Add build attestations to all uploaded/released artifacts.#1964
Draft
andylockran wants to merge 6 commits intoopen-telemetry:mainfrom
Draft
Add build attestations to all uploaded/released artifacts.#1964andylockran wants to merge 6 commits intoopen-telemetry:mainfrom
andylockran wants to merge 6 commits intoopen-telemetry:mainfrom
Conversation
Loading
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As a step suggested in #1963 , add the GH attestations for binaries produced by the Github workflows on this repository, so that all artefacts generated as a result of the workflows have provenance checks.
It may be that more work needs to be done on deciding how to manage the lifecycle of historic attestations.
https://github.com/actions/attest-build-provenance