Add path to created attestation in a well-known summary file (#252)

* Added a new output file, where the path on local disk to each created
attestation is stored. One attestation per line.

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

* Added a section to the readme about the paths file

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

* store the file in RUNNER_TEMP

* Ignore writing summary file for created attestations if runner_temp is not set.

* prettier updates

---------

Signed-off-by: Fredrik Skogman <kommendorkapten@github.com>

README.md

@@ -18,6 +18,12 @@ Once the attestation has been created and signed, it will be uploaded to the GH
 attestations API and associated with the repository from which the workflow was
 initiated.
 
+When an attestation is created, the attestation is stored on the local
+filesystem used by the runner. For each attestation created, the filesystem path
+will be appended to the file `${RUNNER_TEMP}/created_attestation_paths.txt`.
+This can be used to gather all attestations created by all jobs during a the
+workflow.
+
 Attestations can be verified using the [`attestation` command in the GitHub
 CLI][5].
 

dist/index.js

@@ -71130,6 +71130,7 @@ const predicate_1 = __nccwpck_require__(84982);
 const style = __importStar(__nccwpck_require__(64542));
 const subject_1 = __nccwpck_require__(36303);
 const ATTESTATION_FILE_NAME = 'attestation.json';
+const ATTESTATION_PATHS_FILE_NAME = 'created_attestation_paths.txt';
 /* istanbul ignore next */
 const logHandler = (level, ...args) => {
     // Send any HTTP-related log events to the GitHub Actions debug log
@@ -71172,6 +71173,18 @@ async function run(inputs) {
             encoding: 'utf-8',
             flag: 'a'
         });
+        const baseDir = process.env.RUNNER_TEMP;
+        if (baseDir) {
+            const outputSummaryPath = path_1.default.join(baseDir, ATTESTATION_PATHS_FILE_NAME);
+            // Append the output path to the attestations paths file
+            fs_1.default.appendFileSync(outputSummaryPath, outputPath + os_1.default.EOL, {
+                encoding: 'utf-8',
+                flag: 'a'
+            });
+        }
+        else {
+            core.warning('RUNNER_TEMP environment variable is not set. Cannot write attestation paths file.');
+        }
         if (att.attestationID) {
             core.setOutput('attestation-id', att.attestationID);
             core.setOutput('attestation-url', attestationURL(att.attestationID));

src/main.ts

@@ -16,6 +16,7 @@ import {
 import type { Subject } from '@actions/attest'
 
 const ATTESTATION_FILE_NAME = 'attestation.json'
+const ATTESTATION_PATHS_FILE_NAME = 'created_attestation_paths.txt'
 
 export type RunInputs = SubjectInputs &
   PredicateInputs & {
@@ -79,6 +80,20 @@ export async function run(inputs: RunInputs): Promise<void> {
       flag: 'a'
     })
 
+    const baseDir = process.env.RUNNER_TEMP
+    if (baseDir) {
+      const outputSummaryPath = path.join(baseDir, ATTESTATION_PATHS_FILE_NAME)
+      // Append the output path to the attestations paths file
+      fs.appendFileSync(outputSummaryPath, outputPath + os.EOL, {
+        encoding: 'utf-8',
+        flag: 'a'
+      })
+    } else {
+      core.warning(
+        'RUNNER_TEMP environment variable is not set. Cannot write attestation paths file.'
+      )
+    }
+
     if (att.attestationID) {
       core.setOutput('attestation-id', att.attestationID)
       core.setOutput('attestation-url', attestationURL(att.attestationID))