wip

Signed-off-by: Brian DeHamer <bdehamer@github.com>

.github/workflows/linter.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Lint Codebase
         id: super-linter
-        uses: super-linter/super-linter/slim@v7.2.1
+        uses: super-linter/super-linter/slim@v7
         env:
           DEFAULT_BRANCH: main
           FILTER_REGEX_EXCLUDE: dist/**/*

README.md

@@ -65,7 +65,7 @@ attest:
    The `subject-path` parameter should identify the artifact for which you want
    to generate an attestation. The `predicate-type` can be any of the the
    [vetted predicate types][3] or a custom value. The `predicate-path`
-   identifies a file containing the JSON-encoded predicate parameters.
+   identifies a file containg the JSON-encoded predicate parameters.
 
 ### Inputs
 
@@ -323,5 +323,3 @@ jobs:
 [8]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns
 [9]:
   https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
-
-

__tests__/subject.test.ts

@@ -99,7 +99,7 @@ describe('subjectFromInputs', () => {
       })
     })
 
-    describe('when the algorithm is not supported', () => {
+    describe('when the alogrithm is not supported', () => {
       it('throws an error', async () => {
         const inputs: SubjectInputs = {
           ...blankInputs,

dist/index.js

@@ -7521,7 +7521,7 @@ __export(dist_src_exports, {
 module.exports = __toCommonJS(dist_src_exports);
 
 // pkg/dist-src/version.js
-var VERSION = "9.2.2";
+var VERSION = "9.1.5";
 
 // pkg/dist-src/normalize-paginated-list-response.js
 function normalizePaginatedListResponse(response) {
@@ -7569,7 +7569,7 @@ function iterator(octokit, route, parameters) {
           const response = await requestMethod({ method, url, headers });
           const normalizedResponse = normalizePaginatedListResponse(response);
           url = ((normalizedResponse.headers.link || "").match(
-            /<([^<>]+)>;\s*rel="next"/
+            /<([^>]+)>;\s*rel="next"/
           ) || [])[1];
           return { value: normalizedResponse };
         } catch (error) {
@@ -7682,8 +7682,6 @@ var paginatingEndpoints = [
   "GET /orgs/{org}/members/{username}/codespaces",
   "GET /orgs/{org}/migrations",
   "GET /orgs/{org}/migrations/{migration_id}/repositories",
-  "GET /orgs/{org}/organization-roles/{role_id}/teams",
-  "GET /orgs/{org}/organization-roles/{role_id}/users",
   "GET /orgs/{org}/outside_collaborators",
   "GET /orgs/{org}/packages",
   "GET /orgs/{org}/packages/{package_type}/{package_name}/versions",
@@ -10198,7 +10196,7 @@ var RequestError = class extends Error {
     if (options.request.headers.authorization) {
       requestCopy.headers = Object.assign({}, options.request.headers, {
         authorization: options.request.headers.authorization.replace(
-          /(?<! ) .*$/,
+          / .*$/,
           " [REDACTED]"
         )
       });
@@ -42883,7 +42881,7 @@ const testSet = (set, version, options) => {
 
 const debug = __nccwpck_require__(1159)
 const { MAX_LENGTH, MAX_SAFE_INTEGER } = __nccwpck_require__(45101)
-const { safeRe: re, safeSrc: src, t } = __nccwpck_require__(95471)
+const { safeRe: re, t } = __nccwpck_require__(95471)
 
 const parseOptions = __nccwpck_require__(70356)
 const { compareIdentifiers } = __nccwpck_require__(73348)
@@ -42893,7 +42891,7 @@ class SemVer {
 
     if (version instanceof SemVer) {
       if (version.loose === !!options.loose &&
-        version.includePrerelease === !!options.includePrerelease) {
+          version.includePrerelease === !!options.includePrerelease) {
         return version
       } else {
         version = version.version
@@ -43059,20 +43057,6 @@ class SemVer {
   // preminor will bump the version up to the next minor release, and immediately
   // down to pre-release. premajor and prepatch work the same way.
   inc (release, identifier, identifierBase) {
-    if (release.startsWith('pre')) {
-      if (!identifier && identifierBase === false) {
-        throw new Error('invalid increment argument: identifier is empty')
-      }
-      // Avoid an invalid semver results
-      if (identifier) {
-        const r = new RegExp(`^${this.options.loose ? src[t.PRERELEASELOOSE] : src[t.PRERELEASE]}$`)
-        const match = `-${identifier}`.match(r)
-        if (!match || match[1] !== identifier) {
-          throw new Error(`invalid identifier: ${identifier}`)
-        }
-      }
-    }
-
     switch (release) {
       case 'premajor':
         this.prerelease.length = 0
@@ -43103,12 +43087,6 @@ class SemVer {
         }
         this.inc('pre', identifier, identifierBase)
         break
-      case 'release':
-        if (this.prerelease.length === 0) {
-          throw new Error(`version ${this.raw} is not a prerelease`)
-        }
-        this.prerelease.length = 0
-        break
 
       case 'major':
         // If this is a pre-major version, bump up to the same major version.
@@ -43152,6 +43130,10 @@ class SemVer {
       case 'pre': {
         const base = Number(identifierBase) ? 1 : 0
 
+        if (!identifier && identifierBase === false) {
+          throw new Error('invalid increment argument: identifier is empty')
+        }
+
         if (this.prerelease.length === 0) {
           this.prerelease = [base]
         } else {
@@ -43410,13 +43392,20 @@ const diff = (version1, version2) => {
       return 'major'
     }
 
-    // If the main part has no difference
-    if (lowVersion.compareMain(highVersion) === 0) {
-      if (lowVersion.minor && !lowVersion.patch) {
-        return 'minor'
-      }
+    // Otherwise it can be determined by checking the high version
+
+    if (highVersion.patch) {
+      // anything higher than a patch bump would result in the wrong version
       return 'patch'
     }
+
+    if (highVersion.minor) {
+      // anything higher than a minor bump would result in the wrong version
+      return 'minor'
+    }
+
+    // bumping major/minor/patch all have same result
+    return 'major'
   }
 
   // add the `pre` prefix if we are going to a prerelease version
@@ -43923,7 +43912,6 @@ exports = module.exports = {}
 const re = exports.re = []
 const safeRe = exports.safeRe = []
 const src = exports.src = []
-const safeSrc = exports.safeSrc = []
 const t = exports.t = {}
 let R = 0
 
@@ -43956,7 +43944,6 @@ const createToken = (name, value, isGlobal) => {
   debug(name, index, value)
   t[name] = index
   src[index] = value
-  safeSrc[index] = safe
   re[index] = new RegExp(value, isGlobal ? 'g' : undefined)
   safeRe[index] = new RegExp(safe, isGlobal ? 'g' : undefined)
 }
@@ -70768,8 +70755,10 @@ const createAttestation = async (subjects, predicate, opts) => {
         predicateType: predicate.type,
         predicate: predicate.params,
         sigstore: opts.sigstoreInstance,
-        token: opts.githubToken
+        token: opts.githubToken,
+        skipWrite: true
     });
+    console.log(JSON.stringify(attestation.bundle));
     const result = attestation;
     if (subjects.length === 1 && opts.pushToRegistry) {
         const subject = subjects[0];
@@ -71275,10 +71264,18 @@ const getSubjectFromChecksumsString = (checksums) => {
         if (!HEX_STRING_RE.test(digest)) {
             throw new Error(`Invalid digest: ${digest}`);
         }
-        subjects.push({
-            name,
-            digest: { [digestAlgorithm(digest)]: digest }
-        });
+        if (digestAlgorithm(digest) === 'sha1') {
+            subjects.push({
+                uri: name,
+                digest: { [digestAlgorithm(digest)]: digest }
+            });
+        }
+        else {
+            subjects.push({
+                name,
+                digest: { [digestAlgorithm(digest)]: digest }
+            });
+        }
     }
     return subjects;
 };
@@ -71309,6 +71306,8 @@ const parseSubjectPathList = (input) => {
 };
 const digestAlgorithm = (digest) => {
     switch (digest.length) {
+        case 40:
+            return 'sha1';
         case 64:
             return 'sha256';
         case 128:

package.json

@@ -77,23 +77,23 @@
     "csv-parse": "^5.6.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.21.0",
-    "@sigstore/mock": "^0.10.0",
+    "@eslint/js": "^9.19.0",
+    "@sigstore/mock": "^0.9.0",
     "@types/jest": "^29.5.14",
     "@types/make-fetch-happen": "^10.0.4",
-    "@types/node": "^22.13.5",
+    "@types/node": "^22.10.10",
     "@vercel/ncc": "^0.38.3",
-    "eslint": "^9.21.0",
+    "eslint": "^9.19.0",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.11.0",
     "jest": "^29.7.0",
     "js-yaml": "^4.1.0",
     "markdownlint-cli": "^0.44.0",
     "nock": "^13.5.6",
-    "prettier": "^3.5.2",
-    "ts-jest": "^29.2.6",
+    "prettier": "^3.4.2",
+    "ts-jest": "^29.2.5",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.25.0",
+    "typescript-eslint": "^8.22.0",
     "undici": "^5.28.5"
   }
 }

src/attest.ts

@@ -25,9 +25,12 @@ export const createAttestation = async (
     predicateType: predicate.type,
     predicate: predicate.params,
     sigstore: opts.sigstoreInstance,
-    token: opts.githubToken
+    token: opts.githubToken,
+    skipWrite: true
   })
 
+  console.log(JSON.stringify(attestation.bundle))
+
   const result: AttestResult = attestation
 
   if (subjects.length === 1 && opts.pushToRegistry) {

src/subject.ts

@@ -189,10 +189,17 @@ const getSubjectFromChecksumsString = (checksums: string): Subject[] => {
       throw new Error(`Invalid digest: ${digest}`)
     }
 
-    subjects.push({
-      name,
-      digest: { [digestAlgorithm(digest)]: digest }
-    })
+    if (digestAlgorithm(digest) === 'sha1') {
+      subjects.push({
+        uri: name,
+        digest: { [digestAlgorithm(digest)]: digest }
+      } as any)
+    } else {
+      subjects.push({
+        name,
+        digest: { [digestAlgorithm(digest)]: digest }
+      })
+    }
   }
 
   return subjects
@@ -233,6 +240,8 @@ const parseSubjectPathList = (input: string): string[] => {
 
 const digestAlgorithm = (digest: string): string => {
   switch (digest.length) {
+    case 40:
+      return 'sha1'
     case 64:
       return 'sha256'
     case 128: