try macos-latest-large

Signed-off-by: Brian DeHamer <[email protected]>

.github/workflows/releases.yml

@@ -11,7 +11,7 @@ on:
 
 jobs:
   test:
-    runs-on: macos-latest-large
+    runs-on: macos-latest
 
     steps:
       - name: setup repo
@@ -48,7 +48,7 @@ jobs:
           path: packages/${{ github.event.inputs.package }}/*.tgz
 
   publish:
-    runs-on: macos-latest-large
+    runs-on: macos-latest
     needs: test
     environment: npm-publish
     permissions:

.github/workflows/unit-tests.yml

@@ -17,10 +17,6 @@ jobs:
     strategy:
       matrix:
         runs-on: [ubuntu-latest, macos-latest-large, windows-latest]
-
-        # Node 18 is the current default Node version in hosted runners, so users may still use the toolkit with it when running tests (see https://github.com/actions/toolkit/issues/1841)
-        # Node 20 is the currently support Node version for actions - https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runsusing-for-javascript-actions
-        node-version: [18.x, 20.x]
       fail-fast: false
 
     runs-on: ${{ matrix.runs-on }}
@@ -29,10 +25,10 @@ jobs:
     - name: Checkout
       uses: actions/checkout@v4
 
-    - name: Set up Node ${{ matrix.node-version }}
+    - name: Set Node.js 20.x
       uses: actions/setup-node@v4
       with:
-        node-version: ${{ matrix.node-version }}
+        node-version: 20.x
 
     - name: npm install
       run: npm install

packages/attest/README.md

@@ -32,7 +32,8 @@ async function run() {
     const ghToken = core.getInput('gh-token');
 
     const attestation = await attest({
-        subjects: [{name: 'my-artifact-name', digest: { 'sha256': '36ab4667...'}}],
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
         predicateType: 'https://in-toto.io/attestation/release',
         predicate: { . . . },
         token: ghToken
@@ -48,12 +49,11 @@ The `attest` function supports the following options:
 
 ```typescript
 export type AttestOptions = {
-  // Deprecated. Use 'subjects' instead.
+  // The name of the subject to be attested.
-  subjectName?: string
+  subjectName: string
-  // Deprecated. Use 'subjects' instead.
+  // The digest of the subject to be attested. Should be a map of digest
-  subjectDigest?: Record<string, string>
+  // algorithms to their hex-encoded values.
-  // Collection of subjects to be attested
+  subjectDigest: Record<string, string>
-  subjects?: Subject[]
   // URI identifying the content type of the predicate being attested.
   predicateType: string
   // Predicate to be attested.
@@ -68,13 +68,6 @@ export type AttestOptions = {
   // Whether to skip writing the attestation to the GH attestations API.
   skipWrite?: boolean
 }
-
-export type Subject = {
-   // Name of the subject.
-  name: string
-   // Digests of the subject. Should be a map of digest algorithms to their hex-encoded values.
-  digest: Record<string, string>
-}
 ```
 
 ### `attestProvenance`
@@ -112,13 +105,12 @@ The `attestProvenance` function supports the following options:
 
 ```typescript
 export type AttestProvenanceOptions = {
-  // Deprecated. Use 'subjects' instead.
+  // The name of the subject to be attested.
-  subjectName?: string
+  subjectName: string
-  // Deprecated. Use 'subjects' instead.
+  // The digest of the subject to be attested. Should be a map of digest
-  subjectDigest?: Record<string, string>
+  // algorithms to their hex-encoded values.
-  // Collection of subjects to be attested
+  subjectDigest: Record<string, string>
-  subjects?: Subject[]
+  // GitHub token for writing attestations.
-  // URI identifying the content type of the predicate being attested.
   token: string
   // Sigstore instance to use for signing. Must be one of "public-good" or
   // "github".

packages/attest/RELEASES.md

@@ -1,17 +1,8 @@
 # @actions/attest Releases
 
-### 1.5.0
-
-- Bump @actions/core from 1.10.1 to 1.11.1 [#1847](https://github.com/actions/toolkit/pull/1847)
-- Bump @sigstore/bundle from 2.3.2 to 3.0.0 [#1846](https://github.com/actions/toolkit/pull/1846)
-- Bump @sigstore/sign from 2.3.2 to 3.0.0 [#1846](https://github.com/actions/toolkit/pull/1846)
-- Support for generating multi-subject attestations [#1864](https://github.com/actions/toolkit/pull/1865)
-- Fix bug in `buildSLSAProvenancePredicate` related to `workflow_ref` OIDC token claims containing the "@" symbol in the tag name [#1863](https://github.com/actions/toolkit/pull/1863)
-
 ### 1.4.2
 
 - Fix bug in `buildSLSAProvenancePredicate`/`attestProvenance` when generating provenance statement for enterprise account using customized OIDC issuer value [#1823](https://github.com/actions/toolkit/pull/1823)
-
 ### 1.4.1
 
 - Bump @actions/http-client from 2.2.1 to 2.2.3 [#1805](https://github.com/actions/toolkit/pull/1805)

packages/attest/__tests__/__snapshots__/provenance.test.ts.snap

@@ -1,47 +1,5 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`provenance functions buildSLSAProvenancePredicate handle tags including "@" character 1`] = `
-{
-  "params": {
-    "buildDefinition": {
-      "buildType": "https://actions.github.io/buildtypes/workflow/v1",
-      "externalParameters": {
-        "workflow": {
-          "path": ".github/workflows/main.yml",
-          "ref": "[email protected]",
-          "repository": "https://foo.ghe.com/owner/repo",
-        },
-      },
-      "internalParameters": {
-        "github": {
-          "event_name": "push",
-          "repository_id": "repo-id",
-          "repository_owner_id": "owner-id",
-          "runner_environment": "github-hosted",
-        },
-      },
-      "resolvedDependencies": [
-        {
-          "digest": {
-            "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
-          },
-          "uri": "git+https://foo.ghe.com/owner/repo@refs/heads/main",
-        },
-      ],
-    },
-    "runDetails": {
-      "builder": {
-        "id": "https://foo.ghe.com/owner/workflows/.github/workflows/publish.yml@main",
-      },
-      "metadata": {
-        "invocationId": "https://foo.ghe.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
-      },
-    },
-  },
-  "type": "https://slsa.dev/provenance/v1",
-}
-`;
-
 exports[`provenance functions buildSLSAProvenancePredicate returns a provenance hydrated from an OIDC token 1`] = `
 {
   "params": {

packages/attest/__tests__/attest.test.ts

@@ -1,16 +0,0 @@
-import {attest} from '../src/attest'
-
-describe('attest', () => {
-  describe('when no subject information is provided', () => {
-    it('throws an error', async () => {
-      const options = {
-        predicateType: 'foo',
-        predicate: {bar: 'baz'},
-        token: 'token'
-      }
-      expect(attest(options)).rejects.toThrowError(
-        'Must provide either subjectName and subjectDigest or subjects'
-      )
-    })
-  })
-})

packages/attest/__tests__/intoto.test.ts

@@ -17,7 +17,7 @@ describe('buildIntotoStatement', () => {
   }
 
   it('returns an intoto statement', () => {
-    const statement = buildIntotoStatement([subject], predicate)
+    const statement = buildIntotoStatement(subject, predicate)
     expect(statement).toMatchSnapshot()
   })
 })

packages/attest/__tests__/provenance.test.ts

@@ -33,7 +33,15 @@ describe('provenance functions', () => {
     runner_environment: 'github-hosted'
   }
 
-  const mockIssuer = async (claims: jose.JWTPayload): Promise<void> => {
+  beforeEach(async () => {
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
+      GITHUB_SERVER_URL: 'https://foo.ghe.com',
+      GITHUB_REPOSITORY: claims.repository
+    }
+
     // Generate JWT signing key
     const key = await jose.generateKeyPair('PS256')
 
@@ -52,18 +60,6 @@ describe('provenance functions', () => {
 
     // Mock OIDC token endpoint for populating the provenance
     nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
-  }
-
-  beforeEach(async () => {
-    process.env = {
-      ...originalEnv,
-      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
-      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
-      GITHUB_SERVER_URL: 'https://foo.ghe.com',
-      GITHUB_REPOSITORY: claims.repository
-    }
-
-    await mockIssuer(claims)
   })
 
   afterEach(() => {
@@ -75,16 +71,6 @@ describe('provenance functions', () => {
       const predicate = await buildSLSAProvenancePredicate()
       expect(predicate).toMatchSnapshot()
     })
-
-    it('handle tags including "@" character', async () => {
-      nock.cleanAll()
-      await mockIssuer({
-        ...claims,
-        workflow_ref: 'owner/repo/.github/workflows/main.yml@[email protected]'
-      })
-      const predicate = await buildSLSAProvenancePredicate()
-      expect(predicate).toMatchSnapshot()
-    })
   })
 
   describe('attestProvenance', () => {
@@ -129,7 +115,8 @@ describe('provenance functions', () => {
       describe('when the sigstore instance is explicitly set', () => {
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjects: [{name: subjectName, digest: subjectDigest}],
+            subjectName,
+            subjectDigest,
             token: 'token',
             sigstore: 'github'
           })
@@ -156,7 +143,8 @@ describe('provenance functions', () => {
 
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjects: [{name: subjectName, digest: subjectDigest}],
+            subjectName,
+            subjectDigest,
             token: 'token'
           })
 
@@ -190,7 +178,8 @@ describe('provenance functions', () => {
       describe('when the sigstore instance is explicitly set', () => {
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjects: [{name: subjectName, digest: subjectDigest}],
+            subjectName,
+            subjectDigest,
             token: 'token',
             sigstore: 'public-good'
           })
@@ -217,7 +206,8 @@ describe('provenance functions', () => {
 
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjects: [{name: subjectName, digest: subjectDigest}],
+            subjectName,
+            subjectDigest,
             token: 'token'
           })
 

packages/attest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/attest",
-  "version": "1.5.0",
+  "version": "1.4.2",
   "description": "Actions attestation lib",
   "keywords": [
     "github",
@@ -35,19 +35,19 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "devDependencies": {
-    "@sigstore/mock": "^0.8.0",
+    "@sigstore/mock": "^0.7.4",
-    "@sigstore/rekor-types": "^3.0.0",
+    "@sigstore/rekor-types": "^2.0.0",
     "@types/jsonwebtoken": "^9.0.6",
     "nock": "^13.5.1",
     "undici": "^5.28.4"
   },
   "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.0",
     "@actions/http-client": "^2.2.3",
     "@octokit/plugin-retry": "^6.0.1",
-    "@sigstore/bundle": "^3.0.0",
+    "@sigstore/bundle": "^2.3.2",
-    "@sigstore/sign": "^3.0.0",
+    "@sigstore/sign": "^2.3.2",
     "jose": "^5.2.3"
   },
   "overrides": {

packages/attest/src/attest.ts

@@ -14,16 +14,11 @@ const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
  * Options for attesting a subject / predicate.
  */
 export type AttestOptions = {
-  /**
+  // The name of the subject to be attested.
-   * @deprecated Use `subjects` instead.
+  subjectName: string
-   **/
+  // The digest of the subject to be attested. Should be a map of digest
-  subjectName?: string
+  // algorithms to their hex-encoded values.
-  /**
+  subjectDigest: Record<string, string>
-   * @deprecated Use `subjects` instead.
-   **/
-  subjectDigest?: Record<string, string>
-  // Subjects to be attested.
-  subjects?: Subject[]
   // Content type of the predicate being attested.
   predicateType: string
   // Predicate to be attested.
@@ -47,24 +42,15 @@ export type AttestOptions = {
  * @returns A promise that resolves to the attestation.
  */
 export async function attest(options: AttestOptions): Promise<Attestation> {
-  let subjects: Subject[]
+  const subject: Subject = {
-
+    name: options.subjectName,
-  if (options.subjects) {
+    digest: options.subjectDigest
-    subjects = options.subjects
-  } else if (options.subjectName && options.subjectDigest) {
-    subjects = [{name: options.subjectName, digest: options.subjectDigest}]
-  } else {
-    throw new Error(
-      'Must provide either subjectName and subjectDigest or subjects'
-    )
   }
-
   const predicate: Predicate = {
     type: options.predicateType,
     params: options.predicate
   }
-
+  const statement = buildIntotoStatement(subject, predicate)
-  const statement = buildIntotoStatement(subjects, predicate)
 
   // Sign the provenance statement
   const payload: Payload = {

packages/attest/src/intoto.ts

@@ -20,12 +20,12 @@ export type InTotoStatement = {
  * @returns The constructed in-toto statement.
  */
 export const buildIntotoStatement = (
-  subjects: Subject[],
+  subject: Subject,
   predicate: Predicate
 ): InTotoStatement => {
   return {
     _type: INTOTO_STATEMENT_V1_TYPE,
-    subject: subjects,
+    subject: [subject],
     predicateType: predicate.type,
     predicate: predicate.params
   }

packages/attest/src/provenance.ts

@@ -30,11 +30,9 @@ export const buildSLSAProvenancePredicate = async (
   // Split just the path and ref from the workflow string.
   // owner/repo/.github/workflows/main.yml@main =>
   //   .github/workflows/main.yml, main
-  const [workflowPath, ...workflowRefChunks] = claims.workflow_ref
+  const [workflowPath, workflowRef] = claims.workflow_ref
     .replace(`${claims.repository}/`, '')
     .split('@')
-  // Handle case where tag contains `@` (e.g: when using changesets in a monorepo context),
-  const workflowRef = workflowRefChunks.join('@')
 
   return {
     type: SLSA_PREDICATE_V1_TYPE,

packages/attest/src/sign.ts

@@ -86,6 +86,7 @@ const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
     witnesses.push(
       new RekorWitness({
         rekorBaseURL: opts.rekorURL,
+        entryType: 'dsse',
         fetchOnConflict: true,
         timeout,
         retry
@@ -105,5 +106,5 @@ const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
 
   // Build the bundle with the singleCertificate option which will
   // trigger the creation of v0.3 DSSE bundles
-  return new DSSEBundleBuilder({signer, witnesses})
+  return new DSSEBundleBuilder({signer, witnesses, singleCertificate: true})
 }

packages/cache/RELEASES.md

@@ -1,13 +1,9 @@
 # @actions/cache Releases
 
-### 3.3.0
-- Update `@actions/core` to `1.11.1`
-- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)
-
 ### 3.2.4
 
 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
-
+  
 ### 3.2.3
 
 - Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)

packages/cache/package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "@actions/cache",
-  "version": "3.3.0",
+  "version": "3.2.4",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "3.3.0",
+      "version": "3.2.4",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^1.11.1",
+        "@actions/core": "^1.10.0",
         "@actions/exec": "^1.0.1",
         "@actions/glob": "^0.1.0",
         "@actions/http-client": "^2.1.1",
@@ -25,12 +25,20 @@
       }
     },
     "node_modules/@actions/core": {
-      "version": "1.11.1",
+      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
       "dependencies": {
-        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1",
-        "@actions/http-client": "^2.0.1"
+        "uuid": "^8.3.2"
+      }
+    },
+    "node_modules/@actions/core/node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "bin": {
+        "uuid": "dist/bin/uuid"
       }
     },
     "node_modules/@actions/exec": {
@@ -507,12 +515,19 @@
   },
   "dependencies": {
     "@actions/core": {
-      "version": "1.11.1",
+      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.0.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "integrity": "sha512-2aZDDa3zrrZbP5ZYg159sNoLRb61nQ7awl5pSvIq5Qpj81vwDzdMRKzkWJGJuwVvWpvZKx7vspJALyvaaIQyug==",
       "requires": {
-        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1",
-        "@actions/http-client": "^2.0.1"
+        "uuid": "^8.3.2"
+      },
+      "dependencies": {
+        "uuid": {
+          "version": "8.3.2",
+          "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+          "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
+        }
       }
     },
     "@actions/exec": {

packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "3.3.0",
+  "version": "3.2.4",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [
@@ -37,7 +37,7 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/core": "^1.11.1",
+    "@actions/core": "^1.10.0",
     "@actions/exec": "^1.0.1",
     "@actions/glob": "^0.1.0",
     "@actions/http-client": "^2.1.1",

packages/tool-cache/RELEASES.md

@@ -1,8 +1,5 @@
 # @actions/tool-cache Releases
 
-### Unreleased
-- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)
-
 ### 2.0.1
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)