bot/src/attest.ts
openaliro/openaliro
Module

attest.ts

@file Look up a GitHub build-provenance attestation by subject digest.

bot/src/attest.ts1 documented symbols

Overview

@file Look up a GitHub build-provenance attestation by subject digest. release.yml runs actions/attest-build-provenance on every published asset (.github/workflows/release.yml, scripts/security-attest.sh), which binds an artifact's sha256 to the workflow, repository and commit that built it. This is the read half: "does this digest have one", answered from GitHub's own public attestations API rather than trusted from a SHA256SUMS file served next to the thing it describes. Read-only and needs no write scope. A token, if bound, only raises the unauthenticated rate limit; the lookup works without one for a public repo.

used by verify.ts

flowchart TD
  lookupAttestation --> normaliseDigest

API

Fexport function normaliseDigest(raw: string): string | null

bot/src/attest.ts:33

Accepts a bare 64-hex digest or one prefixed sha256:. Case-insensitive, normalised to lowercase, prefix added back for the API call.

called by lookupAttestation
Undocumented (2)

predicateTypeOf, lookupAttestation