Create generator-generic-ossf-slsa3-publish.yml by Kushmanmb · Pull Request #1640 · github/gh-ost
This pull request adds a new GitHub Actions workflow to generate SLSA provenance files for project artifacts, enhancing supply chain security and compliance with SLSA level 3 requirements. The workflow builds artifacts, computes their hashes, and uses the OpenSSF SLSA generator to produce and optionally upload provenance files during releases or manual dispatches.
Supply Chain Security Integration:
- Added a new workflow file
.github/workflows/generator-generic-ossf-slsa3-publish.ymlthat builds sample artifacts, computes their SHA256 hashes, and generates SLSA provenance files using theslsa-framework/slsa-github-generatoraction. - Configured the workflow to trigger on releases and manual dispatch, and to upload provenance files as release assets for verification and traceability.## A Pull Request should be associated with an Issue.
We wish to have discussions in Issues. A single issue may be targeted by multiple PRs.
If you're offering a new feature or fixing anything, we'd like to know beforehand in Issues,
and potentially we'll be able to point development in a particular direction.
Related issue: https://github.com/github/gh-ost/issues/0123456789
Further notes in https://github.com/github/gh-ost/blob/master/.github/CONTRIBUTING.md
Thank you! We are open to PRs, but please understand if for technical reasons we are unable to accept each and any PR
Description
This PR [briefly explain what it does]
In case this PR introduced Go code changes:
- contributed code is using same conventions as original code
-
script/cibuildreturns with no formatting errors, build errors or unit test errors.