Comparing changes

Bumps the npm-development group with 2 updates: [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) and [prettier](https://github.com/prettier/prettier). Updates `eslint-plugin-jest` from 29.15.2 to 29.15.3 - [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases) - [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md) - [Commits](jest-community/eslint-plugin-jest@v29.15.2...v29.15.3) Updates `prettier` from 3.8.4 to 3.9.0 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.4...3.9.0) --- updated-dependencies: - dependency-name: eslint-plugin-jest dependency-version: 29.15.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-development - dependency-name: prettier dependency-version: 3.9.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the actions-minor group with 1 update: [masci/datadog](https://github.com/masci/datadog). Updates `masci/datadog` from 2.0.3 to 2.0.4 - [Release notes](https://github.com/masci/datadog/releases) - [Commits](masci/datadog@7696b77...e6e5018) --- updated-dependencies: - dependency-name: masci/datadog dependency-version: 2.0.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…443) getSubjectFromChecksumsString split the checksums input on os.EOL. On Windows os.EOL is "\r\n", so an LF-only checksums file never split: the whole file collapsed into a single record, only the first artifact was attested, and every other listed file was silently left unattested while the step still succeeded. Split on /\r?\n/ instead so the parser is line-ending agnostic, and add a defense-in-depth guard that rejects any subject name containing a newline so a malformed multi-line record fails loudly instead of producing a partial attestation. Regenerated dist/ to match. Fixes #440 Co-authored-by: Copilot App <[email protected]>

Bumps the actions-minor group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...54f647b) Updates `github/codeql-action/autobuild` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...54f647b) Updates `github/codeql-action/analyze` from 4.36.2 to 4.36.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@8aad20d...54f647b) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor - dependency-name: github/codeql-action/autobuild dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* ci: auto-rebuild dist/ for Dependabot production bumps Add a two-workflow pipeline that rebuilds the transpiled dist/ whenever Dependabot bumps a production dependency, so consumers of the action get the updated JavaScript without a manual rebuild. - rebuild-dist.yml runs unprivileged on the PR (read-only token, no secrets, npm ci --ignore-scripts). Untrusted freshly-bumped dependency code executes here and only produces artifacts. - commit-dist.yml triggers via workflow_run so its definition comes from the default branch, downloads the built dist/ bytes, and commits them back to the PR branch using GITHUB_TOKEN. No PR code runs privileged. Also correct two stale comments in check-dist.yml that described Dependabot actor-gating that was never implemented. Co-authored-by: Copilot App <[email protected]> * ci: address review feedback on dist rebuild workflows - Grant pull-requests: read in rebuild-dist.yml, required by dependabot/fetch-metadata. - Harden commit-dist.yml: strictly validate head-ref/head-sha read from the PR-context artifact (40-hex sha, safe ref charset, single line) and require head-sha to exist before use, preventing workflow-command injection into $GITHUB_OUTPUT. Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Copilot App <[email protected]>

) commit-dist.yml downloaded the artifact into `incoming/` within the workspace, but the later actions/checkout step runs `git clean -ffdx` and deleted that untracked directory before the apply step, failing with "mv: cannot stat 'incoming/dist'". Download to ${{ runner.temp }}/incoming instead, which lives outside $GITHUB_WORKSPACE and is untouched by checkout's clean. Co-authored-by: Copilot App <[email protected]>

…ross 1 directory (#435) * Bump @actions/glob in the npm-production group across 1 directory Bumps the npm-production group with 1 update in the / directory: [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob). Updates `@actions/glob` from 0.6.1 to 0.7.0 - [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob) --- updated-dependencies: - dependency-name: "@actions/glob" dependency-version: 0.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: npm-production ... Signed-off-by: dependabot[bot] <[email protected]> * build: rebuild dist/ for dependency bump --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* Bump csv-parse from 6.2.1 to 7.0.1 Bumps [csv-parse](https://github.com/adaltas/node-csv/tree/HEAD/packages/csv-parse) from 6.2.1 to 7.0.1. - [Changelog](https://github.com/adaltas/node-csv/blob/master/packages/csv-parse/CHANGELOG.md) - [Commits](https://github.com/adaltas/node-csv/commits/[email protected]/packages/csv-parse) --- updated-dependencies: - dependency-name: csv-parse dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> * build: rebuild dist/ for dependency bump --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

* feat: read subjects from GITHUB_ARTIFACTS_LIST Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d * fix: restrict artifact digests to SHA-256 Both file-kind and OCI-kind entries in the runner-provided artifacts list now require sha256 digests only. Remove the broader sha384/sha512 allowance for OCI entries and the corresponding runtime digest-algorithm guard in main.ts (which is now redundant). Update tests and documentation to reflect the SHA-256-only constraint. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d * docs: clarify subject discovery fallback Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d * fix: validate registry push subjects Add source-agnostic preflight validation that runs after subjects are resolved and before createAttestation. When pushToRegistry is true, require exactly one subject with a SHA-256 digest. This ensures explicit subject-checksums with SHA-512 or multiple subjects fail clearly instead of silently skipping the registry push. When pushToRegistry is false, all existing behavior is preserved including SHA-512 checksum attestations and multiple subjects. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d * rebuild dist Signed-off-by: Brian DeHamer <[email protected]> * test: restore full branch coverage - Extract errorMessage helper in artifacts.ts and test both branches (Error instance and non-Error value) to cover the previously-missed false branch at line 53 - Tighten subject-digest regex from [A-Za-z0-9] to [0-9a-fA-F] to reject non-hex characters (e.g. 'g' repeated 64 times) - Add tests for non-hex digest rejection and valid uppercase hex Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d * test: load main via mocked dynamic import for Node <24.9 CI The validateRegistrySubjects unit test statically imported src/main, which loads ESM-only dependencies asynchronously under Jest's experimental VM modules. On the CI Node version (24.5.0) that async import resolves after the environment is torn down and crashes the suite. Mock the ESM-only modules and import main dynamically, mirroring the integration test, so the heavy graph never loads. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d * fix: enforce subject count cap on discovered subjects Discovered subjects from $GITHUB_ARTIFACTS_LIST now respect the same MAX_SUBJECT_COUNT (1024) limit applied to glob and checksum inputs. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d --------- Signed-off-by: Brian DeHamer <[email protected]> Co-authored-by: Copilot App <[email protected]>

Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.2 to 26.1.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the npm-development group with 2 updates in the / directory: [prettier](https://github.com/prettier/prettier) and [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint). Updates `prettier` from 3.9.4 to 3.9.5 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.4...3.9.5) Updates `typescript-eslint` from 8.62.1 to 8.63.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.63.0/packages/typescript-eslint) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-development - dependency-name: typescript-eslint dependency-version: 8.63.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-development ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps the actions-minor group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.36.3 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...99df26d) Updates `github/codeql-action/autobuild` from 4.36.3 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...99df26d) Updates `github/codeql-action/analyze` from 4.36.3 to 4.37.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@54f647b...99df26d) --- updated-dependencies: - dependency-name: github/codeql-action/init dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: github/codeql-action/autobuild dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor - dependency-name: github/codeql-action/analyze dependency-version: 4.37.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.2.0 to 5.2.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.2.0...5.2.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 5.2.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Signed-off-by: Brian DeHamer <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Comparing changes

Open a pull request

Commits on Jul 7, 2026

Commits on Jul 9, 2026

Commits on Jul 10, 2026

Commits on Jul 14, 2026

Commits on Jul 16, 2026

This comparison is taking too long to generate.

Uh oh!