From 5c92b3920b6a55ad33f238456892889aca8a7dba Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 15:33:26 +0100 Subject: [PATCH 1/8] add disclaimer --- README.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index ff2075a..4bfb899 100644 --- a/README.md +++ b/README.md @@ -1,11 +1,15 @@ # Publish Action Package -_This action_ packages _your action_ as OCI artifacts and publishes it to the [GitHub Container registry](ghcr.io). +_This action_ packages _your action_ as an OCI container and publishes it to the [GitHub Container registry](ghcr.io). -This allows your action to be consumed as an _immutable_ package even if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. +This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. Your action workflow must be triggered on `release` as in the following example. The release's title must follow [semantic versioning](https://semver.org/). -Then consumers of your action will then be able to specify the version, e.g., `- uses: your-name/your-action@v1.2.3` or even `- uses: your-name/your-action@v1`. +Consumers of your action will then be able to specify the version, e.g., `- uses: your-name/your-action@v1.2.3` or even `- uses: your-name/your-action@v1`. + +> [!IMPORTANT] +> This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). +> Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. ## Usage @@ -14,7 +18,7 @@ Then consumers of your action will then be able to specify the version, e.g., `- on: release: -- uses: immutable-actions/publish-action-package@v1 +- uses: actions/publish-action-package@v1 ``` From 58addcb0cc08b4adec248874443785bab7ae2e91 Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 16:36:28 +0100 Subject: [PATCH 2/8] Update README.md --- README.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 4bfb899..11bb4a7 100644 --- a/README.md +++ b/README.md @@ -1,15 +1,19 @@ # Publish Action Package +> [!IMPORTANT] +> This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). +> Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. + _This action_ packages _your action_ as an OCI container and publishes it to the [GitHub Container registry](ghcr.io). This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. Your action workflow must be triggered on `release` as in the following example. The release's title must follow [semantic versioning](https://semver.org/). -Consumers of your action will then be able to specify the version, e.g., `- uses: your-name/your-action@v1.2.3` or even `- uses: your-name/your-action@v1`. +Consumers of your action will then be able to specify the version, e.g. + +* `- uses: your-name/your-action@v1.2.3` +* `- uses: your-name/your-action@v1` -> [!IMPORTANT] -> This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). -> Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. ## Usage From 638fb07f1a500d594a750f2b16aa80fc7e1be26e Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 16:48:33 +0100 Subject: [PATCH 3/8] Update README.md --- README.md | 35 ++++++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 11bb4a7..95d58ba 100644 --- a/README.md +++ b/README.md @@ -4,25 +4,50 @@ > This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). > Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. -_This action_ packages _your action_ as an OCI container and publishes it to the [GitHub Container registry](ghcr.io). +This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). + This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. -This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. +Your action workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag, e.g. [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release), [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push), [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch). The associated tag must follow [semantic versioning](https://semver.org/) - this tag value will be used to create a package version. -Your action workflow must be triggered on `release` as in the following example. The release's title must follow [semantic versioning](https://semver.org/). -Consumers of your action will then be able to specify the version, e.g. +Consumers of your action will then be able to specify that version to consume your action from the package, e.g. * `- uses: your-name/your-action@v1.2.3` * `- uses: your-name/your-action@v1` +Such packages will come with stronger security guarantees, such as: + +* Provenance attestations generated using the [`@actions/attest`](https://github.com/actions/toolkit/tree/main/packages/attest) package +* Tag immutability - it will not be possible to overwrite tags once published, ensuring versions of an action can't change once in use +* Namespace immutability - it will not be possible to delete and recreate the package with different content; this would undermine tag immutability ## Usage +An actions workflow file like the following should be placed in your action repository: + ```yaml +name: "Publish Actions Package" + on: release: + types: [created] -- uses: actions/publish-action-package@v1 +jobs: + publish: + runs-on: ubuntu-latest + permissions: + id-token: write + packages: write + contents: write + actions: read + steps: + - name: Check out repo + uses: actions/checkout@v4 + - name: Publish + id: publish + uses: actions/publish-immutable-action@v1 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} ``` From bc99e92f1f05ff18d374f432f322ec1c4a881b31 Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 16:56:30 +0100 Subject: [PATCH 4/8] Update README.md --- README.md | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/README.md b/README.md index 95d58ba..bb47849 100644 --- a/README.md +++ b/README.md @@ -1,28 +1,29 @@ -# Publish Action Package +# Publish Immutable Action > [!IMPORTANT] > This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). > Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. -This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). - This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. +This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. -Your action workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag, e.g. [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release), [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push), [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch). The associated tag must follow [semantic versioning](https://semver.org/) - this tag value will be used to create a package version. +Your action workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag, +e.g. [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release), [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push), and [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch). +The associated tag must follow [semantic versioning](https://semver.org/) - this tag value will be used to create a package version. -Consumers of your action will then be able to specify that version to consume your action from the package, e.g. +Consumers of your action will then be able to specify that version to consume your action from the package, e.g. -* `- uses: your-name/your-action@v1.2.3` -* `- uses: your-name/your-action@v1` +- `- uses: your-name/your-action@v1.2.3` +- `- uses: your-name/your-action@v1` -Such packages will come with stronger security guarantees, such as: +Such packages will come with stronger security guarantees for consumers than existing git-based action resolution, such as: -* Provenance attestations generated using the [`@actions/attest`](https://github.com/actions/toolkit/tree/main/packages/attest) package -* Tag immutability - it will not be possible to overwrite tags once published, ensuring versions of an action can't change once in use -* Namespace immutability - it will not be possible to delete and recreate the package with different content; this would undermine tag immutability +- Provenance attestations generated using the [`@actions/attest`](https://github.com/actions/toolkit/tree/main/packages/attest) package +- Tag immutability - it will not be possible to overwrite tags once published, ensuring versions of an action can't change once in use +- Namespace immutability - it will not be possible to delete and recreate the package with different content; this would undermine tag immutability ## Usage -An actions workflow file like the following should be placed in your action repository: +An actions workflow file like the following should be placed in your action repository: ```yaml @@ -38,8 +39,8 @@ jobs: permissions: id-token: write packages: write - contents: write - actions: read + contents: write + actions: read steps: - name: Check out repo uses: actions/checkout@v4 From 9bd8f2e9c0ef95e83fc33575449bf0d129e1b09f Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 17:03:18 +0100 Subject: [PATCH 5/8] Update README.md --- README.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index bb47849..6749b9f 100644 --- a/README.md +++ b/README.md @@ -4,10 +4,11 @@ > This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). > Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. -This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. +This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). +This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. -Your action workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag, -e.g. [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release), [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push), and [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch). +Your action workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. +Some examples of these events are [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release), [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push), and [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch). The associated tag must follow [semantic versioning](https://semver.org/) - this tag value will be used to create a package version. Consumers of your action will then be able to specify that version to consume your action from the package, e.g. From b54ac768dfb903ab0651fd9d73ac2724b78ab3cd Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 17:12:06 +0100 Subject: [PATCH 6/8] Update README.md --- README.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 6749b9f..f0fdec5 100644 --- a/README.md +++ b/README.md @@ -4,11 +4,15 @@ > This action is **not ready for public use**. It is part of an upcoming public roadmap item (see [GitHub Actions: Immutable actions publishing](https://github.com/github/roadmap/issues/592)). > Attempts to use this action to upload an OCI artifact will not work until this feature has been fully released to the public. Please do not attempt to use it until that time. -This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). +This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. -Your action workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. -Some examples of these events are [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release), [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push), and [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch). +Your workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. Some examples of these events are: + +- [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release) +- [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push) (only applies to pushed tags) +- [`workflow_dispatch`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch) (only applies subject of dispatch is a tag) + The associated tag must follow [semantic versioning](https://semver.org/) - this tag value will be used to create a package version. Consumers of your action will then be able to specify that version to consume your action from the package, e.g. From 287eff5a0a60e06462b5f04bc82bf37e66447318 Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 17:20:03 +0100 Subject: [PATCH 7/8] Update README.md --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index f0fdec5..5441037 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,8 @@ This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. -Your workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. Some examples of these events are: +Your workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. +Some examples of these events are: - [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release) - [`push`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#push) (only applies to pushed tags) From 3a114e3b75d437feb1d9a9972202f41c6928f71f Mon Sep 17 00:00:00 2001 From: Conor Sloan Date: Tue, 30 Jul 2024 17:25:31 +0100 Subject: [PATCH 8/8] Update README.md --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5441037..0250904 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ This action packages _your action_ as an [OCI container](https://opencontainers.org/) and publishes it to the [GitHub Container registry](https://ghcr.io). This allows your action to be consumed as an _immutable_ package if a [SemVer](https://semver.org/) is specified in the consumer's workflow file. -Your workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. +Your workflow can be triggered by any [event](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows) which has a `GITHUB_REF` that points to a git tag. Some examples of these events are: - [`release`](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release)