build: adding SLSA provenance generation for nupkg artifacts #228
Conversation
.github/workflows/manual-publish.yml
Outdated
| base64-subjects: "${{ needs.build.outputs.server-sdk-hashes }}" | ||
| upload-assets: true | ||
| upload-tag-name: ${{ input.tag_name }} | ||
| provenance-name: ${{ format('LaunchDarkly.ServerSdk-{0}_provenance.intoto.jsonl', input.tag_name) }} |
There was a problem hiding this comment.
How do we specify release tag name for manual publish workflows?
There was a problem hiding this comment.
Manual publish uses the version in the project file. Manual publish does not support changing the version or tagging.
Release please (a separate workflow) makes the tag and updates the version in the project file to match. For example, the dotnet-server-sdk version is here. The dotnet build tools understand the version internally. There may be a dotnet command to ask the project file for its version if you need it here.
There was a problem hiding this comment.
In C++ we made it so you could only publish an existing label. Which means you need to change the label if you are doing a manual publish to fix a problem.
It is really inconvenient. Not sure if there would be a happy medium to handle both cases.
.github/workflows/manual-publish.yml
Outdated
| base64-subjects: "${{ needs.build.outputs.telemetry-hashes }}" | ||
| upload-assets: true | ||
| upload-tag-name: ${{ input.tag_name }} | ||
| provenance-name: ${{ format('LaunchDarkly.ServerSdk.Telemetry-{0}_provenance.intoto.jsonl', input.tag_name) }} |
rsoberano-ld
deleted the
rsoberano/SEC-5135/dotnet-server-sdk-slsa-provenance
branch
Requirements
Related issues
Provide links to any issues in this repository or elsewhere relating to this pull request.
Describe the solution you've provided
Provide a clear and concise description of what you expect to happen.
Describe alternatives you've considered
Provide a clear and concise description of any alternative solutions or features you've considered.
Additional context
Add any other context about the pull request here.