actions / attest Goto Github PK

Thank you for your work on this.

It is not clear how to use the input to define a tagged release.

For example, assume my github action fires on commit of a new tag to create a new release with assets named inline with the tag number e.g. foo_$tagNumber_darwin_amd64.tar.gz.

Its not quite clear, at least to me, how to integrate attest with this sort of dynamic naming.

This would make it slightly easier for projects to comply with OSSF's Scorecard: https://github.com/ossf/scorecard/blob/7ce8609469289d5f3b1bf5ee3122f42b4e3054fb/docs/checks.md#signed-releases.

The alternative at the moment is for users to override the asset name the file is uploaded with to the release.

I can start a PR if y'all like the idea. If we make it configurable, we'd probably want to follow up with a corresponding PR in actions/attest-build-provenance.

In one of my pipelines the attestation fails with the output:

 Error: Failed to persist attestation: Server Error - https://docs.github.com/rest/repos/repos#create-an-attestation

The link leads to a documentation page that seems to relate to completely different information.

When the attestation process fails, it would be helpful to get better guidance.