Bump @sigstore/oci from 0.4.0 to 0.5.0 (#235)

* bump @sigstore/oci from 0.4.0 to 0.5.0

Signed-off-by: Brian DeHamer <bdehamer@github.com>

* bump package version to 2.3.0

Signed-off-by: Brian DeHamer <bdehamer@github.com>

* update @babel/helpers from 7.22.13 to 7.27.0

Signed-off-by: Brian DeHamer <bdehamer@github.com>

---------

Signed-off-by: Brian DeHamer <bdehamer@github.com>

dist/index.js

@@ -12934,7 +12934,7 @@ const getRegistryCredentials = (imageName) => {
     const { username, password } = (0, exports.fromBasicAuth)(creds.auth);
     // If the identitytoken is present, use it as the password (primarily for ACR)
     const pass = creds.identitytoken ? creds.identitytoken : password;
-    return { username, password: pass };
+    return { headers: dockerConfig.HttpHeaders, username, password: pass };
 };
 exports.getRegistryCredentials = getRegistryCredentials;
 // Encode the username and password as base64-encoded basicauth value
@@ -13422,6 +13422,8 @@ class RegistryClient {
     // authenticate requests.
     // https://github.com/google/go-containerregistry/blob/main/pkg/authn/README.md#the-registry
     async signIn(creds) {
+        // Ensure we include an auth headers if they are present
+        __classPrivateFieldSet(this, _RegistryClient_fetch, __classPrivateFieldGet(this, _RegistryClient_fetch, "f").defaults({ headers: creds.headers }), "f");
         // Initiate a blob upload to get the auth challenge
         const probeResponse = await __classPrivateFieldGet(this, _RegistryClient_fetch, "f").call(this, `${__classPrivateFieldGet(this, _RegistryClient_baseURL, "f")}/v2/${__classPrivateFieldGet(this, _RegistryClient_repository, "f")}/blobs/uploads/`, { method: 'POST' });
         // If we get a 200 response, we're already authenticated

package.json

@@ -1,7 +1,7 @@
 {
   "name": "actions/attest",
   "description": "Generate signed attestations for workflow artifacts",
-  "version": "2.2.1",
+  "version": "2.3.0",
   "author": "",
   "private": true,
   "homepage": "https://github.com/actions/attest",
@@ -73,17 +73,17 @@
     "@actions/core": "^1.11.1",
     "@actions/github": "^6.0.0",
     "@actions/glob": "^0.5.0",
-    "@sigstore/oci": "^0.4.0",
+    "@sigstore/oci": "^0.5.0",
     "csv-parse": "^5.6.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.23.0",
+    "@eslint/js": "^9.24.0",
     "@sigstore/mock": "^0.10.0",
     "@types/jest": "^29.5.14",
     "@types/make-fetch-happen": "^10.0.4",
-    "@types/node": "^22.13.14",
+    "@types/node": "^22.14.1",
     "@vercel/ncc": "^0.38.3",
-    "eslint": "^9.23.0",
+    "eslint": "^9.24.0",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.11.0",
     "jest": "^29.7.0",
@@ -91,9 +91,9 @@
     "markdownlint-cli": "^0.44.0",
     "nock": "^13.5.6",
     "prettier": "^3.5.3",
-    "ts-jest": "^29.3.1",
-    "typescript": "^5.8.2",
-    "typescript-eslint": "^8.29.0",
+    "ts-jest": "^29.3.2",
+    "typescript": "^5.8.3",
+    "typescript-eslint": "^8.30.1",
     "undici": "^5.28.5"
   }
 }