From 4650c6834ff33205c572f2a9d50f44e041ce5658 Mon Sep 17 00:00:00 2001 From: idaundaw-debug Date: Tue, 6 Jan 2026 22:19:02 +0700 Subject: [PATCH 1/3] Add SLSA generic generator workflow This workflow generates SLSA provenance files for projects, satisfying level 3 requirements. --- .../generator-generic-ossf-slsa3-publish.yml | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 .github/workflows/generator-generic-ossf-slsa3-publish.yml diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml new file mode 100644 index 00000000..35c829b1 --- /dev/null +++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml @@ -0,0 +1,66 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow lets you generate SLSA provenance file for your project. +# The generation satisfies level 3 for the provenance requirements - see https://slsa.dev/spec/v0.1/requirements +# The project is an initiative of the OpenSSF (openssf.org) and is developed at +# https://github.com/slsa-framework/slsa-github-generator. +# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier. +# For more information about SLSA and how it improves the supply-chain, visit slsa.dev. + +name: SLSA generic generator +on: + workflow_dispatch: + release: + types: [created] + +jobs: + build: + runs-on: ubuntu-latest + outputs: + digests: ${{ steps.hash.outputs.digests }} + + steps: + - uses: actions/checkout@v4 + + # ======================================================== + # + # Step 1: Build your artifacts. + # + # ======================================================== + - name: Build artifacts + run: | + # These are some amazing artifacts. + echo "artifact1" > artifact1 + echo "artifact2" > artifact2 + + # ======================================================== + # + # Step 2: Add a step to generate the provenance subjects + # as shown below. Update the sha256 sum arguments + # to include all binaries that you generate + # provenance for. + # + # ======================================================== + - name: Generate subject for provenance + id: hash + run: | + set -euo pipefail + + # List the artifacts the provenance will refer to. + files=$(ls artifact*) + # Generate the subjects (base64 encoded). + echo "hashes=$(sha256sum $files | base64 -w0)" >> "${GITHUB_OUTPUT}" + + provenance: + needs: [build] + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write # To add assets to a release. + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.4.0 + with: + base64-subjects: "${{ needs.build.outputs.digests }}" + upload-assets: true # Optional: Upload to a new release From 0b579515b9d1628b4b4735ce0abc6dfc24f96526 Mon Sep 17 00:00:00 2001 From: idaundaw-debug Date: Tue, 6 Jan 2026 23:06:11 +0700 Subject: [PATCH 2/3] Update GitHub Actions workflow for deployment Replaced staging deployment steps with Armory Continuous Deployment action. --- .github/workflows/main.yml | 59 ++++++++++++++------------------------ 1 file changed, 22 insertions(+), 37 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 69cbd4b7..79a072b4 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -1,37 +1,22 @@ -name: Main - -on: - push: - branches: ['main'] - -env: - FORCE_COLOR: 1 - -jobs: - deploy-staging: - name: Deploy (staging) - runs-on: ubuntu-24.04 - permissions: - contents: read - timeout-minutes: 10 - concurrency: ${{ github.workflow }}-deploy-staging - steps: - - name: Checkout Repo - uses: actions/checkout@v4 - - uses: ./.github/actions/setup - - # Run tests & checks before deploying - - name: Syncpack lint - run: pnpm check:deps - - name: Run linter - run: pnpm check:turbo - - name: Run linter (formatting) - run: pnpm check:format - - name: Run tests - run: pnpm test - - - name: Deploy Workers (staging) - run: pnpm turbo deploy -- -e staging - env: - CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} - CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }} + - name: Armory Continuous Deployment-as-a-Service + # You may pin to the exact commit or the version. + # uses: armory/cli-deploy-action@36fc96b3e295e960d22f96513ef781bb9865a87c + uses: armory/cli-deploy-action@v1.0.0 + with: + # Path to the configuration YAML file used to configure your deployment + path-to-file: + # extra args to the deployment start command + applicationName: # optional + # extra context params to the deployment start command + addContext: # optional + # ClientId for Armory Cloud + clientId: + # ClientSecret for Armory Cloud + clientSecret: + # Intended audience of requests that will use your Armory Cloud authentication token. Is deployHostUrl by default + audience: # optional, default is https://api.cloud.armory.io + # Armory Cloud authentication provider url + tokenIssuerUrl: # optional, default is https://auth.cloud.armory.io/oauth + # Location of the Armory Cloud API which will handle your deployment + deployHostUrl: # optional, default is api.cloud.armory.io + From 0341304f453b0f9c2361fe2f53326cc201707443 Mon Sep 17 00:00:00 2001 From: idaundaw-debug Date: Wed, 7 Jan 2026 01:28:39 +0700 Subject: [PATCH 3/3] Delete .github/workflows/main.yml --- .github/workflows/main.yml | 22 ---------------------- 1 file changed, 22 deletions(-) delete mode 100644 .github/workflows/main.yml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml deleted file mode 100644 index 79a072b4..00000000 --- a/.github/workflows/main.yml +++ /dev/null @@ -1,22 +0,0 @@ - - name: Armory Continuous Deployment-as-a-Service - # You may pin to the exact commit or the version. - # uses: armory/cli-deploy-action@36fc96b3e295e960d22f96513ef781bb9865a87c - uses: armory/cli-deploy-action@v1.0.0 - with: - # Path to the configuration YAML file used to configure your deployment - path-to-file: - # extra args to the deployment start command - applicationName: # optional - # extra context params to the deployment start command - addContext: # optional - # ClientId for Armory Cloud - clientId: - # ClientSecret for Armory Cloud - clientSecret: - # Intended audience of requests that will use your Armory Cloud authentication token. Is deployHostUrl by default - audience: # optional, default is https://api.cloud.armory.io - # Armory Cloud authentication provider url - tokenIssuerUrl: # optional, default is https://auth.cloud.armory.io/oauth - # Location of the Armory Cloud API which will handle your deployment - deployHostUrl: # optional, default is api.cloud.armory.io -