only write attestation for non-private repos

src/api-client.ts

@@ -55,23 +55,3 @@ export async function getContainerRegistryURL(
   const registryURL: URL = new URL(data.url)
   return registryURL
 }
-
-export async function getRepositoryVisibility(
-  githubAPIURL: string
-): Promise<string> {
-  const response = await fetch(`${githubAPIURL}/`)
-  if (!response.ok) {
-    throw new Error(
-      `Failed to fetch repository metadata due to bad status code: ${response.status}`
-    )
-  }
-  const data = await response.json()
-
-  if (!data.full_name) {
-    throw new Error(
-      `Failed to fetch repository metadata: unexpected response format`
-    )
-  }
-
-  return data.full_name
-}

src/config.ts

@@ -109,6 +109,14 @@ export async function resolvePublishActionOptions(): Promise<PublishActionOption
     throw new Error(`Could not find repository visibility.`)
   }
 
+  if (repoMetadata.repoId !== repositoryId) {
+    throw new Error(`Repository ID mismatch.`)
+  }
+
+  if (repoMetadata.ownerId !== repositoryOwnerId) {
+    throw new Error(`Repository Owner ID mismatch.`)
+  }
+
   const repositoryVisibility = repoMetadata.visibility
 
   return {

src/main.ts

@@ -57,6 +57,7 @@ export async function run(): Promise<void> {
     core.setOutput('package-manifest', JSON.stringify(manifest))
     core.setOutput('package-manifest-sha', manifestDigest)
 
+    // Attestations are not currently supported in GHES.
     if (!options.isEnterprise) {
       const attestation = await generateAttestation(
         manifestDigest,
@@ -106,7 +107,11 @@ async function generateAttestation(
     subjectDigest: { sha256: subjectDigest },
     token: options.token,
     sigstore: 'github',
-    skipWrite: false // TODO: Attestation storage is only supported for public repositories or repositories which belong to a GitHub Enterprise Cloud account
+    // Attestation storage is only supported for public repositories or repositories which belong to a GitHub Enterprise Cloud account.
+    // See: https://github.com/actions/toolkit/tree/main/packages/attest#storage
+    // Since internal repos can only be owned by Enterprises, we'll use this visibility as a proxy for "owned by a GitHub Enterprise Cloud account."
+    // See: https://docs.github.com/en/enterprise-cloud@latest/repositories/creating-and-managing-repositories/about-repositories#about-internal-repositories
+    skipWrite: options.repositoryVisibility === 'private'
   })
 }