Read subjects from GITHUB_ARTIFACTS_LIST#447
Merged
Merged
Conversation
Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
Both file-kind and OCI-kind entries in the runner-provided artifacts list now require sha256 digests only. Remove the broader sha384/sha512 allowance for OCI entries and the corresponding runtime digest-algorithm guard in main.ts (which is now redundant). Update tests and documentation to reflect the SHA-256-only constraint. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds automatic subject discovery for the attest action by falling back to the runner-provided $GITHUB_ARTIFACTS_LIST JSON file when no explicit subject inputs are supplied, enabling workflows to attest produced artifacts without wiring subject inputs manually.
Changes:
- Add
readArtifactsList/parseArtifactsListto read + strictly validate subjects from$GITHUB_ARTIFACTS_LIST. - Update subject resolution to prefer explicit inputs, otherwise use discovered subjects (with registry-push constraints and OCI name normalization when applicable).
- Add unit + integration tests and update documentation/action metadata to describe the new fallback behavior.
Show a summary per file
| File | Description |
|---|---|
| src/subject.ts | Adds fallback to runner artifacts list when no explicit subject inputs are provided. |
| src/artifacts.ts | Introduces artifacts list reader/parser with validation, dedup, and registry constraints. |
| README.md | Documents automatic subject discovery and artifacts list JSON shape/constraints. |
| dist/index.js | Re-bundled distribution output including the new artifacts list logic. |
| action.yml | Updates input descriptions to reflect “at most one” subject input and discovery fallback. |
| tests/unit/subject.test.ts | Adds tests for subject discovery precedence, normalization, and error cases. |
| tests/unit/artifacts.test.ts | Adds comprehensive unit tests for artifacts list parsing/validation behavior. |
| tests/integration/main.test.ts | Adds integration coverage for discovery behavior and registry-related rejections. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 7/8 changed files
- Comments generated: 2
- Review effort level: Low
Add source-agnostic preflight validation that runs after subjects are resolved and before createAttestation. When pushToRegistry is true, require exactly one subject with a SHA-256 digest. This ensures explicit subject-checksums with SHA-512 or multiple subjects fail clearly instead of silently skipping the registry push. When pushToRegistry is false, all existing behavior is preserved including SHA-512 checksum attestations and multiple subjects. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
Signed-off-by: Brian DeHamer <[email protected]>
- Extract errorMessage helper in artifacts.ts and test both branches (Error instance and non-Error value) to cover the previously-missed false branch at line 53 - Tighten subject-digest regex from [A-Za-z0-9] to [0-9a-fA-F] to reject non-hex characters (e.g. 'g' repeated 64 times) - Add tests for non-hex digest rejection and valid uppercase hex Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
The validateRegistrySubjects unit test statically imported src/main, which loads ESM-only dependencies asynchronously under Jest's experimental VM modules. On the CI Node version (24.5.0) that async import resolves after the environment is torn down and crashes the suite. Mock the ESM-only modules and import main dynamically, mirroring the integration test, so the heavy graph never loads. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
Discovered subjects from $GITHUB_ARTIFACTS_LIST now respect the same MAX_SUBJECT_COUNT (1024) limit applied to glob and checksum inputs. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 1f0a618f-2ff5-464e-9c70-e29acccf2c3d
bdehamer
marked this pull request as ready for review
July 13, 2026 19:58
malancas
approved these changes
Jul 14, 2026
| delete process.env[ENV_KEY] | ||
|
|
||
| await expect(subjectFromInputs(blankInputs)).rejects.toThrow( | ||
| /one of subject-path, subject-digest, or subject-checksums must be provided/i |
Contributor
There was a problem hiding this comment.
Should this error message be updated to reference the new fallback "GITHUB_ARTIFACTS"?
Collaborator
Author
There was a problem hiding this comment.
Until we've officially launched that feature, I don't want to mention it in the error as it could be confusing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When none of the explicit subject inputs (
subject-path,subject-digest,subject-checksums) are provided, the action now falls back to subjectsdiscovered from the runner-provided
$GITHUB_ARTIFACTS_LISTenvironmentvariable. This variable, introduced in actions/runner#4527,
points to a JSON file describing artifacts produced during the workflow.
Key behaviors:
$GITHUB_ARTIFACTS_LISTis never consulted.fileandocikinds)must use
sha256digests. Other algorithms are rejected at parse time.schema — version, entry structure, kind-specific digest algorithm rules,
and hex format/length.
push-to-registryis enabled, discoveredsubjects must contain exactly one OCI-kind entry. File-kind subjects and
multi-subject lists are rejected early with clear error messages.
duplicate detection when the registry push flow is active, ensuring
case-only duplicates are collapsed and case-colliding names with
conflicting digests are caught.
are silently deduplicated; same-name entries with differing kind or
digest are rejected.
Tests: comprehensive unit tests for the new
parseArtifactsListparser(structural validation, version checks, entry validation, kind-specific
algorithm rules, dedup/conflicts, OCI normalization, registry constraints)
plus integration tests covering the full
run()flow with discoveredsubjects, registry rejection, and explicit-input precedence.