{"id":20761343,"url":"https://github.com/philips-labs/slsa-provenance-action","last_synced_at":"2025-04-06T11:11:14.400Z","repository":{"id":37864107,"uuid":"405972862","full_name":"philips-labs/slsa-provenance-action","owner":"philips-labs","description":"Github Action implementation of SLSA Provenance Generation","archived":false,"fork":false,"pushed_at":"2024-12-23T05:03:18.000Z","size":882,"stargazers_count":47,"open_issues_count":32,"forks_count":18,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-01-02T16:36:38.537Z","etag":null,"topics":["github-action","github-actions","hacktoberfest","in-toto","provenance","security","security-tools","slsa","software-supply-chain"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/philips-labs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-09-13T12:54:02.000Z","updated_at":"2024-12-09T08:37:00.000Z","dependencies_parsed_at":"2023-02-14T05:01:17.869Z","dependency_job_id":"c0595e29-8dc5-4f4f-9232-66b36c16019b","html_url":"https://github.com/philips-labs/slsa-provenance-action","commit_stats":null,"previous_names":[],"tags_count":24,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/philips-labs%2Fslsa-provenance-action","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/philips-labs%2Fslsa-provenance-action/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/philips-labs%2Fslsa-provenance-action/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/philips-labs%2Fslsa-provenance-action/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/philips-labs","download_url":"https://codeload.github.com/philips-labs/slsa-provenance-action/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247471521,"owners_count":20944158,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["github-action","github-actions","hacktoberfest","in-toto","provenance","security","security-tools","slsa","software-supply-chain"],"created_at":"2024-11-17T10:19:06.567Z","updated_at":"2025-04-06T11:11:14.375Z","avatar_url":"https://github.com/philips-labs.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"\u003cdiv id=\"top\"\u003e\u003c/div\u003e\n\n\u003cdiv align=\"center\"\u003e\n\n[![Contributors][contributors-shield]][contributors-url]\n[![Forks][forks-shield]][forks-url]\n[![Stargazers][stars-shield]][stars-url]\n[![Issues][issues-shield]][issues-url]\n[![MIT License][license-shield]][license-url]\n\n\u003c/div\u003e\n\n\u003cbr /\u003e\n\u003cdiv align=\"center\"\u003e\n  \u003ca href=\"https://github.com/philips-labs/slsa-provenance-action\"\u003e\n    \u003cimg src=\"https://slsa.dev/images/levelBadge1.svg\" alt=\"Logo\" width=\"80\" height=\"80\"\u003e\n  \u003c/a\u003e\n\n  \u003ch3 align=\"center\"\u003eSLSA Provenance GitHub Action\u003c/h3\u003e\n\n  \u003cp align=\"center\"\u003e\n    Github Action to generate [SLSA provenance][slsa-provenance]\n    \u003cbr\u003e\n    \u003ca href=\"https://github.com/philips-labs/slsa-provenance-action/issues\"\u003eReport Bug\u003c/a\u003e\n    ·\n    \u003ca href=\"https://github.com/philips-labs/slsa-provenance-action/issues\"\u003eRequest Feature\u003c/a\u003e\n  \u003c/p\u003e\n\u003c/div\u003e\n\n\u003c!-- ABOUT THE PROJECT --\u003e\n## About This Project\n\nThis GitHub action implements the level 1 requirements of the [SLSA framework](https://slsa.dev/). By using this GitHub Action it is possible to easily generate the provenance file for different artifact types.\nDifferent artifact types include, but not limited to:\n\n- Files\n- Push event (Docker Hub, trigger different workflow, etc)\n\nWhile there are no integrity guarantees on the produced provenance at L1,\npublishing artifact provenance in a common format opens up opportunities for\nautomated analysis and auditing. Additionally, moving build definitions into\nsource control and onto well-supported, secure build systems represents a marked\nimprovement from the ecosystem's current state.\n\nThis is not an official GitHub Action set up and maintained by the SLSA team. This GitHub Action is built for research purposes by Philips Research. It is heavily inspired by the original [Provenance Action example](https://github.com/slsa-framework/github-actions-demo) built by SLSA.\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Background\n\n[SLSA](https://github.com/slsa-framework/slsa) is a framework intended to codify\nand promote secure software supply-chain practices. SLSA helps trace software\nartifacts (e.g. binaries) back to the build and source control systems that\nproduced them using in-toto's\n[Attestation](https://github.com/in-toto/attestation/blob/main/spec/README.md)\nmetadata format.\n\n### Built With\n\n- [SLSA Framework](https://github.com/slsa-framework/slsa/)\n- [Golang](https://golang.org/)\n- [GitHub Actions](https://github.com/features/actions)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Getting Started\n\nGet started quickly by reading the information below.\n\n### Prerequisites\n\nEnsure you have the following installed:\n\n- Golang\n- Docker\n\n#### Recommendations\n\nThe following IDE is recommended when working on this codebase:\n\n- [VSCode](https://code.visualstudio.com/)\n\n### Local Installation\n\n1. Clone the repo.\n\n   ```sh\n   git clone git@github.com:philips-labs/slsa-provenance-action.git\n   ```\n\n1. Build the binary.\n\n   ```sh\n   make build\n   ```\n\n1. Execute the binary.\n\n   ```sh\n   ./bin/slsa-provenance help\n   ```\n\n### Docker Image\n\nOur Docker images are available at both GitHub Container Registry (ghcr) and Docker Hub.\n\n**Docker Hub**\nSee all available images [here.](https://hub.docker.com/r/philipssoftware/slsa-provenance/tags)\nRun the Docker image by doing:\n\n```sh\ndocker run philipssoftware/slsa-provenance:v0.7.2\n```\n\n**GitHub Container Registry**\nSee all available images [here.](https://github.com/philips-labs/slsa-provenance-action/pkgs/container/slsa-provenance)\nRun the Docker image by doing:\n\n```sh\ndocker run ghcr.io/philips-labs/slsa-provenance:v0.7.2\n```\n\nThe Docker image includes the working binary that can be executed by using the ``slsa-provenance`` command.\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Usage\n\nThe easiest way to use this action is to add the following into your workflow file. Additional configuration might be necessary to fit your usecase.\n\n\u003cdetails\u003e\n  \u003csummary\u003eGitHub Releases\u003c/summary\u003e\n\n  Add the following part in your workflow file:\n\n  See [ci workflow](.github/workflows/ci.yaml) for a full example using GitHub releases.\n\n  \u003e :warning: **NOTE:** this job depends on a release job that publishes the release assets to a GitHub Release.\n\n  ```yaml\n  provenance:\n    name: provenance\n    needs: [release]\n    runs-on: ubuntu-20.04\n    permissions:\n      # required to update the release.\n      contents: write\n\n    steps:\n      - name: Generate provenance for Release\n        uses: philips-labs/slsa-provenance-action@v0.7.2\n        with:\n          command: generate\n          subcommand: github-release\n          arguments: --artifact-path release-assets --output-path 'provenance.json' --tag-name ${{ github.ref_name }}\n        env:\n          GITHUB_TOKEN: \"${{ secrets.GITHUB_TOKEN }}\"\n  ```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003eGitHub artifacts\u003c/summary\u003e\n\n  Add the following part in your workflow file:\n\n  See [example workflow](.github/workflows/example-publish.yaml) for a full example using GitHub artifacts.\n\n  ```yaml\n  generate-provenance:\n    name: Generate build provenance\n    runs-on: ubuntu-latest\n    steps:\n      - name: Download build artifact\n        uses: actions/download-artifact@v2\n        with:\n          path: artifact/\n\n      - name: Download extra materials for provenance\n        uses: actions/download-artifact@v2\n        with:\n          name: extra-materials\n          path: extra-materials/\n\n      - name: Generate provenance\n        uses: philips-labs/slsa-provenance-action@v0.7.2\n        with:\n          command: generate\n          subcommand: files\n          arguments: --artifact-path artifact/ --extra-materials extra-materials/file1.json,extra-materials/some-more.json\n\n      - name: Upload provenance\n        uses: actions/upload-artifact@v2\n        with:\n          path: provenance.json\n  ```\n\n\u003c/details\u003e\n\n### Description\n\nAn action to generate SLSA build provenance for an artifact\n\n### Inputs\n\n| parameter | description | required | default |\n| - | - | - | - |\n| command | The slsa-provenance command to run | `false` | generate |\n| subcommand | The subcommand to use when generating provenance | `false` | files |\n| github_context | internal (do not set): the \"github\" context object in json | `true` | ${{ toJSON(github) }} |\n| runner_context | internal (do not set): the \"runner\" context object in json | `true` | ${{ toJSON(runner) }} |\n| arguments | the arguments for the given `command` and `subcommand` | `true` |  |\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Contributing\n\nIf you have a suggestion that would make this project better, please fork the repository and create a pull request. You can also simply open an issue with the tag \"enhancement\".\n\n1. Fork the Project\n2. Create your Feature Branch (`git checkout -b feature/AmazingFeature`)\n3. Commit your Changes (`git commit -m 'Add some AmazingFeature'`)\n4. Push to the Branch (`git push origin feature/AmazingFeature`)\n5. Open a Pull Request\n\nPlease refer to the [Contributing Guidelines](/CONTRIBUTING.md) for all the guidelines.\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## License\n\nDistributed under the MIT License. See [LICENSE](/LICENSE.md) for more information.\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Contact\n\n*Powered by Philips SWAT Eindhoven*\n\n- [Brend Smits](https://github.com/Brend-Smits) - brend.smits@philips.com\n- [Marco Franssen](https://github.com/marcofranssen)\n- [Jeroen Knoops](https://github.com/JeroenKnoops)\n- [Annie Jovitha](https://github.com/AnnieJovitha)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n## Acknowledgments\n\nThis project is inspired by:\n\n- [SLSA Framework](https://slsa.dev/)\n- [SLSA GitHub Action Example](https://github.com/slsa-framework/github-actions-demo)\n\n\u003cp align=\"right\"\u003e(\u003ca href=\"#top\"\u003eback to top\u003c/a\u003e)\u003c/p\u003e\n\n[contributors-shield]: https://img.shields.io/github/contributors/philips-labs/slsa-provenance-action.svg?style=for-the-badge\n[contributors-url]: https://github.com/philips-labs/slsa-provenance-action/graphs/contributors\n[forks-shield]: https://img.shields.io/github/forks/philips-labs/slsa-provenance-action.svg?style=for-the-badge\n[forks-url]: https://github.com/philips-labs/slsa-provenance-action/network/members\n[stars-shield]: https://img.shields.io/github/stars/philips-labs/slsa-provenance-action.svg?style=for-the-badge\n[stars-url]: https://github.com/philips-labs/slsa-provenance-action/stargazers\n[issues-shield]: https://img.shields.io/github/issues/philips-labs/slsa-provenance-action.svg?style=for-the-badge\n[issues-url]: https://github.com/philips-labs/slsa-provenance-action/issues\n[license-shield]: https://img.shields.io/github/license/philips-labs/slsa-provenance-action.svg?style=for-the-badge\n[license-url]: https://github.com/philips-labs/slsa-provenance-action/blob/main/LICENSE.md\n[slsa-provenance]: https://slsa.dev/provenance/v0.2\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphilips-labs%2Fslsa-provenance-action","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fphilips-labs%2Fslsa-provenance-action","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fphilips-labs%2Fslsa-provenance-action/lists"}