oci compat mode input arg

Signed-off-by: Brian DeHamer <[email protected]>

dist/index.js

@@ -12934,7 +12934,7 @@ const getRegistryCredentials = (imageName) => {
     const { username, password } = (0, exports.fromBasicAuth)(creds.auth);
     // If the identitytoken is present, use it as the password (primarily for ACR)
     const pass = creds.identitytoken ? creds.identitytoken : password;
-    return { headers: dockerConfig.HttpHeaders, username, password: pass };
+    return { username, password: pass };
 };
 exports.getRegistryCredentials = getRegistryCredentials;
 // Encode the username and password as base64-encoded basicauth value
@@ -13422,8 +13422,6 @@ class RegistryClient {
     // authenticate requests.
     // https://github.com/google/go-containerregistry/blob/main/pkg/authn/README.md#the-registry
     async signIn(creds) {
-        // Ensure we include an auth headers if they are present
-        __classPrivateFieldSet(this, _RegistryClient_fetch, __classPrivateFieldGet(this, _RegistryClient_fetch, "f").defaults({ headers: creds.headers }), "f");
         // Initiate a blob upload to get the auth challenge
         const probeResponse = await __classPrivateFieldGet(this, _RegistryClient_fetch, "f").call(this, `${__classPrivateFieldGet(this, _RegistryClient_baseURL, "f")}/v2/${__classPrivateFieldGet(this, _RegistryClient_repository, "f")}/blobs/uploads/`, { method: 'POST' });
         // If we get a 200 response, we're already authenticated

package.json

@@ -1,7 +1,7 @@
 {
   "name": "actions/attest",
   "description": "Generate signed attestations for workflow artifacts",
-  "version": "2.3.0",
+  "version": "2.2.1",
   "author": "",
   "private": true,
   "homepage": "https://github.com/actions/attest",
@@ -73,17 +73,17 @@
     "@actions/core": "^1.11.1",
     "@actions/github": "^6.0.0",
     "@actions/glob": "^0.5.0",
-    "@sigstore/oci": "^0.5.0",
+    "@sigstore/oci": "^0.4.0",
     "csv-parse": "^5.6.0"
   },
   "devDependencies": {
-    "@eslint/js": "^9.24.0",
+    "@eslint/js": "^9.23.0",
     "@sigstore/mock": "^0.10.0",
     "@types/jest": "^29.5.14",
     "@types/make-fetch-happen": "^10.0.4",
-    "@types/node": "^22.14.1",
+    "@types/node": "^22.13.14",
     "@vercel/ncc": "^0.38.3",
-    "eslint": "^9.24.0",
+    "eslint": "^9.23.0",
     "eslint-plugin-import": "^2.31.0",
     "eslint-plugin-jest": "^28.11.0",
     "jest": "^29.7.0",
@@ -91,9 +91,9 @@
     "markdownlint-cli": "^0.44.0",
     "nock": "^13.5.6",
     "prettier": "^3.5.3",
-    "ts-jest": "^29.3.2",
-    "typescript": "^5.8.3",
-    "typescript-eslint": "^8.30.1",
+    "ts-jest": "^29.3.1",
+    "typescript": "^5.8.2",
+    "typescript-eslint": "^8.29.0",
     "undici": "^5.28.5"
   }
 }

src/attest.ts

@@ -17,6 +17,7 @@ export const createAttestation = async (
     sigstoreInstance: SigstoreInstance
     pushToRegistry: boolean
     githubToken: string
+    ociCompatMode: boolean
   }
 ): Promise<AttestResult> => {
   // Sign provenance w/ Sigstore
@@ -43,6 +44,7 @@ export const createAttestation = async (
         'dev.sigstore.bundle.content': 'dsse-envelope',
         'dev.sigstore.bundle.predicateType': predicate.type
       },
+      compatibility: opts.ociCompatMode,
       fetchOpts: { timeout: OCI_TIMEOUT, retry: OCI_RETRY }
     })
 

src/index.ts

@@ -18,6 +18,9 @@ const inputs: RunInputs = {
   // undocumented -- not part of public interface
   privateSigning: ['true', 'True', 'TRUE', '1'].includes(
     core.getInput('private-signing')
+  ),
+  ociCompatMode: ['true', 'True', 'TRUE', '1'].includes(
+    core.getInput('oci-compatibility-mode')
   )
 }
 

src/main.ts

@@ -23,6 +23,7 @@ export type RunInputs = SubjectInputs &
     githubToken: string
     showSummary: boolean
     privateSigning: boolean
+    ociCompatMode: boolean
   }
 
 /* istanbul ignore next */
@@ -68,7 +69,8 @@ export async function run(inputs: RunInputs): Promise<void> {
     const att = await createAttestation(subjects, predicate, {
       sigstoreInstance,
       pushToRegistry: inputs.pushToRegistry,
-      githubToken: inputs.githubToken
+      githubToken: inputs.githubToken,
+      ociCompatMode: inputs.ociCompatMode
     })
 
     logAttestation(subjects, att, sigstoreInstance)