actions/publish-immutable-action
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

upload attestation and referrer index before artifact

Browse Source 
This avoids race conditions when the artifact is read but its attestation doesn't exist
This commit is contained in:
Conor Sloan
2024-08-22 16:10:12 +01:00
parent 1f725c56d6
commit c11354f432
3 changed files with 154 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/index.js
Generated Vendored
+6 -6
View File
@@ -107636,13 +107636,9 @@ async function run() {
const archives = await fsHelper.createArchives(stagedActionFilesDir, archiveDir);
const manifest = ociContainer.createActionPackageManifest(archives.tarFile, archives.zipFile, options.nameWithOwner, options.repositoryId, options.repositoryOwnerId, options.sha, semverTag.raw, new Date());
const manifestDigest = ociContainer.sha256Digest(manifest);
const { packageURL, publishedDigest } = await ghcr.publishOCIArtifact(options.token, options.containerRegistryUrl, options.nameWithOwner, semverTag.raw, archives.zipFile, archives.tarFile, manifest);
if (manifestDigest !== publishedDigest) {
throw new Error(`Unexpected digest returned for manifest. Expected ${manifestDigest}, got ${publishedDigest}`);
}
// Attestations are not currently supported in GHES.
// Attestations are not supported in GHES.
if (!options.isEnterprise) {
const attestation = await uploadAttestation(publishedDigest, semverTag.raw, options);
const attestation = await uploadAttestation(manifestDigest, semverTag.raw, options);
if (attestation.digest !== undefined) {
core.info(`Uploaded attestation ${attestation.digest}`);
core.setOutput('attestation-manifest-sha', attestation.digest);
@@ -107652,6 +107648,10 @@ async function run() {
core.setOutput('attestation-url', attestation.urls[0]);
}
}
const { packageURL, publishedDigest } = await ghcr.publishOCIArtifact(options.token, options.containerRegistryUrl, options.nameWithOwner, semverTag.raw, archives.zipFile, archives.tarFile, manifest);
if (manifestDigest !== publishedDigest) {
throw new Error(`Unexpected digest returned for manifest. Expected ${manifestDigest}, got ${publishedDigest}`);
}
core.setOutput('package-url', packageURL.toString());
core.setOutput('package-manifest', JSON.stringify(manifest));
core.setOutput('package-manifest-sha', publishedDigest);