BUILD-9447 Generation attestation for build actions#136
Conversation
838e0de to
4102b9d
Compare
e7f5021 to
4e608b9
Compare
b79abe1 to
659dd3d
Compare
- Add generate-provenance and provenance-on-pr input parameters to all 5 build actions - Add provenance-subject-path override parameter for custom artifact paths - Implement artifact capture for all build types: * Gradle: Search build/libs, distributions, publications directories * Maven: Search target directories * Poetry: Search dist directory * NPM: Copy .tgz to .attestation-artifacts before jf npm publish deletes it * Yarn: Copy .tgz to .attestation-artifacts before jf npm publish deletes it - Add attestation step using actions/attest-build-provenance@v3.0.0 - Only generate attestations on default branch (master) or when provenance-on-pr=true - Update example workflows (sonar-dummy-*, sonar-go-enterprise) to use new parameters - Add attestations write permission to workflow examples
…tions On Windows and Mac, /usr/bin/find is a problematic symlink
SonarQube reviewer guideSummary: Adds SLSA build provenance attestation support to all build actions (Maven, Gradle, NPM, Yarn, Poetry). Review Focus: The automatic artifact discovery logic in each build script's Start review at:
|
BUILD-9447: Introduce automatic provenance attestation across build actions
Overview
This PR introduces automatic SLSA provenance attestation generation across Gradle, Maven, NPM, Poetry, and Yarn build actions. Our goal is to cover ~80% of repositories without requiring teams to specify artifact names manually.
What's included
export_built_artifacts, using ecosystem-appropriate filesystem discovery with standard exclusions (e.g., skip sources/javadoc/tests JARs).should_deploy) to avoid noise on non-deploy branches/PRs.maven.deploy.skip=trueto skip attestation for non-deployable modules.Assumptions (by design)
These are industry-standard conventions intended to cover most cases:
build/libs,build/distributions, optionallybuild/reports(SBOMs).target/(with support forproject.build.directory).dist/.*.jar,*.war,*.ear,*.zip,*.tar.gz,*.tar,*.json; plus Maven*.pom/*.asc, Poetry*.whl/*.tar.gz, NPM/Yarn*.tgz).These assumptions are deliberate trade‑offs to reach broad coverage quickly. Covering 100% of relevant artifacts would require stronger standardization across repositories (folder layouts, naming conventions, and artifact naming).
Recommended path for full accuracy
Teams that need precise control should explicitly provide the artifact paths via the
provenance-subject-pathinput, listing the exact files to attest.Validation on 6 repositories
The approach was validated across six repositories (multiple runs for some repos):
Together, these validate Gradle, Maven, Python/Poetry, NPM, and Yarn flows, including default artifact discovery and attestation gating.