You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[bug] builder-fetch.sh breaks when using action @sha instead of @tag #4216
When using this action based on a git sha instead of tag (as recommended by the ossf scorecard guidelines), this action fails with slsa-generator-generic-linux-amd64: No such file or directory
I found that this is caused by this builer-fetch.sh script :
echo"Invalid ref: $BUILDER_REF. Expected ref of the form refs/tags/vX.Y.Z"
To Reproduce
Steps to reproduce the behavior:
Create an action using the SHA: uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@f7dd8c54c2067bafc12ca7a55595d5ee9b75204a # v2.1.0
Expected behavior
Using the sha that represents a tag should wield the same result.
Activity
chore: revert SLSA generator to tag pinning
chore: create renovate group for SLSA actions
chore: create renovate group for SLSA actions (#10120)
chore: create renovate group for SLSA actions (#10120)
chore: create renovate group for SLSA actions (#10120)
chore: create renovate group for SLSA actions (#10120)
fix(ci): pin slsa-github-generator by tag, not SHA
fix(ci): pin SLSA generator by tag to satisfy builder-fetch ref check (…