actions/toolkit
2
0
Fork 0
mirror of https://github.com/actions/toolkit.git synced 2026-08-25 00:00:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

When creating the workflow claims, actually use the data from the workflow

Browse Source 
claim in the JWT
This commit is contained in:
Fredrik Skogman
2026-01-20 13:42:14 +01:00
parent ee91adfbc4
commit 90cb9652e6
3 changed files with 84 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/attest/__tests__/provenance.test.ts
+29 -3
View File
@@ -23,8 +23,27 @@ describe('provenance functions', () => {
repository: 'owner/repo',
ref: 'refs/heads/main',
sha: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
job_workflow_ref: 'owner/workflows/.github/workflows/publish.yml@main',
workflow_ref: 'owner/repo/.github/workflows/main.yml@main',
job_workflow_ref:
'owner/workflows/.github/workflows/publish.yml@refs/heads/main',
workflow_ref: 'owner/repo/.github/workflows/main.yml@refs/heads/main',
event_name: 'push',
repository_id: 'repo-id',
repository_owner_id: 'owner-id',
run_id: 'run-id',
run_attempt: 'run-attempt',
runner_environment: 'github-hosted'
}
const orgEnforcedclaims = {
iss: issuer,
aud: 'nobody',
repository: 'owner/repo',
ref: 'refs/heads/main',
sha: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
job_workflow_ref:
'enterprise/org-workflows/.github/workflows/enforce.yml@refs/heads/vetted',
workflow_ref:
'enterprise/org-workflows/.github/workflows/enforce.yml@refs/heads/vetted',
event_name: 'push',
repository_id: 'repo-id',
repository_owner_id: 'owner-id',
@@ -73,7 +92,14 @@ describe('provenance functions', () => {
describe('buildSLSAProvenancePredicate', () => {
it('returns a provenance hydrated from an OIDC token', async () => {
const predicate = await buildSLSAProvenancePredicate()
expect(predicate).toMatchSnapshot()
expect(predicate).toMatchSnapshot('provenance with OIDC token')
})
it('returns a provenance from an org required workflow', async () => {
nock.cleanAll()
await mockIssuer(orgEnforcedclaims)
const predicate = await buildSLSAProvenancePredicate()
expect(predicate).toMatchSnapshot('provenance from org required workflow')
})
})