Repository navigation
verify-action-build: recognize multi-org ampel verification - #1483
Merged
Merged
Conversation
carabiner-dev/actions install/download-and-verify v1.3.1 verifies SLSA provenance per organization (policylabs, then carabiner-dev) by running the ampel binary from its ampel-bootstrap step instead of calling ampel/verify, so the download was reported unverified (#1480). Count that shape as verification when the bootstrap step, its ampel-path output and a `verify --subject` run block are all present. Generated-by: Claude Opus 5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
install/download-and-verifyv1.3.1 downloads the tool from the first org that has the release (policylabs, thencarabiner-dev) and then verifies its SLSA provenance against each org in turn, with the build point and signer pinned per org. Verification runs the ampel binary from theampel-bootstrapstep, through an args array, instead of callingampel/verify, soverifyflagged the download as unverified (action-allowlist-review: bump carabiner-dev/actions/install/download-and-verify from 1.3.0 to 1.3.1 in /.github/actions/for-dependabot-triggered-reviews #1480).uses:ofinstall/ampel-bootstrap, a reference to itsampel-pathoutput, and a run block that builds averify --subjectcall.Test plan
action.yml: passes with the fix, fails without it.uv run pytest utils/tests/(396 passed) andprek run --all-filesclean.🤖 Generated with Claude Code