support multi-subject attestations (#164)

Signed-off-by: Brian DeHamer <[email protected]>

src/attest.ts

@@ -1,18 +1,17 @@
 import { Attestation, Predicate, Subject, attest } from '@actions/attest'
 import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
+import { formatSubjectDigest } from './subject'
 
 const OCI_TIMEOUT = 30000
 const OCI_RETRY = 3
 
 export type SigstoreInstance = 'public-good' | 'github'
 export type AttestResult = Attestation & {
-  subjectName: string
-  subjectDigest: string
   attestationDigest?: string
 }
 
 export const createAttestation = async (
-  subject: Subject,
+  subjects: Subject[],
   predicate: Predicate,
   opts: {
     sigstoreInstance: SigstoreInstance
@@ -22,27 +21,22 @@ export const createAttestation = async (
 ): Promise<AttestResult> => {
   // Sign provenance w/ Sigstore
   const attestation = await attest({
-    subjectName: subject.name,
-    subjectDigest: subject.digest,
+    subjects,
     predicateType: predicate.type,
     predicate: predicate.params,
     sigstore: opts.sigstoreInstance,
     token: opts.githubToken
   })
 
-  const subDigest = subjectDigest(subject)
-  const result: AttestResult = {
-    ...attestation,
-    subjectName: subject.name,
-    subjectDigest: subDigest
-  }
+  const result: AttestResult = attestation
 
-  if (opts.pushToRegistry) {
+  if (subjects.length === 1 && opts.pushToRegistry) {
+    const subject = subjects[0]
     const credentials = getRegistryCredentials(subject.name)
     const artifact = await attachArtifactToImage({
       credentials,
       imageName: subject.name,
-      imageDigest: subDigest,
+      imageDigest: formatSubjectDigest(subject),
       artifact: Buffer.from(JSON.stringify(attestation.bundle)),
       mediaType: attestation.bundle.mediaType,
       annotations: {
@@ -58,10 +52,3 @@ export const createAttestation = async (
 
   return result
 }
-
-// Returns the subject's digest as a formatted string of the form
-// "<algorithm>:<digest>".
-const subjectDigest = (subject: Subject): string => {
-  const alg = Object.keys(subject.digest).sort()[0]
-  return `${alg}:${subject.digest[alg]}`
-}