+          digest: { sha256: expectedDigest }
+        })
+
+        expect(subjects).toContainEqual({
+          name: 'other-0',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'other-1',
+          digest: { sha256: expectedDigest }
+        })
+        expect(subjects).toContainEqual({
+          name: 'other-2',
+          digest: { sha256: expectedDigest }
+        })
+      })
+    })
   })
 })

action.yml

@@ -1,16 +1,20 @@
 name: 'Generate Generic Attestations'
 description: 'Generate attestations for build artifacts'
 author: 'GitHub'
+branding:
+  color: 'blue'
+  icon: 'link'
 
 inputs:
   subject-path:
     description: >
       Path to the artifact serving as the subject of the attestation. Must
-      specify exactly one of "subject-path" or "subject-digest".
+      specify exactly one of "subject-path" or "subject-digest". May contain a
+      glob pattern or list of paths (total subject count cannot exceed 2500).
     required: false
   subject-digest:
     description: >
-      Digest of the subject for for the attestation. Must be in the form
+      Digest of the subject for the attestation. Must be in the form
       "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one
       of "subject-path" or "subject-digest".
     required: false
@@ -26,13 +30,15 @@ inputs:
     required: true
   predicate:
     description: >
-      String containing the value for the attestation predicate. Must supply
-      exactly one of "predicate-path" or "predicate".
+      String containing the value for the attestation predicate. String length
+      cannot exceed 16MB. Must supply exactly one of "predicate-path" or
+      "predicate".
     required: false
   predicate-path:
     description: >
       Path to the file which contains the content for the attestation predicate.
-      Must supply exactly one of "predicate-path" or "predicate".
+      File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
+      or "predicate".
     required: false
   push-to-registry:
     description: >
@@ -41,6 +47,12 @@ inputs:
       the "subject-digest" parameter be specified. Defaults to false.
     default: false
     required: false
+  show-summary:
+    description: >
+      Whether to attach a list of generated attestations to the workflow run
+      summary page. Defaults to true.
+    default: true
+    required: false
   github-token:
     description: >
       The GitHub token used to make authenticated API requests.
@@ -52,4 +64,4 @@ outputs:
 
 runs:
   using: node20
-  main: ./dist/index.js
+  main: ./dist/index.js

dist/licenses.txt

@@ -243,6 +243,31 @@ The above copyright notice and this permission notice (including the next paragr
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
+@octokit/plugin-retry
+MIT
+MIT License
+
+Copyright (c) 2018 Octokit contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 @octokit/request
 MIT
 The MIT License
@@ -1366,6 +1391,30 @@ Apache-2.0
    limitations under the License.
 
 
+bottleneck
+MIT
+The MIT License (MIT)
+
+Copyright (c) 2014 Simon Grondin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+
 brace-expansion
 MIT
 MIT License
@@ -1446,6 +1495,31 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
+csv-parse
+MIT
+The MIT License (MIT)
+
+Copyright (c) 2010 Adaltas
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 debug
 MIT
 (The MIT License)
@@ -1691,6 +1765,31 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
 
+jose
+MIT
+The MIT License (MIT)
+
+Copyright (c) 2018 Filip Skokan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 jsbn
 MIT
 Licensing
@@ -2094,6 +2193,25 @@ will be liable to anyone for any damages related to this
 software or this license, under any kind of legal claim.***
 
 
+proc-log
+ISC
+The ISC License
+
+Copyright (c) GitHub, Inc.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
+IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+
+
 promise-retry
 MIT
 Copyright (c) 2014 IndigoUnited

package.json

@@ -1,21 +1,20 @@
 {
-  "name": "typescript-action",
-  "description": "GitHub Actions TypeScript template",
-  "version": "0.0.0",
+  "name": "actions/attest",
+  "description": "Generate signed attestations for workflow artifacts",
+  "version": "1.4.1",
   "author": "",
   "private": true,
-  "homepage": "https://github.com/actions/typescript-action",
+  "homepage": "https://github.com/actions/attest",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/actions/typescript-action.git"
+    "url": "git+https://github.com/actions/attest.git"
   },
   "bugs": {
-    "url": "https://github.com/actions/typescript-action/issues"
+    "url": "https://github.com/actions/attest/issues"
   },
   "keywords": [
     "actions",
-    "node",
-    "setup"
+    "attestation"
   ],
   "exports": {
     ".": "./dist/index.js"
@@ -70,31 +69,33 @@
     ]
   },
   "dependencies": {
-    "@actions/attest": "^1.0.0",
+    "@actions/attest": "^1.4.1",
     "@actions/core": "^1.10.1",
-    "@actions/glob": "^0.4.0",
-    "@sigstore/oci": "^0.2.0"
+    "@actions/glob": "^0.5.0",
+    "@sigstore/oci": "^0.3.7",
+    "csv-parse": "^5.5.6"
   },
   "devDependencies": {
-    "@sigstore/mock": "^0.7.0",
+    "@sigstore/mock": "^0.7.5",
     "@types/jest": "^29.5.12",
     "@types/make-fetch-happen": "^10.0.4",
-    "@types/node": "^20.11.26",
-    "@typescript-eslint/eslint-plugin": "^7.2.0",
-    "@typescript-eslint/parser": "^7.2.0",
+    "@types/node": "^22.4.1",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
     "@vercel/ncc": "^0.38.1",
     "eslint": "^8.57.0",
-    "eslint-plugin-github": "^4.10.2",
-    "eslint-plugin-jest": "^27.9.0",
-    "eslint-plugin-jsonc": "^2.13.0",
-    "eslint-plugin-prettier": "^5.1.3",
+    "eslint-plugin-github": "^5.0.1",
+    "eslint-plugin-jest": "^28.8.0",
+    "eslint-plugin-jsonc": "^2.16.0",
+    "eslint-plugin-prettier": "^5.2.1",
     "jest": "^29.7.0",
     "js-yaml": "^4.1.0",
-    "markdownlint-cli": "^0.39.0",
+    "markdownlint-cli": "^0.41.0",
     "nock": "^13.5.4",
-    "prettier": "^3.2.5",
+    "prettier": "^3.3.3",
     "prettier-eslint": "^16.3.0",
-    "ts-jest": "^29.1.2",
-    "typescript": "^5.4.2"
+    "ts-jest": "^29.2.4",
+    "typescript": "^5.5.4",
+    "undici": "^5.28.4"
   }
 }

src/attest.ts

@@ -0,0 +1,67 @@
+import { Attestation, Predicate, Subject, attest } from '@actions/attest'
+import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
+
+const OCI_TIMEOUT = 30000
+const OCI_RETRY = 3
+
+export type SigstoreInstance = 'public-good' | 'github'
+export type AttestResult = Attestation & {
+  subjectName: string
+  subjectDigest: string
+  attestationDigest?: string
+}
+
+export const createAttestation = async (
+  subject: Subject,
+  predicate: Predicate,
+  opts: {
+    sigstoreInstance: SigstoreInstance
+    pushToRegistry: boolean
+    githubToken: string
+  }
+): Promise<AttestResult> => {
+  // Sign provenance w/ Sigstore
+  const attestation = await attest({
+    subjectName: subject.name,
+    subjectDigest: subject.digest,
+    predicateType: predicate.type,
+    predicate: predicate.params,
+    sigstore: opts.sigstoreInstance,
+    token: opts.githubToken
+  })
+
+  const subDigest = subjectDigest(subject)
+  const result: AttestResult = {
+    ...attestation,
+    subjectName: subject.name,
+    subjectDigest: subDigest
+  }
+
+  if (opts.pushToRegistry) {
+    const credentials = getRegistryCredentials(subject.name)
+    const artifact = await attachArtifactToImage({
+      credentials,
+      imageName: subject.name,
+      imageDigest: subDigest,
+      artifact: Buffer.from(JSON.stringify(attestation.bundle)),
+      mediaType: attestation.bundle.mediaType,
+      annotations: {
+        'dev.sigstore.bundle.content': 'dsse-envelope',
+        'dev.sigstore.bundle.predicateType': predicate.type
+      },
+      fetchOpts: { timeout: OCI_TIMEOUT, retry: OCI_RETRY }
+    })
+
+    // Add the attestation's digest to the result
+    result.attestationDigest = artifact.digest
+  }
+
+  return result
+}
+
+// Returns the subject's digest as a formatted string of the form
+// "<algorithm>:<digest>".
+const subjectDigest = (subject: Subject): string => {
+  const alg = Object.keys(subject.digest).sort()[0]
+  return `${alg}:${subject.digest[alg]}`
+}

src/index.ts

@@ -1,7 +1,28 @@
 /**
  * The entrypoint for the action.
  */
-import { run } from './main'
+import * as core from '@actions/core'
+import { run, RunInputs } from './main'
+
+const DEFAULT_BATCH_SIZE = 50
+
+const inputs: RunInputs = {
+  subjectPath: core.getInput('subject-path'),
+  subjectName: core.getInput('subject-name'),
+  subjectDigest: core.getInput('subject-digest'),
+  predicateType: core.getInput('predicate-type'),
+  predicate: core.getInput('predicate'),
+  predicatePath: core.getInput('predicate-path'),
+  pushToRegistry: core.getBooleanInput('push-to-registry'),
+  showSummary: core.getBooleanInput('show-summary'),
+  githubToken: core.getInput('github-token'),
+  // undocumented -- not part of public interface
+  privateSigning: ['true', 'True', 'TRUE', '1'].includes(
+    core.getInput('private-signing')
+  ),
+  // internal only
+  batchSize: DEFAULT_BATCH_SIZE
+}
 
 // eslint-disable-next-line @typescript-eslint/no-floating-promises
-run()
+run(inputs)

src/main.ts

@@ -1,106 +1,139 @@
-import { Attestation, Predicate, Subject, attest } from '@actions/attest'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import { BUNDLE_V02_MEDIA_TYPE } from '@sigstore/bundle'
-import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
 import fs from 'fs'
 import os from 'os'
 import path from 'path'
+import { AttestResult, SigstoreInstance, createAttestation } from './attest'
 import { SEARCH_PUBLIC_GOOD_URL } from './endpoints'
-import { predicateFromInputs } from './predicate'
-import { subjectFromInputs } from './subject'
+import { PredicateInputs, predicateFromInputs } from './predicate'
+import * as style from './style'
+import { SubjectInputs, subjectFromInputs } from './subject'
 
-type SigstoreInstance = 'public-good' | 'github'
-
-const COLOR_CYAN = '\x1B[36m'
-const COLOR_DEFAULT = '\x1B[39m'
 const ATTESTATION_FILE_NAME = 'attestation.jsonl'
+const DELAY_INTERVAL_MS = 75
+const DELAY_MAX_MS = 1200
+
+export type RunInputs = SubjectInputs &
+  PredicateInputs & {
+    pushToRegistry: boolean
+    githubToken: string
+    showSummary: boolean
+    privateSigning: boolean
+    batchSize: number
+  }
+
+/* istanbul ignore next */
+const logHandler = (level: string, ...args: unknown[]): void => {
+  // Send any HTTP-related log events to the GitHub Actions debug log
+  if (level === 'http') {
+    core.debug(args.join(' '))
+  }
+}
 
 /**
  * The main function for the action.
  * @returns {Promise<void>} Resolves when the action is complete.
  */
-export async function run(): Promise<void> {
+export async function run(inputs: RunInputs): Promise<void> {
+  process.on('log', logHandler)
+
   // Provenance visibility will be public ONLY if we can confirm that the
   // repository is public AND the undocumented "private-signing" arg is NOT set.
   // Otherwise, it will be private.
   const sigstoreInstance: SigstoreInstance =
     github.context.payload.repository?.visibility === 'public' &&
-    core.getInput('private-signing') !== 'true'
+    !inputs.privateSigning
       ? 'public-good'
       : 'github'
 
   try {
+    const atts: AttestResult[] = []
     if (!process.env.ACTIONS_ID_TOKEN_REQUEST_URL) {
       throw new Error(
         'missing "id-token" permission. Please add "permissions: id-token: write" to your workflow.'
       )
     }
 
-    // Calculate subject from inputs and generate provenance
-    const subjects = await subjectFromInputs()
-    const predicate = predicateFromInputs()
+    const subjects = await subjectFromInputs({
+      ...inputs,
+      downcaseName: inputs.pushToRegistry
+    })
+    const predicate = predicateFromInputs(inputs)
+
     const outputPath = path.join(tempDir(), ATTESTATION_FILE_NAME)
+    core.setOutput('bundle-path', outputPath)
 
-    // Generate attestations for each subject serially
-    for (const subject of subjects) {
-      const att = await createAttestation(subject, predicate, sigstoreInstance)
+    const subjectChunks = chunkArray(subjects, inputs.batchSize)
 
-      // Write attestation bundle to output file
-      fs.writeFileSync(outputPath, JSON.stringify(att.bundle) + os.EOL, {
-        encoding: 'utf-8',
-        flag: 'a'
-      })
+    // Generate attestations for each subject serially, working in batches
+    for (let i = 0; i < subjectChunks.length; i++) {
+      if (subjectChunks.length > 1) {
+        core.info(`Processing subject batch ${i + 1}/${subjectChunks.length}`)
+      }
 
-      if (att.attestationID) {
-        core.summary.addLink(
-          `${subject.name}@${subjectDigest(subject)}`,
-          attestationURL(att.attestationID)
-        )
+      // Calculate the delay time for this batch
+      const delayTime = delay(i)
+
+      for (const subject of subjectChunks[i]) {
+        // Delay between attestations (only when chunk size > 1)
+        if (i > 0) {
+          await new Promise(resolve => setTimeout(resolve, delayTime))
+        }
+
+        const att = await createAttestation(subject, predicate, {
+          sigstoreInstance,
+          pushToRegistry: inputs.pushToRegistry,
+          githubToken: inputs.githubToken
+        })
+        atts.push(att)
+
+        logAttestation(att, sigstoreInstance)
+
+        // Write attestation bundle to output file
+        fs.writeFileSync(outputPath, JSON.stringify(att.bundle) + os.EOL, {
+          encoding: 'utf-8',
+          flag: 'a'
+        })
       }
     }
 
-    if (!core.summary.isEmptyBuffer()) {
-      core.summary.addHeading('Attestation(s) Created', 3)
-      core.summary.write()
+    if (inputs.showSummary) {
+      logSummary(atts)
     }
-
-    core.setOutput('bundle-path', outputPath)
   } catch (err) {
     // Fail the workflow run if an error occurs
     core.setFailed(
-      err instanceof Error ? err.message : /* istanbul ignore next */ `${err}`
+      err instanceof Error ? err : /* istanbul ignore next */ `${err}`
     )
 
+    // Log the cause of the error if one is available
     /* istanbul ignore if */
     if (err instanceof Error && 'cause' in err) {
       const innerErr = err.cause
-      core.debug(innerErr instanceof Error ? innerErr.message : `${innerErr}}`)
+      core.info(
+        style.mute(
+          innerErr instanceof Error ? innerErr.toString() : `${innerErr}`
+        )
+      )
     }
+  } finally {
+    process.removeListener('log', logHandler)
   }
 }
 
-const createAttestation = async (
-  subject: Subject,
-  predicate: Predicate,
+// Log details about the attestation to the GitHub Actions run
+const logAttestation = (
+  attestation: AttestResult,
   sigstoreInstance: SigstoreInstance
-): Promise<Attestation> => {
-  // Sign provenance w/ Sigstore
-  const attestation = await attest({
-    subjectName: subject.name,
-    subjectDigest: subject.digest,
-    predicateType: predicate.type,
-    predicate: predicate.params,
-    sigstore: sigstoreInstance,
-    token: core.getInput('github-token')
-  })
-
-  core.info(`Attestation created for ${subject.name}@${subjectDigest(subject)}`)
+): void => {
+  core.info(
+    `Attestation created for ${attestation.subjectName}@${attestation.subjectDigest}`
+  )
 
   const instanceName =
     sigstoreInstance === 'public-good' ? 'Public Good' : 'GitHub'
   core.startGroup(
-    highlight(
+    style.highlight(
       `Attestation signed using certificate from ${instanceName} Sigstore instance`
     )
   )
@@ -109,36 +142,46 @@ const createAttestation = async (
 
   if (attestation.tlogID) {
     core.info(
-      highlight('Attestation signature uploaded to Rekor transparency log')
+      style.highlight(
+        'Attestation signature uploaded to Rekor transparency log'
+      )
     )
     core.info(`${SEARCH_PUBLIC_GOOD_URL}?logIndex=${attestation.tlogID}`)
   }
 
   if (attestation.attestationID) {
-    core.info(highlight('Attestation uploaded to repository'))
+    core.info(style.highlight('Attestation uploaded to repository'))
     core.info(attestationURL(attestation.attestationID))
   }
 
-  if (core.getBooleanInput('push-to-registry', { required: false })) {
-    const credentials = getRegistryCredentials(subject.name)
-    const artifact = await attachArtifactToImage({
-      credentials,
-      imageName: subject.name,
-      imageDigest: subjectDigest(subject),
-      artifact: Buffer.from(JSON.stringify(attestation.bundle)),
-      mediaType: BUNDLE_V02_MEDIA_TYPE,
-      annotations: {
-        'dev.sigstore.bundle/predicateType': core.getInput('predicate-type')
-      }
-    })
-    core.info(highlight('Attestation uploaded to registry'))
-    core.info(`${subject.name}@${artifact.digest}`)
+  if (attestation.attestationDigest) {
+    core.info(style.highlight('Attestation uploaded to registry'))
+    core.info(`${attestation.subjectName}@${attestation.attestationDigest}`)
   }
-
-  return attestation
 }
 
-const highlight = (str: string): string => `${COLOR_CYAN}${str}${COLOR_DEFAULT}`
+// Attach summary information to the GitHub Actions run
+const logSummary = (attestations: AttestResult[]): void => {
+  if (attestations.length > 0) {
+    core.summary.addHeading(
+      /* istanbul ignore next */
+      attestations.length > 1 ? 'Attestations Created' : 'Attestation Created',
+      3
+    )
+
+    const listItems = []
+    for (const { subjectName, subjectDigest, attestationID } of attestations) {
+      if (attestationID) {
+        listItems.push(
+          `<a href="${attestationURL(attestationID)}">${subjectName}@${subjectDigest}</a>`
+        )
+      }
+    }
+
+    core.summary.addList(listItems)
+    core.summary.write()
+  }
+}
 
 const tempDir = (): string => {
   const basePath = process.env['RUNNER_TEMP']
@@ -151,12 +194,18 @@ const tempDir = (): string => {
   return fs.mkdtempSync(path.join(basePath, path.sep))
 }
 
-// Returns the subject's digest as a formatted string of the form
-// "<algorithm>:<digest>".
-const subjectDigest = (subject: Subject): string => {
-  const alg = Object.keys(subject.digest).sort()[0]
-  return `${alg}:${subject.digest[alg]}`
+// Transforms an array into an array of arrays, each containing at most
+// `chunkSize` elements.
+const chunkArray = <T>(array: T[], chunkSize: number): T[][] => {
+  return Array.from(
+    { length: Math.ceil(array.length / chunkSize) },
+    (_, index) => array.slice(index * chunkSize, (index + 1) * chunkSize)
+  )
 }
 
+// Calculate the delay time for a given iteration
+const delay = (iteration: number): number =>
+  Math.min(DELAY_INTERVAL_MS * 2 ** iteration, DELAY_MAX_MS)
+
 const attestationURL = (id: string): string =>
   `${github.context.serverUrl}/${github.context.repo.owner}/${github.context.repo.repo}/attestations/${id}`

src/predicate.ts

@@ -1,26 +1,56 @@
-import * as core from '@actions/core'
 import fs from 'fs'
 
 import type { Predicate } from '@actions/attest'
 
+export type PredicateInputs = {
+  predicateType: string
+  predicate: string
+  predicatePath: string
+}
+
+const MAX_PREDICATE_SIZE_BYTES = 16 * 1024 * 1024
+
 // Returns the predicate specified by the action's inputs. The predicate value
 // may be specified as a path to a file or as a string.
-export const predicateFromInputs = (): Predicate => {
-  const predicateType = core.getInput('predicate-type', { required: true })
-  const predicateStr = core.getInput('predicate', { required: false })
-  const predicatePath = core.getInput('predicate-path', { required: false })
+export const predicateFromInputs = (inputs: PredicateInputs): Predicate => {
+  const { predicateType, predicate, predicatePath } = inputs
 
-  if (!predicatePath && !predicateStr) {
+  if (!predicateType) {
+    throw new Error('predicate-type must be provided')
+  }
+
+  if (!predicatePath && !predicate) {
     throw new Error('One of predicate-path or predicate must be provided')
   }
 
-  if (predicatePath && predicateStr) {
+  if (predicatePath && predicate) {
     throw new Error('Only one of predicate-path or predicate may be provided')
   }
 
-  const params = predicatePath
-    ? fs.readFileSync(predicatePath, 'utf-8')
-    : predicateStr
+  let params: string = predicate
+
+  if (predicatePath) {
+    if (!fs.existsSync(predicatePath)) {
+      throw new Error(`predicate file not found: ${predicatePath}`)
+    }
+
+    /* istanbul ignore next */
+    if (fs.statSync(predicatePath).size > MAX_PREDICATE_SIZE_BYTES) {
+      throw new Error(
+        `predicate file exceeds maximum allowed size: ${MAX_PREDICATE_SIZE_BYTES} bytes`
+      )
+    }
+
+    params = fs.readFileSync(predicatePath, 'utf-8')
+  } else {
+    if (predicate.length > MAX_PREDICATE_SIZE_BYTES) {
+      throw new Error(
+        `predicate string exceeds maximum allowed size: ${MAX_PREDICATE_SIZE_BYTES} bytes`
+      )
+    }
+
+    params = predicate
+  }
 
   return { type: predicateType, params: JSON.parse(params) }
 }

src/style.ts

@@ -0,0 +1,11 @@
+const COLOR_CYAN = '\x1B[36m'
+const COLOR_GRAY = '\x1B[38;5;244m'
+const COLOR_DEFAULT = '\x1B[39m'
+
+// Emphasis string using ANSI color codes
+export const highlight = (str: string): string =>
+  `${COLOR_CYAN}${str}${COLOR_DEFAULT}`
+
+// De-emphasize string using ANSI color codes
+export const mute = (str: string): string =>
+  `${COLOR_GRAY}${str}${COLOR_DEFAULT}`

src/subject.ts

@@ -1,21 +1,28 @@
-import * as core from '@actions/core'
 import * as glob from '@actions/glob'
 import crypto from 'crypto'
+import { parse } from 'csv-parse/sync'
 import fs from 'fs'
 import path from 'path'
 
 import type { Subject } from '@actions/attest'
 
+const MAX_SUBJECT_COUNT = 2500
 const DIGEST_ALGORITHM = 'sha256'
 
+export type SubjectInputs = {
+  subjectPath: string
+  subjectName: string
+  subjectDigest: string
+  downcaseName?: boolean
+}
 // Returns the subject specified by the action's inputs. The subject may be
 // specified as a path to a file or as a digest. If a path is provided, the
 // file's digest is calculated and returned along with the subject's name. If a
 // digest is provided, the name must also be provided.
-export const subjectFromInputs = async (): Promise<Subject[]> => {
-  const subjectPath = core.getInput('subject-path', { required: false })
-  const subjectDigest = core.getInput('subject-digest', { required: false })
-  const subjectName = core.getInput('subject-name', { required: false })
+export const subjectFromInputs = async (
+  inputs: SubjectInputs
+): Promise<Subject[]> => {
+  const { subjectPath, subjectDigest, subjectName, downcaseName } = inputs
 
   if (!subjectPath && !subjectDigest) {
     throw new Error('One of subject-path or subject-digest must be provided')
@@ -31,10 +38,14 @@ export const subjectFromInputs = async (): Promise<Subject[]> => {
     throw new Error('subject-name must be provided when using subject-digest')
   }
 
+  // If push-to-registry is enabled, ensure the subject name is lowercase
+  // to conform to OCI image naming conventions
+  const name = downcaseName ? subjectName.toLowerCase() : subjectName
+
   if (subjectPath) {
-    return await getSubjectFromPath(subjectPath, subjectName)
+    return await getSubjectFromPath(subjectPath, name)
   } else {
-    return [getSubjectFromDigest(subjectDigest, subjectName)]
+    return [getSubjectFromDigest(subjectDigest, name)]
   }
 }
 
@@ -44,20 +55,38 @@ const getSubjectFromPath = async (
   subjectPath: string,
   subjectName?: string
 ): Promise<Subject[]> => {
-  /* eslint-disable-next-line github/no-then */
-  const files = await glob.create(subjectPath).then(async g => g.glob())
+  const digestedSubjects: Subject[] = []
+
+  // Parse the list of subject paths
+  const subjectPaths = parseList(subjectPath).join('\n')
+
+  // Expand the globbed paths to a list of files
+  /* eslint-disable-next-line github/no-then */
+  const files = await glob.create(subjectPaths).then(async g => g.glob())
+
+  if (files.length > MAX_SUBJECT_COUNT) {
+    throw new Error(
+      `Too many subjects specified. The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
+    )
+  }
+
+  for (const file of files) {
+    // Skip anything that is NOT a file
+    if (!fs.statSync(file).isFile()) {
+      continue
+    }
 
-  const subjects = files.map(async file => {
     const name = subjectName || path.parse(file).base
     const digest = await digestFile(DIGEST_ALGORITHM, file)
-    return { name, digest: { [DIGEST_ALGORITHM]: digest } }
-  })
 
-  if (subjects.length === 0) {
+    digestedSubjects.push({ name, digest: { [DIGEST_ALGORITHM]: digest } })
+  }
+
+  if (digestedSubjects.length === 0) {
     throw new Error(`Could not find subject at path ${subjectPath}`)
   }
 
-  return Promise.all(subjects)
+  return digestedSubjects
 }
 
 // Returns the subject specified by the digest of a file. The digest is returned
@@ -94,3 +123,20 @@ const digestFile = async (
       .once('finish', () => resolve(hash.read()))
   })
 }
+
+const parseList = (input: string): string[] => {
+  const res: string[] = []
+
+  const records: string[][] = parse(input, {
+    columns: false,
+    relaxQuotes: true,
+    relaxColumnCount: true,
+    skipEmptyLines: true
+  })
+
+  for (const record of records) {
+    res.push(...record)
+  }
+
+  return res.filter(item => item).map(pat => pat.trim())
+}