-
Notifications
You must be signed in to change notification settings - Fork 2
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
use upload-artifact@v4 #3
use upload-artifact@v4 #3
Conversation
Signed-off-by: Ramon Petgrave <ramon.petgrave64@gmail.com>
@@ -68,7 +68,7 @@ runs: | |||
# builders are run concurrently. This is simplified | |||
# for our e2e tests. | |||
- name: Upload the artifact | |||
uses: actions/upload-artifact@v3 | |||
uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Might we want to pin these to a version as well? example-package is in many ways more problematic security-wise than slsa-github-generator repo since example-package has access to highly privileged PAT tokens.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this repo only contains example. Either we pin it and we'll never update, or we keep a floating version. I'm fine pinning so long as dependabot is not enabled :)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
SG
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks. I'll wait for a decision on @ianlewis 's comment to merge.
Ping me on the thread when it's ready to merge
@ianlewis please take another look |
@@ -68,7 +68,7 @@ runs: | |||
# builders are run concurrently. This is simplified | |||
# for our e2e tests. | |||
- name: Upload the artifact | |||
uses: actions/upload-artifact@v3 | |||
uses: actions/upload-artifact@v4 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
SG
…act v4"" (#3499) Reverts #3398 Following up with - slsa-framework/example-trw#3 - slsa-framework/example-package#340 - slsa-framework/slsa-verifier#719 Signed-off-by: Ramon Petgrave <32398091+ramonpetgrave64@users.noreply.github.com>
followup to slsa-framework/example-package#336
fixes e2e test
will followup in slsa-framework/example-package#340