Add SLSA source provenance workflow and VSA integration#1199
Merged
Conversation
Contributor
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
WalkthroughAdds a reusable Source Provenance workflow, wires CI to run it, extends the build job to verify source provenance and optionally generate/use a Verification Summary Attestation (VSA) predicate to attest built artifacts, and documents VSA verification in the installation guide. ChangesSLSA Source Provenance and Attestation
Sequence Diagram(s)sequenceDiagram
participant CI as CI Workflow (.github/workflows/ci.yml)
participant Prov as Source Provenance Workflow
participant Build as Build Job
participant Verify as gh attestation verify
participant Attest as actions/attest
participant Artifacts as Actions Artifact Upload
CI->>Prov: invoke (non-PR, minimal perms)
Prov->>Artifacts: upload source-archive (source.tar.gz)
CI->>Build: needs satisfied (includes source-provenance)
Build->>Artifacts: download source-archive (continue-on-error allowed)
alt source provenance artifact present
Build->>Verify: gh attestation verify (SLSA source provenance)
alt verify succeeds
Build->>Build: generate vsa-predicate.json (jq)
Build->>Attest: actions/attest with verification_summary/v1 predicate
Attest-->>Artifacts: produce artifact attestations
else verify fails
Build-->>Build: continue without VSA attestation
end
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/build.yml:
- Around line 197-209: The predicate currently sets resourceUri to the Git
commit and claims verifiedLevels: ["SLSA_BUILD_LEVEL_3"] while the VSA subjects
are binary packages; change resourceUri to reference the actual artifact URIs
for the binary subjects (e.g., the .deb/.rpm/.pkg/.msi locations or storage URLs
listed as subjects) and remove/replace the incorrect build-level claim: do not
assert "SLSA_BUILD_LEVEL_3" since no binary build verification was
performed—instead set verifiedLevels to the appropriate source-provenance
indicator or omit the SLSA build level entirely; ensure
verificationResult/inputAttestations remain consistent with this lower assurance
level and keep verifier/timeVerified fields as-is.
- Around line 178-192: The verification fails because the build job re-generates
source.tar.gz with git archive (and the verify step id: verify-source uses gh
attestation verify) which produces non-deterministic bytes across
ubuntu/macos/windows; stop regenerating the archive on each runner and instead
fetch the exact artifact produced by the source-provenance workflow (or move the
gh attestation verify step into source-provenance.yml where the original archive
was created). Concretely: remove/avoid the git archive --format=tar.gz step and
change the verify-source step to download the canonical source.tar.gz artifact
(or relocate the verify-source gh attestation verify invocation into
source-provenance.yml) so gh attestation verify runs against the byte-identical
file that the attestation covers; also remove continue-on-error: true so
failures surface.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: ec2ef941-369c-4391-9f69-051e62d51ec9
📒 Files selected for processing (2)
.github/workflows/build.yml.github/workflows/source-provenance.yml
spoorcc
force-pushed
the
claude/add-slsa-provenance-vsa-hXTNK
branch
from
225ca98 to
f28f480
Compare
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 33-35: The build job's conditional uses always(), which bypasses
the prep-release failure gate and allows build to run with an empty
needs.prep-release.outputs.release_id; remove always() and make the if
explicitly require prep-release to not have failed (e.g. use if:
needs.prep-release.result != 'failure' && needs.source-provenance.result !=
'failure') on the build job so prep-release failures/cancels block build while
still allowing source-provenance to be skipped.
In @.github/workflows/source-provenance.yml:
- Around line 48-56: The Verify step uses a hardcoded --cert-identity that only
matches refs/heads/main, so tag-triggered runs will fail; update the gh
attestation verify invocation (the command using gh attestation verify
source.tar.gz) to replace the fixed --cert-identity with a regex-based identity
flag (--cert-identity-regex) that accepts either refs/heads/main or
refs/tags/<semver> (e.g., a regex matching
refs/heads/main|refs/tags/[0-9]+\.[0-9]+\.[0-9]+) so the certificate SAN from
tag and branch runs will both validate.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: a513a655-cd39-4719-9d5d-eb5a8db150e9
📒 Files selected for processing (4)
.github/workflows/build.yml.github/workflows/ci.yml.github/workflows/source-provenance.ymldoc/tutorials/installation.rst
spoorcc
force-pushed
the
claude/add-slsa-provenance-vsa-hXTNK
branch
from
f28f480 to
e0c71a3
Compare
Contributor
Author
|
@coderabbitai review |
Contributor
✅ Actions performedReview triggered.
|
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/source-provenance.yml:
- Line 6: The tags trigger is using a regex-like string '[0-9]+.[0-9]+.[0-9]+'
under the tags key which GitHub Actions expects glob patterns; replace that
pattern with a glob such as '*.*.*' (or 'v*.*.*' if your tags include a leading
"v") so semver tags like 1.2.3 will match, update the tags entry accordingly,
and commit the change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 34bbfa9f-a0cb-44c0-bcef-593e2117eed5
📒 Files selected for processing (4)
.github/workflows/build.yml.github/workflows/ci.yml.github/workflows/source-provenance.ymldoc/tutorials/installation.rst
New source-provenance.yml workflow runs on push to main, creates a deterministic git archive, and attests it with SLSA build provenance.
spoorcc
force-pushed
the
claude/add-slsa-provenance-vsa-hXTNK
branch
from
e0c71a3 to
6bca1b7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New source-provenance.yml workflow runs on push to main, creates a
deterministic git archive, and attests it with SLSA build provenance.
build.yml gains four steps after existing provenance attestations:
generate source archive, verify source provenance (continue-on-error),
generate SLSA VSA predicate, and attest binary artifacts with it.
VSA steps are skipped gracefully when source attestation is absent
(e.g. race on push, non-main commits).
https://claude.ai/code/session_01TGzde6LDNw9q7aK9JE5jGf
Summary by CodeRabbit
New Features
Documentation
Chores