From e4999289cef36dec982154ca2a12e3fb6895c682 Mon Sep 17 00:00:00 2001 From: divyanshujethi Date: Sat, 7 Nov 2026 06:50:36 +0530 Subject: [PATCH] fix(ci): upgrade scorecard to v2.4.1 and fix SLSA provenance digests output --- .github/workflows/generator-generic-ossf-slsa3-publish.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml index 35c829b..ccf0cd8 100644 --- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -52,7 +52,7 @@ jobs: # List the artifacts the provenance will refer to. files=$(ls artifact*) # Generate the subjects (base64 encoded). - echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" + echo "digests=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" provenance: needs: [build] @@ -60,7 +60,7 @@ jobs: actions: read # To read the workflow path. id-token: write # To sign the provenance. contents: write # To add assets to a release. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 with: base64-subjects: "${{ needs.build.outputs.digests }}" upload-assets: true # Optional: Upload to a new release diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index e44d4fc..ef6a040 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -27,7 +27,7 @@ jobs: persist-credentials: false - name: Run OpenSSF Scorecard - uses: ossf/scorecard-action@v2.4.0 + uses: ossf/scorecard-action@v2.4.1 with: results_file: results.sarif results_format: sarif