FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Add workflow file for publishing releases to immutable action package by Jcambass · Pull Request #485 · actions/github-script · GitHub

/ github-script Public

Add workflow file for publishing releases to immutable action package #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Jcambass merged 1 commit into from
Sep 13, 2024
Conversation 7 Commits 1 Checks 0 Files changed
Merged

Add workflow file for publishing releases to immutable action package #485

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension .yml  (1) All 1 file type selected
Only manifest files
Viewed files
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Unified
Split
Hide whitespace
Diff view
Unified
Split
Hide whitespace
22 changes: 22 additions & 0 deletions .github/workflows/publish-immutable-actions.yml
Show comments
View file
Open in desktop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
name: 'Publish Immutable Action Version'

on:
release:
types: [created]

joshmgross Sep 13, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Should we use release published instead of created?

https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=published#release

Users may create a draft release and not want others to depend on it yet.

jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write

joshmgross Sep 13, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Why is an OIDC token needed?

conorsloan Sep 13, 2024 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

It's required for generating the attestation - it uses the id-token to prove the identity and request a Sigstore signing cert. See also: https://github.com/actions/attest-build-provenance?tab=readme-ov-file#usage

The id-token permission gives the action the ability to mint the OIDC token necessary to request a Sigstore signing certificate. The attestations permission is necessary to persist the attestation.

(we don't persist the attestation with GitHub's API so we don't need that second one)
packages: write

steps:
- name: Checking out
uses: actions/checkout@v4
- name: Publish
id: publish
uses: actions/publish-immutable-action@0.0.1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +20 to +22

joshmgross Sep 13, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

We could update this action to default ot using the GITHUB_TOKEN

github-script/action.yml

Lines 11 to 14 in 35b1cdd

github-token:
description: The GitHub token used to create an authenticated client
default: ${{ github.token }}
required: false

Back | FazBrowse Home | New Git URL