Skip to content

Generate GitHub Artifact Attestations#174

Merged
SamMorrowDrums merged 2 commits intogithub:mainfrom
suzuki-shunsuke:github-artifact-attestations
Apr 8, 2025
Merged

Generate GitHub Artifact Attestations#174
SamMorrowDrums merged 2 commits intogithub:mainfrom
suzuki-shunsuke:github-artifact-attestations

Conversation

@suzuki-shunsuke
Copy link
Copy Markdown
Contributor

@suzuki-shunsuke suzuki-shunsuke commented Apr 8, 2025 •
edited
Loading

Closes: #173

Test

I pushed a tag v0.1.2-0 to the fork repository https://github.com/suzuki-shunsuke/github-mcp-server and confirmed attestations were generated.

https://github.com/suzuki-shunsuke/github-mcp-server/actions/runs/14326892487/job/40153957850
https://github.com/suzuki-shunsuke/github-mcp-server/attestations/6157885

gh release download -R suzuki-shunsuke/github-mcp-server v0.1.2-0
while read -r asset; do
  echo "$asset"
  gh attestation verify "$asset" \
    -R suzuki-shunsuke/github-mcp-server \
    --signer-workflow suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
done < <(ls)
Result 
github-mcp-server_0.1.2-0_checksums.txt
Loaded digest sha256:6aa7d0c3c21532ed26b2685bc2cbe4275390b949e2b0402e259ccca9bbc32165 for file://github-mcp-server_0.1.2-0_checksums.txt
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Darwin_arm64.tar.gz
Loaded digest sha256:5e1ddf9643eef2a665e0941d1158e9c20866cce60ea9de72f7434e1a030e0f99 for file://github-mcp-server_Darwin_arm64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Darwin_x86_64.tar.gz
Loaded digest sha256:0b0966754489a66c42b307fcc6aa2b66a6f75be2ea5f7d0375a3b52f555f7ad1 for file://github-mcp-server_Darwin_x86_64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Linux_arm64.tar.gz
Loaded digest sha256:9041a5241f5fc50917a135896e3938407523ac77581ac5cf737c82ebf1918de2 for file://github-mcp-server_Linux_arm64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Linux_i386.tar.gz
Loaded digest sha256:1e403adddc50d5dfa4de8f5a8cb6fc233609fd5117dffe02e5556f90db35f080 for file://github-mcp-server_Linux_i386.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Linux_x86_64.tar.gz
Loaded digest sha256:5a61ef459e5898673ca60a63e4fdb314069f4d6bf5a84ffcd5df6327cfc08138 for file://github-mcp-server_Linux_x86_64.tar.gz
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Windows_arm64.zip
Loaded digest sha256:e417ac4d61363dff027dfa33dbda35064e4ac4b55f42aa1ce30a14c665463226 for file://github-mcp-server_Windows_arm64.zip
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Windows_i386.zip
Loaded digest sha256:5909afabcfc4a09070ac358cc0e702cc212142ff8058770bb617c45ea5cce7d5 for file://github-mcp-server_Windows_i386.zip
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

github-mcp-server_Windows_x86_64.zip
Loaded digest sha256:127dc1d04cbdae292dc6540963d3e0fa4e4468c8f37b66436c5dd853f07420ea for file://github-mcp-server_Windows_x86_64.zip
Loaded 1 attestation from GitHub API

The following policy criteria will be enforced:
- Predicate type must match:................ https://slsa.dev/provenance/v1
- Source Repository Owner URI must match:... https://github.com/suzuki-shunsuke
- Source Repository URI must match:......... https://github.com/suzuki-shunsuke/github-mcp-server
- Subject Alternative Name must match regex: ^https://github.com/suzuki-shunsuke/github-mcp-server/.github/workflows/goreleaser.yml
- OIDC Issuer must match:................... https://token.actions.githubusercontent.com

✓ Verification succeeded!

The following 1 attestation matched the policy criteria

- Attestation #1
  - Build repo:..... suzuki-shunsuke/github-mcp-server
  - Build workflow:. .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0
  - Signer repo:.... suzuki-shunsuke/github-mcp-server
  - Signer workflow: .github/workflows/goreleaser.yml@refs/tags/v0.1.2-0

Note

Copilot AI review requested due to automatic review settings April 8, 2025 06:35
Copilot AI reviewed Apr 8, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

suzuki-shunsuke
suzuki-shunsuke commented Apr 8, 2025
View reviewed changes
Comment thread .github/workflows/goreleaser.yml
Comment on lines +8 to +9
id-token: write
attestations: write
Copy link
Copy Markdown
Contributor Author

@suzuki-shunsuke suzuki-shunsuke Apr 8, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These permissions are required.
https://github.com/actions/attest-build-provenance?tab=readme-ov-file#usage

@suzuki-shunsuke suzuki-shunsuke mentioned this pull request Apr 8, 2025
Closed
@SamMorrowDrums SamMorrowDrums merged commit 923e1b0 into github:main Apr 8, 2025
9 checks passed
@github-project-automation github-project-automation Bot moved this to Done in main Apr 8, 2025
@SamMorrowDrums
Copy link
Copy Markdown
Collaborator

SamMorrowDrums commented Apr 8, 2025

Thanks very much.

@suzuki-shunsuke suzuki-shunsuke deleted the github-artifact-attestations branch April 8, 2025 08:16
DaleSeo pushed a commit to DaleSeo/github-mcp-server that referenced this pull request Oct 24, 2025
@cmrigney
Add markitdown mcp server. (github#174)
cec8520
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@SamMorrowDrums SamMorrowDrums SamMorrowDrums approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Generate GitHub Artifact Attestations

3 participants

@suzuki-shunsuke @SamMorrowDrums