remove comment

Signed-off-by: Meredith Lancaster <malancas@github.com>

README.md

@@ -41,21 +41,6 @@ information on artifact attestations.
 > Artifact attestations are NOT supported on GitHub Enterprise Server.
 <!-- prettier-ignore-end -->
 
-## Attestation Modes
-
-This action supports three attestation modes, automatically detected based on
-the inputs you provide:
-
-<!-- markdownlint-disable MD013 -->
-
-| Mode           | When Used                                              | Description                                      |
-| -------------- | ------------------------------------------------------ | ------------------------------------------------ |
-| **Provenance** | No `sbom-path` or predicate inputs                     | Auto-generates [SLSA build provenance][10]       |
-| **SBOM**       | `sbom-path` is provided                                | Creates attestation from SPDX or CycloneDX SBOM  |
-| **Custom**     | `predicate-type`/`predicate`/`predicate-path` provided | User-supplied predicate                          |
-
-<!-- markdownlint-enable MD013 -->
-
 ## Usage
 
 Within the GitHub Actions workflow which builds some artifact you would like to
@@ -78,21 +63,24 @@ attest:
 1. Add the following to your workflow after your artifact has been built:
 
    ```yaml
-   - uses: actions/attest@v4
+   - uses: actions/attest@v2
      with:
        subject-path: '<PATH TO ARTIFACT>'
+       predicate-type: '<PREDICATE URI>'
+       predicate-path: '<PATH TO PREDICATE>'
    ```
 
-   By default, this generates a [SLSA build provenance][10] attestation. For
-   SBOM or custom attestations, see the [Attestation Modes](#attestation-modes)
-   section.
+   The `subject-path` parameter should identify the artifact for which you want
+   to generate an attestation. The `predicate-type` can be any of the the
+   [vetted predicate types][3] or a custom value. The `predicate-path`
+   identifies a file containing the JSON-encoded predicate parameters.
 
 ### Inputs
 
 See [action.yml](action.yml)
 
 ```yaml
-- uses: actions/attest@v4
+- uses: actions/attest@v2
   with:
     # Path to the artifact serving as the subject of the attestation. Must
     # specify exactly one of "subject-path", "subject-digest", or
@@ -114,24 +102,17 @@ See [action.yml](action.yml)
     # or "subject-checksums".
     subject-checksums:
 
-    # Path to the JSON-formatted SBOM file (SPDX or CycloneDX) to attest.
-    # File size cannot exceed 16MB. When provided, creates an SBOM attestation.
-    # Cannot be used together with "predicate-type", "predicate", or
-    # "predicate-path".
-    sbom-path:
-
-    # URI identifying the type of the predicate. Required when using "predicate"
-    # or "predicate-path" for custom attestations.
+    # URI identifying the type of the predicate.
     predicate-type:
 
     # String containing the value for the attestation predicate. String length
     # cannot exceed 16MB. Must supply exactly one of "predicate-path" or
-    # "predicate" when creating custom attestations.
+    # "predicate".
     predicate:
 
     # Path to the file which contains the content for the attestation predicate.
     # File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
-    # or "predicate" when creating custom attestations.
+    # or "predicate".
     predicate-path:
 
     # Whether to push the attestation to the image registry. Requires that the
@@ -185,13 +166,13 @@ string cannot exceed 16MB.
 
 ## Examples
 
-### Provenance Attestation (Default)
+### Identify Subject by Path
 
-The simplest use case - just specify the artifact path and a SLSA build
-provenance attestation is automatically generated:
+For the basic use case, simply add the `attest` action to your workflow and
+supply the path to the artifact for which you want to generate attestation.
 
 ```yaml
-name: build-attest-provenance
+name: build-attest
 
 on:
   workflow_dispatch:
@@ -209,36 +190,11 @@ jobs:
       - name: Build artifact
         run: make my-app
       - name: Attest
-        uses: actions/attest@v4
+        uses: actions/attest@v2
         with:
           subject-path: '${{ github.workspace }}/my-app'
-```
-
-### SBOM Attestation
-
-To create an SBOM attestation, provide the path to an SPDX or CycloneDX JSON
-file:
-
-```yaml
-- name: Generate SBOM
-  run: syft . -o spdx-json > sbom.spdx.json
-
-- uses: actions/attest@v4
-  with:
-    subject-path: '${{ github.workspace }}/my-app'
-    sbom-path: '${{ github.workspace }}/sbom.spdx.json'
-```
-
-### Custom Attestation
-
-For custom attestations, provide your own predicate type and content:
-
-```yaml
-- uses: actions/attest@v4
-  with:
-    subject-path: '${{ github.workspace }}/my-app'
-    predicate-type: 'https://example.com/predicate/v1'
-    predicate: '{}'
+          predicate-type: 'https://example.com/predicate/v1'
+          predicate: '{}'
 ```
 
 ### Identify Multiple Subjects
@@ -247,7 +203,7 @@ If you are generating multiple artifacts, you can attest all of them at the same
 time by using a wildcard in the `subject-path` input.
 
 ```yaml
-- uses: actions/attest@v4
+- uses: actions/attest@v2
   with:
     subject-path: 'dist/**/my-bin-*'
     predicate-type: 'https://example.com/predicate/v1'
@@ -261,13 +217,13 @@ Alternatively, you can explicitly list multiple subjects with either a comma or
 newline delimited list:
 
 ```yaml
-- uses: actions/attest@v4
+- uses: actions/attest@v2
   with:
     subject-path: 'dist/foo, dist/bar'
 ```
 
 ```yaml
-- uses: actions/attest@v4
+- uses: actions/attest@v2
   with:
     subject-path: |
       dist/foo
@@ -289,9 +245,11 @@ attestation.
   run: |
     shasum -a 256 foo_0.0.1_* > subject.checksums.txt
 
-- uses: actions/attest@v4
+- uses: actions/attest@v2
   with:
     subject-checksums: subject.checksums.txt
+    predicate-type: 'https://example.com/predicate/v1'
+    predicate: '{}'
 ```
 
 <!-- markdownlint-disable MD038 -->
@@ -364,11 +322,13 @@ jobs:
           push: true
           tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
       - name: Attest
-        uses: actions/attest@v4
+        uses: actions/attest@v2
         id: attest
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.push.outputs.digest }}
+          predicate-type: 'https://in-toto.io/attestation/release/v0.1'
+          predicate: '{"purl":"pkg:oci/..."}'
           push-to-registry: true
 ```
 
@@ -383,4 +343,3 @@ jobs:
 [8]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns
 [9]:
   https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
-[10]: https://slsa.dev/spec/v1.0/provenance

__tests__/attest.test.ts

@@ -1,195 +0,0 @@
-import { jest } from '@jest/globals'
-import type { Descriptor } from '@sigstore/oci'
-// Mock functions
-const mockGetOctokit = jest.fn()
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const mockAttest = jest.fn<() => Promise<any>>()
-const mockCreateStorageRecord = jest.fn<() => Promise<number[]>>()
-const mockGetRegistryCredentials = jest.fn()
-const mockAttachArtifactToImage = jest.fn<() => Promise<Descriptor>>()
-
-// Mock @actions/github
-jest.unstable_mockModule('@actions/github', () => ({
-  getOctokit: mockGetOctokit,
-  context: {
-    repo: { owner: 'foo', repo: 'bar' },
-    payload: { repository: { visibility: 'private' } }
-  }
-}))
-
-// Mock @actions/attest
-jest.unstable_mockModule('@actions/attest', () => ({
-  attest: mockAttest,
-  createStorageRecord: mockCreateStorageRecord
-}))
-
-// Mock @sigstore/oci
-jest.unstable_mockModule('@sigstore/oci', () => ({
-  getRegistryCredentials: mockGetRegistryCredentials,
-  attachArtifactToImage: mockAttachArtifactToImage
-}))
-
-// Dynamic imports after mocking
-const { createAttestation, repoOwnerIsOrg } = await import('../src/attest')
-
-const subjectName = 'ghcr.io/foo/bar'
-const subjectDigest =
-  'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
-
-const predicate = {
-  type: 'https://in-toto.io/attestation/release/v0.1',
-  params: {}
-}
-
-describe('repoOwnerIsOrg', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-  })
-
-  it('returns true when repo owner is an organization', async () => {
-    mockGetOctokit.mockReturnValue({
-      rest: {
-        repos: {
-          get: jest
-            .fn<() => Promise<{ data: { owner: { type: string } } }>>()
-            .mockResolvedValue({
-              data: { owner: { type: 'Organization' } }
-            })
-        }
-      }
-    })
-
-    const result = await repoOwnerIsOrg('gh-token')
-    expect(result).toBe(true)
-  })
-
-  it('returns false when repo owner is a user', async () => {
-    mockGetOctokit.mockReturnValue({
-      rest: {
-        repos: {
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any
-          get: jest.fn<() => Promise<any>>().mockResolvedValue({
-            data: { owner: { type: 'User' } }
-          })
-        }
-      }
-    })
-
-    const result = await repoOwnerIsOrg('gh-token')
-    expect(result).toBe(false)
-  })
-})
-
-describe('createAttestation', () => {
-  beforeEach(() => {
-    jest.clearAllMocks()
-
-    // Default mock implementations
-    mockAttest.mockResolvedValue({
-      bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' },
-      certificate: 'cert',
-      tlogID: 'tlog-123',
-      attestationID: 'att-123'
-    })
-
-    mockGetRegistryCredentials.mockReturnValue({
-      username: 'user',
-      password: 'pass'
-    })
-
-    mockAttachArtifactToImage.mockResolvedValue({
-      digest: 'sha256:abc123',
-      mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
-      size: 100
-    })
-  })
-
-  describe('when createStorageRecord is false', () => {
-    it('skips storage record creation', async () => {
-      const subjects = [
-        {
-          name: subjectName,
-          digest: { sha256: subjectDigest.replace('sha256:', '') }
-        }
-      ]
-
-      const result = await createAttestation(subjects, predicate, {
-        sigstoreInstance: 'github',
-        pushToRegistry: true,
-        createStorageRecord: false,
-        githubToken: 'gh-token'
-      })
-
-      expect(result.attestationDigest).toBe('sha256:abc123')
-      expect(mockCreateStorageRecord).not.toHaveBeenCalled()
-    })
-  })
-
-  describe('when storage records are empty', () => {
-    beforeEach(() => {
-      mockGetOctokit.mockReturnValue({
-        rest: {
-          repos: {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            get: jest.fn<() => Promise<any>>().mockResolvedValue({
-              data: { owner: { type: 'Organization' } }
-            })
-          }
-        }
-      })
-      mockCreateStorageRecord.mockResolvedValue([])
-    })
-
-    it('handles empty storage records gracefully', async () => {
-      const subjects = [
-        {
-          name: subjectName,
-          digest: { sha256: subjectDigest.replace('sha256:', '') }
-        }
-      ]
-
-      const result = await createAttestation(subjects, predicate, {
-        sigstoreInstance: 'github',
-        pushToRegistry: true,
-        createStorageRecord: true,
-        githubToken: 'gh-token'
-      })
-
-      expect(result.attestationDigest).toBe('sha256:abc123')
-    })
-  })
-
-  describe('when subject has unsupported protocol', () => {
-    beforeEach(() => {
-      mockGetOctokit.mockReturnValue({
-        rest: {
-          repos: {
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            get: jest.fn<() => Promise<any>>().mockResolvedValue({
-              data: { owner: { type: 'Organization' } }
-            })
-          }
-        }
-      })
-      mockCreateStorageRecord.mockResolvedValue([123])
-    })
-
-    it('handles unsupported protocol gracefully', async () => {
-      const subjects = [
-        {
-          name: 'http://registry.example.com/foo/bar',
-          digest: { sha256: subjectDigest.replace('sha256:', '') }
-        }
-      ]
-
-      const result = await createAttestation(subjects, predicate, {
-        sigstoreInstance: 'github',
-        pushToRegistry: true,
-        createStorageRecord: true,
-        githubToken: 'gh-token'
-      })
-
-      expect(result.attestationDigest).toBe('sha256:abc123')
-    })
-  })
-})

__tests__/detect.test.ts

@@ -1,190 +0,0 @@
-import {
-  detectAttestationType,
-  validateAttestationInputs,
-  DetectionInputs
-} from '../src/detect'
-
-describe('detectAttestationType', () => {
-  const blankInputs: DetectionInputs = {
-    sbomPath: '',
-    predicateType: '',
-    predicate: '',
-    predicatePath: ''
-  }
-
-  describe('when no inputs are provided', () => {
-    it('returns provenance', () => {
-      expect(detectAttestationType(blankInputs)).toBe('provenance')
-    })
-  })
-
-  describe('when sbom-path is provided', () => {
-    it('returns sbom', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        sbomPath: '/path/to/sbom.json'
-      }
-      expect(detectAttestationType(inputs)).toBe('sbom')
-    })
-
-    it('returns sbom even when predicate inputs are also provided', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        sbomPath: '/path/to/sbom.json',
-        predicateType: 'https://example.com/predicate'
-      }
-      expect(detectAttestationType(inputs)).toBe('sbom')
-    })
-  })
-
-  describe('when predicate-type is provided', () => {
-    it('returns custom', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicateType: 'https://example.com/predicate'
-      }
-      expect(detectAttestationType(inputs)).toBe('custom')
-    })
-  })
-
-  describe('when predicate is provided', () => {
-    it('returns custom', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicate: '{}'
-      }
-      expect(detectAttestationType(inputs)).toBe('custom')
-    })
-  })
-
-  describe('when predicate-path is provided', () => {
-    it('returns custom', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicatePath: '/path/to/predicate.json'
-      }
-      expect(detectAttestationType(inputs)).toBe('custom')
-    })
-  })
-
-  describe('when predicate-type and predicate are provided', () => {
-    it('returns custom', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicateType: 'https://example.com/predicate',
-        predicate: '{}'
-      }
-      expect(detectAttestationType(inputs)).toBe('custom')
-    })
-  })
-})
-
-describe('validateAttestationInputs', () => {
-  const blankInputs: DetectionInputs = {
-    sbomPath: '',
-    predicateType: '',
-    predicate: '',
-    predicatePath: ''
-  }
-
-  describe('when no inputs are provided', () => {
-    it('does not throw', () => {
-      expect(() => validateAttestationInputs(blankInputs)).not.toThrow()
-    })
-  })
-
-  describe('when sbom-path is provided alone', () => {
-    it('does not throw', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        sbomPath: '/path/to/sbom.json'
-      }
-      expect(() => validateAttestationInputs(inputs)).not.toThrow()
-    })
-  })
-
-  describe('when sbom-path is combined with predicate-type', () => {
-    it('throws an error', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        sbomPath: '/path/to/sbom.json',
-        predicateType: 'https://example.com/predicate'
-      }
-      expect(() => validateAttestationInputs(inputs)).toThrow(
-        /Cannot specify sbom-path together with/
-      )
-    })
-  })
-
-  describe('when sbom-path is combined with predicate', () => {
-    it('throws an error', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        sbomPath: '/path/to/sbom.json',
-        predicate: '{}'
-      }
-      expect(() => validateAttestationInputs(inputs)).toThrow(
-        /Cannot specify sbom-path together with/
-      )
-    })
-  })
-
-  describe('when sbom-path is combined with predicate-path', () => {
-    it('throws an error', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        sbomPath: '/path/to/sbom.json',
-        predicatePath: '/path/to/predicate.json'
-      }
-      expect(() => validateAttestationInputs(inputs)).toThrow(
-        /Cannot specify sbom-path together with/
-      )
-    })
-  })
-
-  describe('when predicate is provided without predicate-type', () => {
-    it('throws an error', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicate: '{}'
-      }
-      expect(() => validateAttestationInputs(inputs)).toThrow(
-        /predicate-type is required/
-      )
-    })
-  })
-
-  describe('when predicate-path is provided without predicate-type', () => {
-    it('throws an error', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicatePath: '/path/to/predicate.json'
-      }
-      expect(() => validateAttestationInputs(inputs)).toThrow(
-        /predicate-type is required/
-      )
-    })
-  })
-
-  describe('when predicate-type and predicate are provided', () => {
-    it('does not throw', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicateType: 'https://example.com/predicate',
-        predicate: '{}'
-      }
-      expect(() => validateAttestationInputs(inputs)).not.toThrow()
-    })
-  })
-
-  describe('when predicate-type and predicate-path are provided', () => {
-    it('does not throw', () => {
-      const inputs: DetectionInputs = {
-        ...blankInputs,
-        predicateType: 'https://example.com/predicate',
-        predicatePath: '/path/to/predicate.json'
-      }
-      expect(() => validateAttestationInputs(inputs)).not.toThrow()
-    })
-  })
-})

__tests__/index.test.ts

@@ -1,35 +1,28 @@
 /**
  * Unit tests for the action's entrypoint, src/index.ts
  */
-import { jest } from '@jest/globals'
 
-// Mock functions
-const mockRun = jest.fn()
-const mockGetInput = jest.fn()
-const mockGetBooleanInput = jest.fn()
+import { jest, describe, expect, beforeEach } from '@jest/globals'
 
-// Mock @actions/core
-jest.unstable_mockModule('@actions/core', () => ({
-  getInput: mockGetInput,
-  getBooleanInput: mockGetBooleanInput
+// Mock modules before importing them
+const runMock = jest.fn<() => Promise<void>>()
+
+jest.unstable_mockModule('../src/main', () => ({
+  run: runMock
 }))
 
-// Mock ../src/main
-jest.unstable_mockModule('../src/main', () => ({
-  run: mockRun
+jest.unstable_mockModule('@actions/core', () => ({
+  getInput: jest.fn(() => ''),
+  getBooleanInput: jest.fn(() => false)
 }))
 
 describe('index', () => {
   beforeEach(() => {
     jest.clearAllMocks()
-    mockGetBooleanInput.mockReturnValue(false)
-    mockGetInput.mockReturnValue('')
   })
-
   it('calls run when imported', async () => {
-    // Dynamic import after mocking
-    await import('../src/index')
+    await import('../src/index.js')
 
-    expect(mockRun).toHaveBeenCalled()
+    expect(runMock).toHaveBeenCalled()
   })
 })

__tests__/main.test.ts

@@ -5,64 +5,38 @@
  * Specifically, the inputs listed in `action.yml` should be set as environment
  * variables following the pattern `INPUT_<INPUT_NAME>`.
  */
-import type { Predicate } from '@actions/attest'
-import { jest } from '@jest/globals'
-import type { RunInputs } from '../src/main'
+import {
+  jest,
+  describe,
+  expect,
+  beforeEach,
+  afterEach,
+  it
+} from '@jest/globals'
+import type { RunInputs } from '../src/main.js'
 
-// Create mock functions before mocking modules
+// Create mock functions for core
 const infoMock = jest.fn()
 const warningMock = jest.fn()
 const startGroupMock = jest.fn()
 const endGroupMock = jest.fn()
 const setOutputMock = jest.fn()
 const setFailedMock = jest.fn()
-const debugMock = jest.fn()
+const summaryWriteMock = jest.fn<() => Promise<void>>()
 
-// OCI mocks
-const getRegCredsMock = jest.fn()
-const attachArtifactMock = jest.fn()
-
-// Attest mocks
-const attestMock = jest.fn()
-const createStorageRecordMock = jest.fn()
-
-// Local attest mocks
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const createAttestationMock = jest.fn<() => Promise<any>>()
-const repoOwnerIsOrgMock = jest.fn()
-
-// Provenance mock
-const generateProvenancePredicateMock = jest.fn<() => Promise<Predicate>>()
-
-// GitHub context mock
-const mockContext = {
-  repo: { owner: 'foo', repo: 'bar' },
-  payload: { repository: { visibility: 'private' } }
-}
-const mockGetOctokit = jest.fn()
-
-// Summary mock with chainable methods
-const summaryMock = {
-  write: jest.fn().mockReturnThis(),
-  addRaw: jest.fn().mockReturnThis(),
+// Create a mock summary object
+const mockSummary = {
   addHeading: jest.fn().mockReturnThis(),
-  addLink: jest.fn().mockReturnThis(),
+  addRaw: jest.fn().mockReturnThis(),
   addTable: jest.fn().mockReturnThis(),
-  addBreak: jest.fn().mockReturnThis(),
   addSeparator: jest.fn().mockReturnThis(),
-  addQuote: jest.fn().mockReturnThis(),
-  addCodeBlock: jest.fn().mockReturnThis(),
+  addLink: jest.fn().mockReturnThis(),
+  addBreak: jest.fn().mockReturnThis(),
   addList: jest.fn().mockReturnThis(),
-  addImage: jest.fn().mockReturnThis(),
-  addDetails: jest.fn().mockReturnThis(),
-  addEOL: jest.fn().mockReturnThis(),
-  emptyBuffer: jest.fn().mockReturnThis(),
-  stringify: jest.fn().mockReturnValue(''),
-  isEmptyBuffer: jest.fn().mockReturnValue(true),
-  clear: jest.fn().mockReturnThis()
+  write: summaryWriteMock.mockResolvedValue(undefined)
 }
 
-// Mock @actions/core
+// Mock @actions/core before importing
 jest.unstable_mockModule('@actions/core', () => ({
   info: infoMock,
   warning: warningMock,
@@ -70,20 +44,21 @@ jest.unstable_mockModule('@actions/core', () => ({
   endGroup: endGroupMock,
   setOutput: setOutputMock,
   setFailed: setFailedMock,
-  debug: debugMock,
-  summary: summaryMock
+  summary: mockSummary
 }))
 
-// Mock @actions/github
-jest.unstable_mockModule('@actions/github', () => ({
-  context: mockContext,
-  getOctokit: mockGetOctokit
-}))
+// Create mocks for OCI and attest modules
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const getRegistryCredentialsMock = jest.fn<(...args: any[]) => any>()
+const attachArtifactToImageMock = jest.fn<(...args: any[]) => any>()
+const createStorageRecordMock = jest.fn<(...args: any[]) => any>()
+const attestMock = jest.fn<(...args: any[]) => any>()
+/* eslint-enable @typescript-eslint/no-explicit-any */
 
 // Mock @sigstore/oci
 jest.unstable_mockModule('@sigstore/oci', () => ({
-  getRegistryCredentials: getRegCredsMock,
-  attachArtifactToImage: attachArtifactMock
+  getRegistryCredentials: getRegistryCredentialsMock,
+  attachArtifactToImage: attachArtifactToImageMock
 }))
 
 // Mock @actions/attest
@@ -92,25 +67,42 @@ jest.unstable_mockModule('@actions/attest', () => ({
   createStorageRecord: createStorageRecordMock
 }))
 
-// Mock ../src/attest
-jest.unstable_mockModule('../src/attest', () => ({
-  createAttestation: createAttestationMock,
-  repoOwnerIsOrg: repoOwnerIsOrgMock
+// Create a mutable context object for @actions/github
+const mockContext: Record<string, unknown> = {}
+
+// Mock for getOctokit to return a mock octokit client
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const mockReposGet = jest.fn<(...args: any[]) => any>()
+const mockOctokit = {
+  rest: {
+    repos: {
+      get: mockReposGet
+    }
+  }
+}
+
+jest.unstable_mockModule('@actions/github', () => ({
+  context: mockContext,
+  getOctokit: jest.fn(() => mockOctokit)
 }))
 
-// Mock ../src/provenance
-jest.unstable_mockModule('../src/provenance', () => ({
-  generateProvenancePredicate: generateProvenancePredicateMock
-}))
+// Helper to set the mocked GitHub context
+function setGHContext(context: object): void {
+  Object.keys(mockContext).forEach(key => delete mockContext[key])
+  Object.assign(mockContext, context)
+}
 
-// Dynamic imports after mocking
+// Now import the modules after mocking
 const { mockFulcio, mockRekor, mockTSA } = await import('@sigstore/mock')
 const fs = (await import('fs/promises')).default
 const nock = (await import('nock')).default
 const os = (await import('os')).default
 const path = (await import('path')).default
 const { MockAgent, setGlobalDispatcher } = await import('undici')
-const { run } = await import('../src/main')
+const { SEARCH_PUBLIC_GOOD_URL } = await import('../src/endpoints.js')
+const { run } = (await import('../src/main.js')) as {
+  run: (inputs: RunInputs) => Promise<void>
+}
 
 // MockAgent for mocking @actions/github
 const mockAgent = new MockAgent()
@@ -120,7 +112,6 @@ const defaultInputs: RunInputs = {
   predicate: '',
   predicateType: '',
   predicatePath: '',
-  sbomPath: '',
   subjectName: '',
   subjectDigest: '',
   subjectPath: '',
@@ -133,12 +124,8 @@ const defaultInputs: RunInputs = {
 }
 
 describe('action', () => {
-  // Capture original environment variables so we can restore after each test
+  // Capture original environment variables so we can restore them after each test
   const originalEnv = process.env
-  const originalContext = {
-    repo: { owner: 'foo', repo: 'bar' },
-    payload: { repository: { visibility: 'private' } }
-  }
 
   // Mock OIDC token endpoint
   const tokenURL = 'https://token.url'
@@ -162,6 +149,34 @@ describe('action', () => {
   beforeEach(() => {
     jest.clearAllMocks()
 
+    // Set up default GitHub context with empty payload
+    setGHContext({
+      payload: {},
+      repo: { owner: 'test-owner', repo: 'test-repo' }
+    })
+
+    // Set up default return value for attestMock (without tlogID for private/GitHub sigstore)
+    attestMock.mockResolvedValue({
+      attestationID,
+      bundle: {
+        mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
+        verificationMaterial: {
+          certificate: {
+            rawBytes: Buffer.from(
+              '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----'
+            ).toString('base64')
+          },
+          tlogEntries: []
+        },
+        content: {}
+      },
+      certificate:
+        '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----'
+    })
+
+    // Set up default return value for createStorageRecordMock (returns array of record IDs)
+    createStorageRecordMock.mockResolvedValue([storageRecordID])
+
     nock(tokenURL)
       .get('/')
       .query({ audience: 'sigstore' })
@@ -194,8 +209,8 @@ describe('action', () => {
     // Restore the original environment
     process.env = originalEnv
 
-    // Restore the original github.context
-    setGHContext(originalContext)
+    // Clear the github context
+    setGHContext({ payload: {}, repo: { owner: '', repo: '' } })
   })
 
   describe('when ACTIONS_ID_TOKEN_REQUEST_URL is not set', () => {
@@ -253,16 +268,6 @@ describe('action', () => {
         repo: { owner: 'foo', repo: 'bar' }
       })
 
-      // Mock createAttestation to return expected values
-      createAttestationMock.mockResolvedValue({
-        attestationID,
-        certificate:
-          '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
-        tlogID: 'tlog-123',
-        attestationDigest: 'sha256:123456',
-        bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
-      })
-
       await mockFulcio({
         baseURL: 'https://fulcio.githubapp.com',
         strict: false
@@ -274,13 +279,44 @@ describe('action', () => {
       await run(inputs)
 
       expect(setFailedMock).not.toHaveBeenCalled()
-      expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
-      expect(infoMock).toHaveBeenCalledWith(
+      expect(infoMock).toHaveBeenNthCalledWith(
+        1,
         expect.stringMatching(
           `Attestation created for ${subjectName}@${subjectDigest}`
         )
       )
-      expect(createAttestationMock).toHaveBeenCalled()
+      expect(startGroupMock).toHaveBeenNthCalledWith(
+        1,
+        expect.stringMatching('GitHub Sigstore')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        2,
+        expect.stringMatching('-----BEGIN CERTIFICATE-----')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        3,
+        expect.stringMatching(/attestation uploaded/i)
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        4,
+        expect.stringMatching(attestationID)
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        1,
+        'bundle-path',
+        expect.stringMatching('attestation.json')
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        2,
+        'attestation-id',
+        expect.stringMatching(attestationID)
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        3,
+        'attestation-url',
+        expect.stringContaining(`foo/bar/attestations/${attestationID}`)
+      )
+      expect(setFailedMock).not.toHaveBeenCalled()
     })
   })
 
@@ -302,33 +338,45 @@ describe('action', () => {
         repo: { owner: 'foo', repo: 'bar' }
       })
 
-      // Setup createAttestation mock
-      createAttestationMock.mockResolvedValue({
-        attestationID,
-        certificate:
-          '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
-        tlogID: 'tlog-123',
-        attestationDigest: 'sha256:123456',
-        bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' },
-        storageRecordIds: [storageRecordID]
-      })
-
       await mockFulcio({
         baseURL: 'https://fulcio.sigstore.dev',
         strict: false
       })
       await mockRekor({ baseURL: 'https://rekor.sigstore.dev' })
 
-      mockGetOctokit.mockReturnValue({
-        rest: {
-          repos: {
-            get: jest
-              .fn<() => Promise<{ data: { owner: { type: string } } }>>()
-              .mockResolvedValue({
-                data: { owner: { type: 'Organization' } }
-              })
-          }
-        }
+      getRegistryCredentialsMock.mockImplementation(() => ({
+        username: 'username',
+        password: 'password'
+      }))
+      attachArtifactToImageMock.mockResolvedValue({
+        digest: 'sha256:123456',
+        mediaType: 'application/vnd.cncf.notary.v2',
+        size: 123456
+      })
+
+      // Set up attestMock with tlogID for public good sigstore
+      attestMock.mockResolvedValue({
+        attestationID,
+        bundle: {
+          mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
+          verificationMaterial: {
+            certificate: {
+              rawBytes: Buffer.from(
+                '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----'
+              ).toString('base64')
+            },
+            tlogEntries: [{ logIndex: '123' }]
+          },
+          content: {}
+        },
+        certificate:
+          '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
+        tlogID: '123'
+      })
+
+      // Mock the repos.get API call for repoOwnerIsOrg check
+      mockReposGet.mockResolvedValue({
+        data: { owner: { type: 'Organization' } }
       })
     })
 
@@ -336,53 +384,121 @@ describe('action', () => {
       await run(inputs)
 
       expect(setFailedMock).not.toHaveBeenCalled()
-      expect(createAttestationMock).toHaveBeenCalled()
-      expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
-      expect(infoMock).toHaveBeenCalledWith(
+      expect(getRegistryCredentialsMock).toHaveBeenCalledWith(subjectName)
+      expect(attachArtifactToImageMock).toHaveBeenCalled()
+      expect(attestMock).toHaveBeenCalled()
+      expect(createStorageRecordMock).toHaveBeenCalled()
+      expect(warningMock).not.toHaveBeenCalled()
+      expect(infoMock).toHaveBeenNthCalledWith(
+        1,
         expect.stringMatching(
           `Attestation created for ${subjectName}@${subjectDigest}`
         )
       )
+      expect(startGroupMock).toHaveBeenNthCalledWith(
+        1,
+        expect.stringMatching('Public Good Sigstore')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        2,
+        expect.stringMatching('-----BEGIN CERTIFICATE-----')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        3,
+        expect.stringMatching(/signature uploaded/i)
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        4,
+        expect.stringMatching(SEARCH_PUBLIC_GOOD_URL)
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        5,
+        expect.stringMatching(/attestation uploaded/i)
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        6,
+        expect.stringMatching(attestationID)
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        9,
+        expect.stringMatching('Storage record created')
+      )
+      expect(infoMock).toHaveBeenNthCalledWith(
+        10,
+        expect.stringMatching('Storage record IDs: 987654321')
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        1,
+        'bundle-path',
+        expect.stringMatching('attestation.json')
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        2,
+        'attestation-id',
+        expect.stringMatching(attestationID)
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        3,
+        'attestation-url',
+        expect.stringContaining(`foo/bar/attestations/${attestationID}`)
+      )
+      expect(setOutputMock).toHaveBeenNthCalledWith(
+        4,
+        'storage-record-ids',
+        expect.stringMatching(storageRecordID.toString())
+      )
+      expect(setFailedMock).not.toHaveBeenCalled()
     })
 
     it('catches error when storage record creation fails and continues', async () => {
-      // Mock createAttestation to simulate storage record failure (but still succeed overall)
-      createAttestationMock.mockResolvedValue({
-        attestationID,
-        certificate:
-          '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
-        tlogID: 'tlog-123',
-        attestationDigest: 'sha256:123456',
-        bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
-        // No storageRecordIDs - simulates empty/failed storage record
-      })
+      // Mock the createStorageRecord function and throw an error
+      createStorageRecordMock.mockRejectedValueOnce(
+        new Error('Failed to persist storage record: Not Found')
+      )
 
       await run(inputs)
 
-      expect(createAttestationMock).toHaveBeenCalled()
+      expect(attestMock).toHaveBeenCalled()
+      expect(createStorageRecordMock).toHaveBeenCalled()
       expect(setFailedMock).not.toHaveBeenCalled()
+      expect(warningMock).toHaveBeenNthCalledWith(
+        1,
+        expect.stringMatching('Failed to create storage record')
+      )
     })
 
     it('does not create a storage record when the repo is owned by a user', async () => {
-      // Mock createAttestation to not return storage record IDs
-      createAttestationMock.mockResolvedValue({
-        attestationID,
-        certificate:
-          '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
-        tlogID: 'tlog-123',
-        attestationDigest: 'sha256:123456',
-        bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
-      })
+      // Mock the repos.get API to return a user-owned repo
+      mockReposGet.mockResolvedValueOnce({ data: { owner: { type: 'User' } } })
 
       await run(inputs)
 
       expect(setFailedMock).not.toHaveBeenCalled()
-      expect(createAttestationMock).toHaveBeenCalled()
+      expect(getRegistryCredentialsMock).toHaveBeenCalledWith(subjectName)
+      expect(attachArtifactToImageMock).toHaveBeenCalled()
+      expect(attestMock).toHaveBeenCalled()
+      expect(createStorageRecordMock).not.toHaveBeenCalled()
+      expect(warningMock).not.toHaveBeenCalled()
       expect(infoMock).toHaveBeenCalledWith(
         expect.stringMatching(
           `Attestation created for ${subjectName}@${subjectDigest}`
         )
       )
+      expect(infoMock).not.toHaveBeenCalledWith(
+        expect.stringMatching('Storage record created')
+      )
+      expect(infoMock).not.toHaveBeenCalledWith(
+        expect.stringMatching('Storage record IDs: 987654321')
+      )
+      expect(setOutputMock).toHaveBeenCalledWith(
+        'attestation-id',
+        expect.stringMatching(attestationID)
+      )
+      expect(setOutputMock).not.toHaveBeenCalledWith(
+        'storage-record-ids',
+        expect.stringMatching(storageRecordID.toString())
+      )
+      expect(setFailedMock).not.toHaveBeenCalled()
     })
   })
 
@@ -435,9 +551,8 @@ describe('action', () => {
       await run(inputs)
 
       expect(setFailedMock).not.toHaveBeenCalled()
-      expect(infoMock).toHaveBeenNthCalledWith(1, 'Attestation type: Custom')
       expect(infoMock).toHaveBeenNthCalledWith(
-        2,
+        1,
         expect.stringMatching('Attestation created for 5 subjects')
       )
     })
@@ -484,193 +599,9 @@ describe('action', () => {
 
       expect(setFailedMock).toHaveBeenCalledWith(
         new Error(
-          'Too many subjects specified (1025). The maximum number of subjects is 1024.'
+          'Too many subjects specified. The maximum number of subjects is 1024.'
         )
       )
     })
   })
-
-  describe('attestation type detection', () => {
-    describe('when sbom-path is provided with predicate inputs', () => {
-      it('sets a failed status for conflicting inputs', async () => {
-        const inputs: RunInputs = {
-          ...defaultInputs,
-          subjectDigest,
-          subjectName,
-          sbomPath: '/path/to/sbom.json',
-          predicateType: 'https://example.com/predicate',
-          githubToken: 'gh-token'
-        }
-
-        await run(inputs)
-
-        expect(setFailedMock).toHaveBeenCalledWith(
-          new Error(
-            'Cannot specify sbom-path together with predicate-type, predicate, or predicate-path'
-          )
-        )
-      })
-    })
-
-    describe('when predicate is provided without predicate-type', () => {
-      it('sets a failed status for missing predicate-type', async () => {
-        const inputs: RunInputs = {
-          ...defaultInputs,
-          subjectDigest,
-          subjectName,
-          predicate: '{}',
-          githubToken: 'gh-token'
-        }
-
-        await run(inputs)
-
-        expect(setFailedMock).toHaveBeenCalledWith(
-          new Error(
-            'predicate-type is required when using predicate or predicate-path'
-          )
-        )
-      })
-    })
-
-    describe('when custom attestation inputs are provided', () => {
-      const inputs: RunInputs = {
-        ...defaultInputs,
-        subjectDigest,
-        subjectName,
-        predicateType,
-        predicate,
-        githubToken: 'gh-token'
-      }
-
-      beforeEach(async () => {
-        setGHContext({
-          payload: { repository: { visibility: 'private' } },
-          repo: { owner: 'foo', repo: 'bar' }
-        })
-
-        await mockFulcio({
-          baseURL: 'https://fulcio.githubapp.com',
-          strict: false
-        })
-        await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
-      })
-
-      it('logs the attestation type as Custom', async () => {
-        await run(inputs)
-
-        expect(setFailedMock).not.toHaveBeenCalled()
-        expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
-      })
-    })
-
-    describe('when provenance attestation is detected', () => {
-      const inputs: RunInputs = {
-        ...defaultInputs,
-        subjectDigest,
-        subjectName,
-        githubToken: 'gh-token'
-      }
-
-      const mockProvPredicate = {
-        type: 'https://slsa.dev/provenance/v1',
-        params: { buildDefinition: {}, runDetails: {} }
-      }
-
-      beforeEach(async () => {
-        // Configure mock for provenance predicate
-        generateProvenancePredicateMock.mockResolvedValue(mockProvPredicate)
-
-        // Configure mock for createAttestation
-        createAttestationMock.mockResolvedValue({
-          attestationID: '1234567890',
-          certificate:
-            '-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
-          tlogID: 'tlog-123',
-          attestationDigest: 'sha256:123456',
-          bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
-        })
-
-        setGHContext({
-          payload: { repository: { visibility: 'private' } },
-          repo: { owner: 'foo', repo: 'bar' }
-        })
-
-        await mockFulcio({
-          baseURL: 'https://fulcio.githubapp.com',
-          strict: false
-        })
-        await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
-      })
-
-      it('logs the attestation type as Build Provenance and generates predicate', async () => {
-        await run(inputs)
-
-        expect(setFailedMock).not.toHaveBeenCalled()
-        expect(infoMock).toHaveBeenCalledWith(
-          'Attestation type: Build Provenance'
-        )
-      })
-    })
-
-    describe('when sbom attestation is detected', () => {
-      let tmpDir: string
-      let sbomFilePath: string
-
-      const spdxSBOM = {
-        spdxVersion: 'SPDX-2.3',
-        SPDXID: 'SPDXRef-DOCUMENT',
-        name: 'test-package',
-        packages: []
-      }
-
-      beforeEach(async () => {
-        tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'main-test-'))
-        sbomFilePath = path.join(tmpDir, 'sbom.spdx.json')
-        await fs.writeFile(sbomFilePath, JSON.stringify(spdxSBOM))
-
-        setGHContext({
-          payload: { repository: { visibility: 'private' } },
-          repo: { owner: 'foo', repo: 'bar' }
-        })
-
-        await mockFulcio({
-          baseURL: 'https://fulcio.githubapp.com',
-          strict: false
-        })
-        await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
-      })
-
-      afterEach(async () => {
-        await fs.rm(tmpDir, { recursive: true })
-      })
-
-      it('logs the attestation type as SBOM and generates predicate', async () => {
-        const inputs: RunInputs = {
-          ...defaultInputs,
-          subjectDigest,
-          subjectName,
-          sbomPath: sbomFilePath,
-          githubToken: 'gh-token'
-        }
-
-        await run(inputs)
-
-        expect(setFailedMock).not.toHaveBeenCalled()
-        expect(infoMock).toHaveBeenCalledWith('Attestation type: SBOM')
-      })
-    })
-  })
 })
-
-// Helper to update the mock context
-function setGHContext(context: {
-  repo?: { owner: string; repo: string }
-  payload?: { repository?: { visibility: string } }
-}): void {
-  if (context.repo) {
-    mockContext.repo = context.repo
-  }
-  if (context.payload) {
-    mockContext.payload = context.payload as typeof mockContext.payload
-  }
-}

__tests__/predicate.test.ts

@@ -1,7 +1,7 @@
 import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'
-import { predicateFromInputs, PredicateInputs } from '../src/predicate'
+import { predicateFromInputs, PredicateInputs } from '../src/predicate.js'
 
 describe('subjectFromInputs', () => {
   const blankInputs: PredicateInputs = {
@@ -11,35 +11,33 @@ describe('subjectFromInputs', () => {
   }
 
   describe('when no inputs are provided', () => {
-    it('throws an error', async () => {
-      await expect(predicateFromInputs(blankInputs)).rejects.toThrow(
-        /predicate-type/i
-      )
+    it('throws an error', () => {
+      expect(() => predicateFromInputs(blankInputs)).toThrow(/predicate-type/i)
     })
   })
 
   describe('when neither predicate path nor predicate are provided', () => {
-    it('throws an error', async () => {
+    it('throws an error', () => {
       const inputs: PredicateInputs = {
         ...blankInputs,
         predicateType: 'https://example.com/predicate'
       }
 
-      await expect(predicateFromInputs(inputs)).rejects.toThrow(
+      expect(() => predicateFromInputs(inputs)).toThrow(
         /one of predicate-path or predicate must be provided/i
       )
     })
   })
 
   describe('when both predicate path and predicate are provided', () => {
-    it('throws an error', async () => {
+    it('throws an error', () => {
       const inputs: PredicateInputs = {
         predicateType: 'https://example.com/predicate',
         predicate: '{}',
         predicatePath: 'path/to/predicate'
       }
 
-      await expect(predicateFromInputs(inputs)).rejects.toThrow(
+      expect(() => predicateFromInputs(inputs)).toThrow(
         /only one of predicate-path or predicate may be provided/i
       )
     })
@@ -67,13 +65,13 @@ describe('subjectFromInputs', () => {
       await fs.rm(path.parse(predicatePath).dir, { recursive: true })
     })
 
-    it('returns the predicate', async () => {
+    it('returns the predicate', () => {
       const inputs: PredicateInputs = {
         ...blankInputs,
         predicateType,
         predicatePath
       }
-      await expect(predicateFromInputs(inputs)).resolves.toEqual({
+      expect(predicateFromInputs(inputs)).toEqual({
         type: predicateType,
         params: JSON.parse(content)
       })
@@ -84,15 +82,13 @@ describe('subjectFromInputs', () => {
     const predicateType = 'https://example.com/predicate'
     const predicatePath = 'foo'
 
-    it('returns the predicate', async () => {
+    it('returns the predicate', () => {
       const inputs: PredicateInputs = {
         ...blankInputs,
         predicateType,
         predicatePath
       }
-      await expect(predicateFromInputs(inputs)).rejects.toThrow(
-        /file not found/
-      )
+      expect(() => predicateFromInputs(inputs)).toThrow(/file not found/)
     })
   })
 
@@ -100,14 +96,14 @@ describe('subjectFromInputs', () => {
     const predicateType = 'https://example.com/predicate'
     const content = '{}'
 
-    it('returns the predicate', async () => {
+    it('returns the predicate', () => {
       const inputs: PredicateInputs = {
         ...blankInputs,
         predicateType,
         predicate: content
       }
 
-      await expect(predicateFromInputs(inputs)).resolves.toEqual({
+      expect(predicateFromInputs(inputs)).toEqual({
         type: predicateType,
         params: JSON.parse(content)
       })
@@ -118,14 +114,14 @@ describe('subjectFromInputs', () => {
     const predicateType = 'https://example.com/predicate'
     const content = JSON.stringify({ a: 'a'.repeat(16 * 1024 * 1024) })
 
-    it('throws an error', async () => {
+    it('throws an error', () => {
       const inputs: PredicateInputs = {
         ...blankInputs,
         predicateType,
         predicate: content
       }
 
-      await expect(predicateFromInputs(inputs)).rejects.toThrow(
+      expect(() => predicateFromInputs(inputs)).toThrow(
         /predicate string exceeds maximum/
       )
     })

__tests__/provenance.test.ts

@@ -1,48 +0,0 @@
-import type { Predicate } from '@actions/attest'
-import { jest } from '@jest/globals'
-
-// Mock function
-const mockBuildSLSAProvenancePredicate = jest.fn<() => Promise<Predicate>>()
-
-// Mock @actions/attest
-jest.unstable_mockModule('@actions/attest', () => ({
-  buildSLSAProvenancePredicate: mockBuildSLSAProvenancePredicate
-}))
-
-// Dynamic import after mocking
-const { generateProvenancePredicate } = await import('../src/provenance')
-
-describe('generateProvenancePredicate', () => {
-  const mockPredicate = {
-    type: 'https://slsa.dev/provenance/v1',
-    params: {
-      buildDefinition: {
-        buildType: 'https://actions.github.io/buildtypes/workflow/v1'
-      },
-      runDetails: {
-        builder: { id: 'https://github.com/actions/runner' }
-      }
-    }
-  }
-
-  beforeEach(() => {
-    jest.clearAllMocks()
-    mockBuildSLSAProvenancePredicate.mockResolvedValue(mockPredicate)
-  })
-
-  it('returns the SLSA provenance predicate', async () => {
-    const result = await generateProvenancePredicate()
-
-    expect(mockBuildSLSAProvenancePredicate).toHaveBeenCalledTimes(1)
-    expect(result).toEqual(mockPredicate)
-  })
-
-  it('propagates errors from buildSLSAProvenancePredicate', async () => {
-    const error = new Error('Failed to build provenance')
-    mockBuildSLSAProvenancePredicate.mockRejectedValue(error)
-
-    await expect(generateProvenancePredicate()).rejects.toThrow(
-      'Failed to build provenance'
-    )
-  })
-})

__tests__/sbom.test.ts

@@ -1,161 +0,0 @@
-import fs from 'fs/promises'
-import os from 'os'
-import path from 'path'
-import { parseSBOMFromPath, generateSBOMPredicate, SBOM } from '../src/sbom'
-
-describe('parseSBOMFromPath', () => {
-  let tmpDir: string
-
-  beforeEach(async () => {
-    tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sbom-test-'))
-  })
-
-  afterEach(async () => {
-    await fs.rm(tmpDir, { recursive: true })
-  })
-
-  describe('when file does not exist', () => {
-    it('throws an error', async () => {
-      await expect(parseSBOMFromPath('/nonexistent/file.json')).rejects.toThrow(
-        /SBOM file not found/
-      )
-    })
-  })
-
-  describe('when file contains valid SPDX SBOM', () => {
-    const spdxSBOM = {
-      spdxVersion: 'SPDX-2.3',
-      SPDXID: 'SPDXRef-DOCUMENT',
-      name: 'test-package',
-      packages: []
-    }
-
-    it('returns SBOM with type spdx', async () => {
-      const filePath = path.join(tmpDir, 'sbom.spdx.json')
-      await fs.writeFile(filePath, JSON.stringify(spdxSBOM))
-
-      const result = await parseSBOMFromPath(filePath)
-
-      expect(result.type).toBe('spdx')
-      expect(result.object).toEqual(spdxSBOM)
-    })
-  })
-
-  describe('when file contains valid CycloneDX SBOM', () => {
-    const cyclonedxSBOM = {
-      bomFormat: 'CycloneDX',
-      specVersion: '1.4',
-      serialNumber: 'urn:uuid:12345',
-      components: []
-    }
-
-    it('returns SBOM with type cyclonedx', async () => {
-      const filePath = path.join(tmpDir, 'sbom.cdx.json')
-      await fs.writeFile(filePath, JSON.stringify(cyclonedxSBOM))
-
-      const result = await parseSBOMFromPath(filePath)
-
-      expect(result.type).toBe('cyclonedx')
-      expect(result.object).toEqual(cyclonedxSBOM)
-    })
-  })
-
-  describe('when file contains invalid SBOM format', () => {
-    it('throws an error', async () => {
-      const filePath = path.join(tmpDir, 'invalid.json')
-      await fs.writeFile(filePath, JSON.stringify({ random: 'data' }))
-
-      await expect(parseSBOMFromPath(filePath)).rejects.toThrow(
-        /Unsupported SBOM format/
-      )
-    })
-  })
-
-  describe('when file contains invalid JSON', () => {
-    it('throws an error', async () => {
-      const filePath = path.join(tmpDir, 'invalid.json')
-      await fs.writeFile(filePath, 'not valid json')
-
-      await expect(parseSBOMFromPath(filePath)).rejects.toThrow()
-    })
-  })
-
-  describe('when file exceeds maximum size', () => {
-    it('throws an error', async () => {
-      const filePath = path.join(tmpDir, 'large.json')
-      // Create a file larger than 16MB
-      const largeContent = 'x'.repeat(17 * 1024 * 1024)
-      await fs.writeFile(filePath, largeContent)
-
-      await expect(parseSBOMFromPath(filePath)).rejects.toThrow(
-        /SBOM file exceeds maximum allowed size/
-      )
-    })
-  })
-})
-
-describe('generateSBOMPredicate', () => {
-  describe('for SPDX SBOM', () => {
-    const spdxSBOM: SBOM = {
-      type: 'spdx',
-      object: {
-        spdxVersion: 'SPDX-2.3',
-        SPDXID: 'SPDXRef-DOCUMENT',
-        name: 'test-package'
-      }
-    }
-
-    it('returns predicate with correct SPDX type', () => {
-      const predicate = generateSBOMPredicate(spdxSBOM)
-
-      expect(predicate.type).toBe('https://spdx.dev/Document/v2.3')
-      expect(predicate.params).toEqual(spdxSBOM.object)
-    })
-  })
-
-  describe('for CycloneDX SBOM', () => {
-    const cyclonedxSBOM: SBOM = {
-      type: 'cyclonedx',
-      object: {
-        bomFormat: 'CycloneDX',
-        specVersion: '1.4',
-        serialNumber: 'urn:uuid:12345'
-      }
-    }
-
-    it('returns predicate with correct CycloneDX type', () => {
-      const predicate = generateSBOMPredicate(cyclonedxSBOM)
-
-      expect(predicate.type).toBe('https://cyclonedx.org/bom')
-      expect(predicate.params).toEqual(cyclonedxSBOM.object)
-    })
-  })
-
-  describe('for SPDX without version', () => {
-    const invalidSBOM: SBOM = {
-      type: 'spdx',
-      object: {
-        SPDXID: 'SPDXRef-DOCUMENT'
-      }
-    }
-
-    it('throws an error', () => {
-      expect(() => generateSBOMPredicate(invalidSBOM)).toThrow(
-        /Cannot find spdxVersion/
-      )
-    })
-  })
-
-  describe('for unsupported SBOM type', () => {
-    const unsupportedSBOM = {
-      type: 'unknown' as SBOM['type'],
-      object: { foo: 'bar' }
-    }
-
-    it('throws an error', () => {
-      expect(() => generateSBOMPredicate(unsupportedSBOM)).toThrow(
-        /Unsupported SBOM format/
-      )
-    })
-  })
-})

__tests__/style.test.ts

@@ -1,4 +1,4 @@
-import { highlight, mute } from '../src/style'
+import { highlight, mute } from '../src/style.js'
 
 describe('style', () => {
   describe('highlight', () => {

__tests__/subject.test.ts

@@ -6,7 +6,7 @@ import {
   formatSubjectDigest,
   subjectFromInputs,
   SubjectInputs
-} from '../src/subject'
+} from '../src/subject.js'
 
 describe('subjectFromInputs', () => {
   const blankInputs: SubjectInputs = {
@@ -264,10 +264,15 @@ describe('subjectFromInputs', () => {
         expect(subjects).toBeDefined()
         expect(subjects).toHaveLength(3)
 
-        subjects.forEach((subject, i) => {
-          expect(subject.name).toEqual(`${filename}-${i}`)
-          expect(subject.digest).toEqual({ sha256: expectedDigest })
-        })
+        subjects.forEach(
+          (
+            subject: { name: string; digest: Record<string, string> },
+            i: number
+          ) => {
+            expect(subject.name).toEqual(`${filename}-${i}`)
+            expect(subject.digest).toEqual({ sha256: expectedDigest })
+          }
+        )
       })
     })
 
@@ -524,39 +529,6 @@ f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e  demo_0.0.1_lin
     })
   })
 
-  describe('when specifying a subject checksums string with duplicates', () => {
-    const checksums = `
-f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e  demo_0.0.1_linux_386
-f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e  demo_0.0.1_linux_386
-187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d *demo_0.0.1_linux_amd64`
-
-    it('returns de-duplicated subjects', async () => {
-      const inputs: SubjectInputs = {
-        ...blankInputs,
-        subjectChecksums: checksums
-      }
-      const subjects = await subjectFromInputs(inputs)
-
-      expect(subjects).toBeDefined()
-      expect(subjects).toHaveLength(2)
-
-      expect(subjects).toContainEqual({
-        name: 'demo_0.0.1_linux_386',
-        digest: {
-          sha256:
-            'f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e'
-        }
-      })
-      expect(subjects).toContainEqual({
-        name: 'demo_0.0.1_linux_amd64',
-        digest: {
-          sha256:
-            '187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d'
-        }
-      })
-    })
-  })
-
   describe('when specifying a subject checksums string with an unrecognized digest', () => {
     const checksums = `f861e  demo_0.0.1_linux_386`
 

action.yml

@@ -30,29 +30,21 @@ inputs:
       attestation. Must specify exactly one of "subject-path", "subject-digest",
       or "subject-checksums".
     required: false
-  sbom-path:
-    description: >
-      Path to the JSON-formatted SBOM file (SPDX or CycloneDX) to attest.
-      File size cannot exceed 16MB. When provided, creates an SBOM attestation.
-      Cannot be used together with "predicate-type", "predicate", or
-      "predicate-path".
-    required: false
   predicate-type:
     description: >
-      URI identifying the type of the predicate. Required when using "predicate"
-      or "predicate-path" for custom attestations.
-    required: false
+      URI identifying the type of the predicate.
+    required: true
   predicate:
     description: >
       String containing the value for the attestation predicate. String length
       cannot exceed 16MB. Must supply exactly one of "predicate-path" or
-      "predicate" when creating custom attestations.
+      "predicate".
     required: false
   predicate-path:
     description: >
       Path to the file which contains the content for the attestation predicate.
       File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
-      or "predicate" when creating custom attestations.
+      or "predicate".
     required: false
   push-to-registry:
     description: >

eslint.config.mjs

@@ -89,6 +89,13 @@ export default tseslint.config(
           allowObject: true
         }
       ]
+    },
+    settings: {
+      'import/resolver': {
+        typescript: {
+          project: './tsconfig.lint.json'
+        }
+      }
     }
   }
 )

jest.config.ts

@@ -0,0 +1,37 @@
+export default {
+  preset: "ts-jest",
+  verbose: true,
+  clearMocks: true,
+  testEnvironment: 'node',
+  moduleFileExtensions: ['js', 'ts'],
+  testMatch: ['**/*.test.ts'],
+  testPathIgnorePatterns: [
+    "/node_modules/",
+    "/dist/"
+  ],
+  transform: {
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        useESM: true,
+        diagnostics: {
+          ignoreCodes: [151002]
+        }
+      }
+    ]
+  },
+  coverageReporters: [
+    "json-summary",
+    "text",
+    "lcov"
+  ],
+  collectCoverage: true,
+  collectCoverageFrom: [
+    "./src/**"
+  ],
+  extensionsToTreatAsEsm: ['.ts'],
+  transformIgnorePatterns: ['node_modules/(?!(@actions)/)'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
+}

jest.setup.js

@@ -1,3 +0,0 @@
-import { jest } from '@jest/globals'
-
-process.stdout.write = jest.fn()

package.json

@@ -2,9 +2,9 @@
   "name": "actions/attest",
   "description": "Generate signed attestations for workflow artifacts",
   "version": "3.2.0",
+  "type": "module",
   "author": "",
   "private": true,
-  "type": "module",
   "homepage": "https://github.com/actions/attest",
   "repository": {
     "type": "git",
@@ -25,7 +25,7 @@
   },
   "scripts": {
     "bundle": "npm run format:write && npm run package",
-    "ci-test": "NODE_OPTIONS='--experimental-vm-modules' jest",
+    "ci-test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
     "format:write": "prettier --write **/*.ts",
     "format:check": "prettier --check **/*.ts",
     "lint:eslint": "npx eslint",
@@ -33,55 +33,15 @@
     "lint": "npm run lint:eslint && npm run lint:markdown",
     "package": "ncc build src/index.ts --license licenses.txt",
     "package:watch": "npm run package -- --watch",
-    "test": "NODE_OPTIONS='--experimental-vm-modules' jest",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",
     "all": "npm run format:write && npm run lint && npm run test && npm run package"
   },
   "license": "MIT",
-  "jest": {
-    "preset": "ts-jest/presets/default-esm",
-    "extensionsToTreatAsEsm": [
-      ".ts"
-    ],
-    "setupFilesAfterEnv": [
-      "./jest.setup.js"
-    ],
-    "verbose": true,
-    "clearMocks": true,
-    "testEnvironment": "node",
-    "moduleFileExtensions": [
-      "js",
-      "ts"
-    ],
-    "testMatch": [
-      "**/*.test.ts"
-    ],
-    "testPathIgnorePatterns": [
-      "/node_modules/",
-      "/dist/"
-    ],
-    "transform": {
-      "^.+\\.ts$": [
-        "ts-jest",
-        {
-          "useESM": true
-        }
-      ]
-    },
-    "coverageReporters": [
-      "json-summary",
-      "text",
-      "lcov"
-    ],
-    "collectCoverage": true,
-    "collectCoverageFrom": [
-      "./src/**"
-    ]
-  },
   "dependencies": {
-    "@actions/attest": "^3.0.0",
-    "@actions/core": "^3.0.0",
-    "@actions/github": "^9.0.0",
-    "@actions/glob": "^0.6.1",
+    "@actions/attest": "^2.2.1",
+    "@actions/core": "^2.0.2",
+    "@actions/github": "^7.0.0",
+    "@actions/glob": "^0.5.0",
     "@sigstore/oci": "^0.6.0",
     "csv-parse": "^5.6.0"
   },
@@ -94,6 +54,7 @@
     "@types/node": "^25.2.0",
     "@vercel/ncc": "^0.38.4",
     "eslint": "^9.39.2",
+    "eslint-import-resolver-typescript": "^4.4.4",
     "eslint-plugin-import": "^2.32.0",
     "eslint-plugin-jest": "^29.12.1",
     "jest": "^30.2.0",

src/attest.ts

@@ -5,10 +5,10 @@ import {
   attest,
   createStorageRecord
 } from '@actions/attest'
+import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
+import { formatSubjectDigest } from './subject.js'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
-import { formatSubjectDigest } from './subject'
 
 const OCI_TIMEOUT = 30000
 const OCI_RETRY = 3

src/detect.ts

@@ -1,45 +0,0 @@
-export type AttestationType = 'provenance' | 'sbom' | 'custom'
-
-export type DetectionInputs = {
-  sbomPath: string
-  predicateType: string
-  predicate: string
-  predicatePath: string
-}
-
-export const detectAttestationType = (
-  inputs: DetectionInputs
-): AttestationType => {
-  const { sbomPath, predicateType, predicate, predicatePath } = inputs
-
-  // SBOM mode takes priority
-  if (sbomPath) {
-    return 'sbom'
-  }
-
-  // Custom mode when any predicate inputs are provided
-  if (predicateType || predicate || predicatePath) {
-    return 'custom'
-  }
-
-  // Default to provenance mode
-  return 'provenance'
-}
-
-export const validateAttestationInputs = (inputs: DetectionInputs): void => {
-  const { sbomPath, predicateType, predicate, predicatePath } = inputs
-
-  // Cannot combine sbom-path with predicate inputs
-  if (sbomPath && (predicateType || predicate || predicatePath)) {
-    throw new Error(
-      'Cannot specify sbom-path together with predicate-type, predicate, or predicate-path'
-    )
-  }
-
-  // Custom mode requires predicate-type
-  if ((predicate || predicatePath) && !predicateType) {
-    throw new Error(
-      'predicate-type is required when using predicate or predicate-path'
-    )
-  }
-}

src/index.ts

@@ -2,14 +2,13 @@
  * The entrypoint for the action.
  */
 import * as core from '@actions/core'
-import { run, RunInputs } from './main'
+import { run, RunInputs } from './main.js'
 
 const inputs: RunInputs = {
   subjectPath: core.getInput('subject-path'),
   subjectName: core.getInput('subject-name'),
   subjectDigest: core.getInput('subject-digest'),
   subjectChecksums: core.getInput('subject-checksums'),
-  sbomPath: core.getInput('sbom-path'),
   predicateType: core.getInput('predicate-type'),
   predicate: core.getInput('predicate'),
   predicatePath: core.getInput('predicate-path'),

src/main.ts

@@ -1,38 +1,25 @@
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import fs from 'fs/promises'
+import fs from 'fs'
 import os from 'os'
 import path from 'path'
-import { AttestResult, SigstoreInstance, createAttestation } from './attest'
-import {
-  AttestationType,
-  DetectionInputs,
-  detectAttestationType,
-  validateAttestationInputs
-} from './detect'
-import { SEARCH_PUBLIC_GOOD_URL } from './endpoints'
-import { PredicateInputs, predicateFromInputs } from './predicate'
-import { generateProvenancePredicate } from './provenance'
-import { generateSBOMPredicate, parseSBOMFromPath } from './sbom'
-import * as style from './style'
+import { AttestResult, SigstoreInstance, createAttestation } from './attest.js'
+import { SEARCH_PUBLIC_GOOD_URL } from './endpoints.js'
+import { PredicateInputs, predicateFromInputs } from './predicate.js'
+import * as style from './style.js'
 import {
   SubjectInputs,
   formatSubjectDigest,
   subjectFromInputs
-} from './subject'
+} from './subject.js'
 
-import type { Predicate, Subject } from '@actions/attest'
+import type { Subject } from '@actions/attest'
 
 const ATTESTATION_FILE_NAME = 'attestation.json'
 const ATTESTATION_PATHS_FILE_NAME = 'created_attestation_paths.txt'
 
-export type SBOMInputs = {
-  sbomPath: string
-}
-
 export type RunInputs = SubjectInputs &
-  PredicateInputs &
-  SBOMInputs & {
+  PredicateInputs & {
     pushToRegistry: boolean
     createStorageRecord: boolean
     githubToken: string
@@ -71,26 +58,13 @@ export async function run(inputs: RunInputs): Promise<void> {
       )
     }
 
-    // Detect attestation type and validate inputs
-    const detectionInputs: DetectionInputs = {
-      sbomPath: inputs.sbomPath,
-      predicateType: inputs.predicateType,
-      predicate: inputs.predicate,
-      predicatePath: inputs.predicatePath
-    }
-    validateAttestationInputs(detectionInputs)
-    const attestationType = detectAttestationType(detectionInputs)
-    logAttestationType(attestationType)
-
     const subjects = await subjectFromInputs({
       ...inputs,
       downcaseName: inputs.pushToRegistry
     })
+    const predicate = predicateFromInputs(inputs)
 
-    // Generate predicate based on attestation type
-    const predicate = await getPredicateForType(attestationType, inputs)
-
-    const outputPath = path.join(await tempDir(), ATTESTATION_FILE_NAME)
+    const outputPath = path.join(tempDir(), ATTESTATION_FILE_NAME)
     core.setOutput('bundle-path', outputPath)
 
     const att = await createAttestation(subjects, predicate, {
@@ -103,7 +77,7 @@ export async function run(inputs: RunInputs): Promise<void> {
     logAttestation(subjects, att, sigstoreInstance)
 
     // Write attestation bundle to output file
-    await fs.writeFile(outputPath, JSON.stringify(att.bundle) + os.EOL, {
+    fs.writeFileSync(outputPath, JSON.stringify(att.bundle) + os.EOL, {
       encoding: 'utf-8',
       flag: 'a'
     })
@@ -113,7 +87,7 @@ export async function run(inputs: RunInputs): Promise<void> {
     if (baseDir) {
       const outputSummaryPath = path.join(baseDir, ATTESTATION_PATHS_FILE_NAME)
       // Append the output path to the attestations paths file
-      await fs.appendFile(outputSummaryPath, outputPath + os.EOL, {
+      fs.appendFileSync(outputSummaryPath, outputPath + os.EOL, {
         encoding: 'utf-8',
         flag: 'a'
       })
@@ -128,7 +102,6 @@ export async function run(inputs: RunInputs): Promise<void> {
       core.setOutput('attestation-id', att.attestationID)
       core.setOutput('attestation-url', attestationURL(att.attestationID))
     }
-
     if (att.storageRecordIds) {
       core.setOutput('storage-record-ids', att.storageRecordIds.join(','))
     }
@@ -221,7 +194,7 @@ const logSummary = async (attestation: AttestResult): Promise<void> => {
   }
 }
 
-const tempDir = async (): Promise<string> => {
+const tempDir = (): string => {
   const basePath = process.env['RUNNER_TEMP']
 
   /* istanbul ignore if */
@@ -229,35 +202,8 @@ const tempDir = async (): Promise<string> => {
     throw new Error('Missing RUNNER_TEMP environment variable')
   }
 
-  return fs.mkdtemp(path.join(basePath, path.sep))
+  return fs.mkdtempSync(path.join(basePath, path.sep))
 }
 
 const attestationURL = (id: string): string =>
   `${github.context.serverUrl}/${github.context.repo.owner}/${github.context.repo.repo}/attestations/${id}`
-
-// Log the detected attestation type
-const logAttestationType = (type: AttestationType): void => {
-  const typeLabels: Record<AttestationType, string> = {
-    provenance: 'Build Provenance',
-    sbom: 'SBOM',
-    custom: 'Custom'
-  }
-  core.info(`Attestation type: ${typeLabels[type]}`)
-}
-
-// Generate predicate based on attestation type
-const getPredicateForType = async (
-  type: AttestationType,
-  inputs: RunInputs
-): Promise<Predicate> => {
-  switch (type) {
-    case 'provenance':
-      return generateProvenancePredicate()
-    case 'sbom': {
-      const sbom = await parseSBOMFromPath(inputs.sbomPath)
-      return generateSBOMPredicate(sbom)
-    }
-    case 'custom':
-      return predicateFromInputs(inputs)
-  }
-}

src/predicate.ts

@@ -1,4 +1,4 @@
-import fs from 'fs/promises'
+import fs from 'fs'
 
 import type { Predicate } from '@actions/attest'
 
@@ -12,9 +12,7 @@ const MAX_PREDICATE_SIZE_BYTES = 16 * 1024 * 1024
 
 // Returns the predicate specified by the action's inputs. The predicate value
 // may be specified as a path to a file or as a string.
-export const predicateFromInputs = async (
-  inputs: PredicateInputs
-): Promise<Predicate> => {
+export const predicateFromInputs = (inputs: PredicateInputs): Predicate => {
   const { predicateType, predicate, predicatePath } = inputs
 
   if (!predicateType) {
@@ -32,22 +30,18 @@ export const predicateFromInputs = async (
   let params: string = predicate
 
   if (predicatePath) {
-    try {
-      await fs.access(predicatePath)
-    } catch {
+    if (!fs.existsSync(predicatePath)) {
       throw new Error(`predicate file not found: ${predicatePath}`)
     }
 
-    const stat = await fs.stat(predicatePath)
-
     /* istanbul ignore next */
-    if (stat.size > MAX_PREDICATE_SIZE_BYTES) {
+    if (fs.statSync(predicatePath).size > MAX_PREDICATE_SIZE_BYTES) {
       throw new Error(
         `predicate file exceeds maximum allowed size: ${MAX_PREDICATE_SIZE_BYTES} bytes`
       )
     }
 
-    params = await fs.readFile(predicatePath, 'utf-8')
+    params = fs.readFileSync(predicatePath, 'utf-8')
   } else {
     if (predicate.length > MAX_PREDICATE_SIZE_BYTES) {
       throw new Error(

src/provenance.ts

@@ -1,7 +0,0 @@
-import { buildSLSAProvenancePredicate } from '@actions/attest'
-
-import type { Predicate } from '@actions/attest'
-
-export const generateProvenancePredicate = async (): Promise<Predicate> => {
-  return buildSLSAProvenancePredicate()
-}

src/sbom.ts

@@ -1,96 +0,0 @@
-import fs from 'fs/promises'
-
-import type { Predicate } from '@actions/attest'
-
-export type SBOM = {
-  type: 'spdx' | 'cyclonedx'
-  object: object
-}
-
-// SBOMs cannot exceed 16MB.
-const MAX_SBOM_SIZE_BYTES = 16 * 1024 * 1024
-
-export const parseSBOMFromPath = async (filePath: string): Promise<SBOM> => {
-  let stats
-  try {
-    stats = await fs.stat(filePath)
-  } catch (error) {
-    const err = error as NodeJS.ErrnoException
-    if (err.code === 'ENOENT') {
-      throw new Error('SBOM file not found')
-    }
-    throw error
-  }
-
-  if (stats.size > MAX_SBOM_SIZE_BYTES) {
-    throw new Error(
-      `SBOM file exceeds maximum allowed size: ${MAX_SBOM_SIZE_BYTES} bytes`
-    )
-  }
-
-  const fileContent = await fs.readFile(filePath, 'utf8')
-  const sbom = JSON.parse(fileContent) as object
-
-  if (checkIsSPDX(sbom)) {
-    return { type: 'spdx', object: sbom }
-  } else if (checkIsCycloneDX(sbom)) {
-    return { type: 'cyclonedx', object: sbom }
-  }
-
-  throw new Error(
-    'Unsupported SBOM format. Must be valid SPDX or CycloneDX JSON.'
-  )
-}
-
-const checkIsSPDX = (sbomObject: {
-  spdxVersion?: string
-  SPDXID?: string
-}): boolean => {
-  return !!(sbomObject?.spdxVersion && sbomObject?.SPDXID)
-}
-
-const checkIsCycloneDX = (sbomObject: {
-  bomFormat?: string
-  serialNumber?: string
-  specVersion?: string
-}): boolean => {
-  return !!(
-    sbomObject?.bomFormat &&
-    sbomObject?.serialNumber &&
-    sbomObject?.specVersion
-  )
-}
-
-export const generateSBOMPredicate = (sbom: SBOM): Predicate => {
-  switch (sbom.type) {
-    case 'spdx':
-      return generateSPDXPredicate(sbom.object)
-    case 'cyclonedx':
-      return generateCycloneDXPredicate(sbom.object)
-    default:
-      throw new Error('Unsupported SBOM format')
-  }
-}
-
-// ref: https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md
-const generateSPDXPredicate = (sbom: object): Predicate => {
-  const spdxVersion = (sbom as { spdxVersion?: string })?.['spdxVersion']
-  if (!spdxVersion) {
-    throw new Error('Cannot find spdxVersion in the SBOM')
-  }
-
-  const version = spdxVersion.split('-')[1]
-
-  return {
-    type: `https://spdx.dev/Document/v${version}`,
-    params: sbom
-  }
-}
-
-// ref: https://github.com/in-toto/attestation/blob/main/spec/predicates/cyclonedx.md
-const generateCycloneDXPredicate = (sbom: object): Predicate => {
-  return {
-    type: 'https://cyclonedx.org/bom',
-    params: sbom
-  }
-}

src/subject.ts

@@ -2,8 +2,7 @@ import * as glob from '@actions/glob'
 import assert from 'assert'
 import crypto from 'crypto'
 import { parse } from 'csv-parse/sync'
-import { createReadStream } from 'fs'
-import fs from 'fs/promises'
+import fs from 'fs'
 import os from 'os'
 import path from 'path'
 
@@ -65,7 +64,7 @@ export const subjectFromInputs = async (
     case !!subjectDigest:
       return [getSubjectFromDigest(subjectDigest, name)]
     case !!subjectChecksums:
-      return await getSubjectFromChecksums(subjectChecksums)
+      return getSubjectFromChecksums(subjectChecksums)
     /* istanbul ignore next */
     default:
       // This should be unreachable, but TS requires a default case
@@ -95,12 +94,11 @@ const getSubjectFromPath = async (
   const paths = await glob.create(subjectPaths).then(async g => g.glob())
 
   // Filter path list to just the files (not directories)
-  const stats = await Promise.all(paths.map(async p => fs.stat(p)))
-  const files = paths.filter((_, i) => stats[i].isFile())
+  const files = paths.filter(p => fs.statSync(p).isFile())
 
   if (files.length > MAX_SUBJECT_COUNT) {
     throw new Error(
-      `Too many subjects specified (${files.length}). The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
+      `Too many subjects specified. The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
     )
   }
 
@@ -144,21 +142,16 @@ const getSubjectFromDigest = (
   }
 }
 
-const getSubjectFromChecksums = async (
-  subjectChecksums: string
-): Promise<Subject[]> => {
-  try {
-    await fs.access(subjectChecksums)
+const getSubjectFromChecksums = (subjectChecksums: string): Subject[] => {
+  if (fs.existsSync(subjectChecksums)) {
     return getSubjectFromChecksumsFile(subjectChecksums)
-  } catch {
+  } else {
     return getSubjectFromChecksumsString(subjectChecksums)
   }
 }
 
-const getSubjectFromChecksumsFile = async (
-  checksumsPath: string
-): Promise<Subject[]> => {
-  const stats = await fs.stat(checksumsPath)
+const getSubjectFromChecksumsFile = (checksumsPath: string): Subject[] => {
+  const stats = fs.statSync(checksumsPath)
   if (!stats.isFile()) {
     throw new Error(`subject checksums file not found: ${checksumsPath}`)
   }
@@ -170,7 +163,7 @@ const getSubjectFromChecksumsFile = async (
     )
   }
 
-  const checksums = await fs.readFile(checksumsPath, 'utf-8')
+  const checksums = fs.readFileSync(checksumsPath, 'utf-8')
   return getSubjectFromChecksumsString(checksums)
 }
 
@@ -202,15 +195,10 @@ const getSubjectFromChecksumsString = (checksums: string): Subject[] => {
       throw new Error(`Invalid digest: ${digest}`)
     }
 
-    const alg = digestAlgorithm(digest)
-
-    // Only add the subject if it is not already in the list (deduplicate by name & digest)
-    if (!subjects.some(s => s.name === name && s.digest[alg] === digest)) {
-      subjects.push({
-        name,
-        digest: { [alg]: digest }
-      })
-    }
+    subjects.push({
+      name,
+      digest: { [digestAlgorithm(digest)]: digest }
+    })
   }
 
   return subjects
@@ -225,7 +213,7 @@ const digestFile = async (
 ): Promise<string> => {
   return new Promise((resolve, reject) => {
     const hash = crypto.createHash(algorithm).setEncoding('hex')
-    createReadStream(filePath)
+    fs.createReadStream(filePath)
       .once('error', reject)
       .pipe(hash)
       .once('finish', () => resolve(hash.read()))

tsconfig.json

@@ -2,9 +2,9 @@
   "$schema": "https://json.schemastore.org/tsconfig",
   "compilerOptions": {
     "target": "ES2022",
-    "module": "ESNext",
+    "module": "NodeNext",
     "rootDir": "./src",
-    "moduleResolution": "Bundler",
+    "moduleResolution": "NodeNext",
     "isolatedModules": true,
     "baseUrl": "./",
     "sourceMap": true,
@@ -16,5 +16,5 @@
     "skipLibCheck": true,
     "newLine": "lf"
   },
-  "exclude": ["./dist", "./node_modules", "./__tests__", "./coverage"]
+  "exclude": ["./dist", "./node_modules", "./__tests__", "./coverage", "./jest.config.ts"]
 }

tsconfig.lint.json

@@ -2,8 +2,9 @@
   "$schema": "https://json.schemastore.org/tsconfig",
   "extends": "./tsconfig.json",
   "compilerOptions": {
-    "noEmit": true
+    "noEmit": true,
+    "rootDir": "."
   },
-  "include": ["./__tests__/**/*", "./src/**/*"],
+  "include": ["./__tests__/**/*", "./src/**/*", "./jest.config.ts"],
   "exclude": ["./dist", "./node_modules", "./coverage", "*.json"]
 }