Skip to content

Commit 4534a0b

Browse files
ramonpetgrave64ramonpetgrave64
authored
break: Revert "chore: Revert "fix: upload-artifact and download-artifact v4"" (#3499)
Reverts #3398 Following up with - slsa-framework/example-trw#3 - slsa-framework/example-package#340 - slsa-framework/slsa-verifier#719 Signed-off-by: Ramon Petgrave <[email protected]>
1 parent e8c2dcf commit 4534a0b

14 files changed

+44
-33
lines changed

‎.github/actions/secure-download-artifact/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ runs:
7878
echo "folder_path=${folder_path}" >> "${GITHUB_OUTPUT}"
7979
8080
- name: Download the artifact
81-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
81+
uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
8282
with:
8383
name: "${{ inputs.name }}"
8484
path: "${{ steps.validate-path.outputs.folder_path }}"

‎.github/actions/secure-download-folder/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ runs:
3434
uses: slsa-framework/slsa-github-generator/.github/actions/rng@main
3535

3636
- name: Download the artifact
37-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
37+
uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
3838
with:
3939
name: "${{ inputs.name }}"
4040
path: "${{ steps.rng.outputs.random }}"

‎.github/actions/secure-upload-artifact/action.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ runs:
3737
path: "${{ inputs.path }}"
3838

3939
- name: Upload the artifact
40-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
40+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
4141
with:
4242
name: "${{ inputs.name }}"
4343
path: "${{ inputs.path }}"

‎.github/workflows/builder_container-based_slsa3.yml

+6-6
Original file line numberDiff line numberDiff line change
@@ -209,7 +209,7 @@ jobs:
209209
allow-private-repository: ${{ inputs.rekor-log-public }}
210210

211211
- name: Upload builder
212-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
212+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
213213
with:
214214
name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
215215
path: "${{ env.BUILDER_BINARY }}"
@@ -462,7 +462,7 @@ jobs:
462462
# TODO(https://github.com/slsa-framework/slsa-github-generator/issues/1655): Use a
463463
# secure upload or verify this against the SLSA layout file.
464464
id: upload-artifacts
465-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
465+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
466466
with:
467467
name: ${{ steps.build.outputs.build-outputs-name }}
468468
path: /tmp/build-outputs-${{ needs.rng.outputs.value }}
@@ -535,7 +535,7 @@ jobs:
535535
- name: Upload unsigned intoto attestations file for pull request
536536
if: ${{ github.event_name == 'pull_request' }}
537537
id: upload-unsigned
538-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
538+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
539539
with:
540540
name: "${{ env.OUTPUT_FOLDER }}-${{ needs.rng.outputs.value }}"
541541
path: "attestations-${{ needs.rng.outputs.value }}"
@@ -556,7 +556,7 @@ jobs:
556556
- name: Upload the signed attestations
557557
id: upload-signed
558558
if: ${{ github.event_name != 'pull_request' }}
559-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
559+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
560560
with:
561561
name: "${{ env.OUTPUT_FOLDER }}-${{ needs.rng.outputs.value }}"
562562
path: "${{ env.OUTPUT_FOLDER }}-${{ needs.rng.outputs.value }}"
@@ -584,15 +584,15 @@ jobs:
584584
# TODO(https://github.com/slsa-framework/slsa-github-generator/issues/1655): Use the SLSA
585585
# layout files and their checksums to validate the artifacts.
586586
- name: Download artifacts
587-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
587+
uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
588588
with:
589589
name: "${{ needs.build.outputs.build-outputs-name }}"
590590
path: "${{ needs.build.outputs.build-outputs-name }}"
591591

592592
# TODO(https://github.com/slsa-framework/slsa-github-generator/issues/1655): Use the
593593
# secure-folder-download action.
594594
- name: Download provenance
595-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
595+
uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
596596
with:
597597
name: "${{ needs.provenance.outputs.provenance-name }}"
598598
path: "${{ needs.provenance.outputs.provenance-name }}"

‎.github/workflows/builder_go_slsa3.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -169,7 +169,7 @@ jobs:
169169
allow-private-repository: ${{ inputs.private-repository }}
170170

171171
- name: Upload builder
172-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
172+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
173173
with:
174174
name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
175175
path: "${{ env.BUILDER_BINARY }}"
@@ -358,7 +358,7 @@ jobs:
358358
--workingDir "$UNTRUSTED_WORKING_DIR"
359359
360360
- name: Upload the signed provenance
361-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
361+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
362362
with:
363363
name: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
364364
path: "${{ steps.sign-prov.outputs.signed-provenance-name }}"

‎.github/workflows/generator_generic_slsa3.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,7 @@ jobs:
238238
- name: Upload the signed provenance
239239
id: upload-prov
240240
continue-on-error: true
241-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
241+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
242242
with:
243243
name: "${{ steps.sign-prov.outputs.provenance-name }}"
244244
path: "${{ steps.sign-prov.outputs.provenance-name }}"

‎.github/workflows/pre-submit.actions.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ jobs:
9898
fi
9999
100100
# If index.js was different from expected, upload the expected version as an artifact
101-
- uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
101+
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
102102
if: ${{ failure() && steps.diff.conclusion == 'failure' }}
103103
with:
104104
name: dist

‎.github/workflows/pre-submit.e2e.container-based.default.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
GITHUB_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
4747
steps:
4848
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
49-
- uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b
49+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
5050
with:
5151
name: ${{ needs.build-container-based.outputs.build-outputs-name }}
5252
path: outputs
@@ -57,7 +57,7 @@ jobs:
5757
name=$(find outputs/ -type f | head -1)
5858
cp "$name" .
5959
echo "name=$(basename "$name")" >> "$GITHUB_OUTPUT"
60-
- uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b
60+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
6161
with:
6262
name: ${{ needs.build-container-based.outputs.attestations-download-name }}
6363
- env:

‎.github/workflows/pre-submit.e2e.generic.default.yml

+6-3
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ jobs:
3636
# echo "2e0390eb024a52963db7b95e84a9c2b12c004054a7bad9a97ec0c7c89d4681d2 binary-name" | base64 -w0
3737
base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
3838
compile-generator: true
39+
provenance-name: build.intoto.jsonl
3940

4041
verify:
4142
# NOTE: this name is used as the status check name and by protected
@@ -47,7 +48,7 @@ jobs:
4748
if: ${{ always() }}
4849
steps:
4950
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
50-
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
51+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
5152
with:
5253
name: ${{ needs.build.outputs.provenance-name }}
5354
- env:
@@ -66,6 +67,7 @@ jobs:
6667
base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
6768
compile-generator: true
6869
continue-on-error: true
70+
provenance-name: build-continue-no-error.intoto.jsonl
6971

7072
verify-continue-no-error:
7173
# NOTE: this name is used as the status check name and by protected
@@ -76,7 +78,7 @@ jobs:
7678
needs: [build-continue-no-error]
7779
steps:
7880
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
79-
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
81+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
8082
with:
8183
name: ${{ needs.build-continue-no-error.outputs.provenance-name }}
8284
- env:
@@ -96,6 +98,7 @@ jobs:
9698
base64-subjects: "invalid base64 subjects"
9799
compile-generator: true
98100
continue-on-error: true
101+
provenance-name: build-continue-invalid-subjects.intoto.jsonl
99102

100103
verify-continue-invalid-subjects:
101104
# NOTE: this name is used as the status check name and by protected
@@ -106,7 +109,7 @@ jobs:
106109
needs: [build, build-continue-invalid-subjects]
107110
steps:
108111
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
109-
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
112+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
110113
with:
111114
name: ${{ needs.build.outputs.provenance-name }}
112115
- env:

‎.github/workflows/pre-submit.e2e.go.config-ldflags-main-dir.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,10 @@ jobs:
6565
if: ${{ always() }}
6666
steps:
6767
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
68-
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
68+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
6969
with:
7070
name: ${{ needs.build.outputs.go-binary-name }}
71-
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
71+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
7272
with:
7373
name: ${{ needs.build.outputs.go-provenance-name }}
7474
- env:

‎.github/workflows/scorecards.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ jobs:
6363
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
6464
# format to the repository Actions tab.
6565
- name: "Upload artifact"
66-
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
66+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
6767
with:
6868
name: SARIF file
6969
path: results.sarif

‎CHANGELOG.md

+5
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1010
<!-- toc -->
1111

1212
- [Unreleased](#unreleased)
13+
- [Unreleased: Breaking Change: upload-artifact and download-artifact](#unreleased-breaking-change-upload-artifact-and-download-artifact)
1314
- [Unreleased: Breaking Change: attestation-name Workflow Input and Output](#unreleased-breaking-change-attestation-name-workflow-input-and-output)
1415
- [Unreleased: DSSE Rekor Type](#unreleased-dsse-rekor-type)
1516
- [v1.10.0](#v1100)
@@ -103,6 +104,10 @@ duplication."
103104

104105
## Unreleased
105106

107+
### Unreleased: Breaking Change: upload-artifact and download-artifact
108+
109+
- Our workflows now use the new `@v4`s of `actions/upload-artifact` and `actions/download-artifact`, which are incompatiblle with the prior `@v3`. See Our docs on the [generic generator](./internal/builders/generic/README.md#compatibility-with-actionsdownload-artifact) for more information and how to upgrade.
110+
106111
### Unreleased: Breaking Change: attestation-name Workflow Input and Output
107112

108113
- `attestation-name` as a workflow input to `.github/workflows/generator_generic_slsa3.yml` is now removed. Use `provenance-name` instead.

‎SPECIFICATIONS.md

+2-2
Original file line numberDiff line numberDiff line change
@@ -193,10 +193,10 @@ jobs:
193193
runs-on: ubuntu-latest
194194
needs: build
195195
steps:
196-
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
196+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
197197
with:
198198
name: ${{ needs.build.outputs.go-binary-name }}
199-
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
199+
- uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
200200
with:
201201
name: ${{ needs.build.outputs.go-binary-name }}.intoto.jsonl
202202
- name: Release

‎internal/builders/generic/README.md

+13-10
Original file line numberDiff line numberDiff line change
@@ -193,12 +193,12 @@ jobs:
193193
if: startsWith(github.ref, 'refs/tags/')
194194
steps:
195195
- name: Download artifact1
196-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v2.1.0
196+
uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
197197
with:
198198
name: artifact1
199199
200200
- name: Download artifact2
201-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # tag=v2.1.0
201+
uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
202202
with:
203203
name: artifact2
204204
@@ -1483,7 +1483,7 @@ jobs:
14831483
# Do the build to create release_artifact_${{ runner.os }}
14841484
- run: ...
14851485
1486-
- uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
1486+
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
14871487
with:
14881488
path: release_artifact_${{ runner.os }}
14891489
name: release_artifact_${{ runner.os }}
@@ -1538,7 +1538,7 @@ jobs:
15381538
# Do the build to create release_artifact_${{ runner.os }}
15391539
- run: ...
15401540
1541-
- uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
1541+
- uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
15421542
with:
15431543
path: release_artifact_${{ runner.os }}
15441544
name: release_artifact_${{ runner.os }}
@@ -1639,9 +1639,12 @@ uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_s
16391639

16401640
### Compatibility with `actions/download-artifact`
16411641

1642-
To download provenance (e.g., if you don't use `upload-assets`) you have to
1643-
use [`actions/download-artifact@v3`](https://github.com/actions/download-artifact).
1644-
The workflow uses [`actions/upload-artifact@3`](https://github.com/actions/upload-artifact)
1645-
which is
1646-
[not compatible](https://github.com/actions/download-artifact?tab=readme-ov-file#breaking-changes)
1647-
with `actions/download-artifact@v4`.
1642+
`[email protected]` and prior use [`actions/upload-artifact@v3`](https://github.com/actions/upload-artifact) and [`actions/download-artifact@v3`](https://github.com/actions/download-artifact) which are not backwards compatible the `@v4`s used in current versions of `slsa-github-generator`.
1643+
The interface remains the same, however. If your own workflows want to download artifacts produced by our workflows, they must begin using `actions/download-artifact@v4`. For your other dependent workflows, you may find that you need to upgrade all of your uses of both of the actions to `@v4` to maintain compatibility.
1644+
1645+
See more migration guidance
1646+
1647+
- https://github.com/actions/upload-artifact/blob/main/docs/MIGRATION.md
1648+
- https://github.com/actions/download-artifact/blob/main/docs/MIGRATION.md
1649+
1650+
This is part of our effort to upgrade from the now-deprecated node16 that the `@v3`s used. `@v4s` use node20.

0 commit comments

Comments
 (0)