ci: attest build provenance for CLI binaries#8379
Conversation
|
WalkthroughThis change adds build provenance attestation to the release workflows. GitHub Actions permissions are extended with Pre-merge checks and finishing touches✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/release.yml (1)
12-12: Workflow-level attestation permissions added.Adding
attestations: writeandid-token: writeat the workflow level simplifies configuration, though this grants these permissions to all jobs. Since neitherbuild-wasmnorbuild-js-apiuse these permissions, consider whether job-level scoping (as done inrelease_cli.yml) would be more security-conscious.Alternatively, this is acceptable if you prefer simplicity over strict least-privilege here.
Also applies to: 14-14
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/release.yml(3 hunks).github/workflows/release_cli.yml(4 hunks)
🔇 Additional comments (6)
.github/workflows/release_cli.yml (4)
67-70: Job-level permissions explicitly scoped.The permissions block correctly restricts access to what's needed for attestation generation. Good practice for security.
151-154: Consistent permissions across build jobs.Matching the permissions from the earlier build job is appropriate for consistency.
188-191: Attest step placement is correct.The step is positioned between binary copying and artifact upload, which is the right place for provenance generation.
124-127: Action version is current and compatible with Depot runners.The
actions/attest-build-provenance@v3.0.0is the latest available version. It works properly with Depot's managed runners, provided the job grants the required permissions (id-token: writeandattestations: write) and the runner can request GitHub OIDC tokens—both of which Depot runners support..github/workflows/release.yml (2)
181-184: Attest step in standard build job looks good.Placement and configuration mirror the CLI workflow. The
build-binariesjob correctly inherits the necessary permissions from the workflow level.
239-242: Ensure build artifacts are accessible to the attest action from containerized build steps.The
attest-build-provenanceaction runs in the job context after containerized build steps complete. Verify that./dist/biome-*artifacts built inside the Docker container are accessible to the action—container outputs must be mounted or copied to the host job filesystem. OIDC token access is not constrained by containerization since the action operates outside the container.
There was a problem hiding this comment.
This workflow is currently unused, it's here for backup
Summary
Generates a build provenance for CLI binaries in a release, using the
actions/attest-build-provenanceaction. Users now can verify the binaries using gh CLI to ensure they're really built on GitHub Actions. It's similar to npm's provenance feature, but for CLI binaries.ref: https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations
Test Plan
Fingers crossed on the next release
Docs
N/A