attest build provenance #945
Conversation
WalkthroughThe recent adjustments to the GitHub workflow configuration files primarily involve enhancing security and traceability of the builds for various Redis versions and a Valkey build. These changes include adding write permissions for Changes
Poem
Tip Early access features: disabledWe are currently testing the following features in early access:
Note:
TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (invoked as PR comments)
Additionally, you can add CodeRabbit Configration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Files selected for processing (10)
- .github/workflows/build-redis-2.8.yml (2 hunks)
- .github/workflows/build-redis-3.0.yml (2 hunks)
- .github/workflows/build-redis-3.2.yml (2 hunks)
- .github/workflows/build-redis-4.0.yml (2 hunks)
- .github/workflows/build-redis-5.0.yml (2 hunks)
- .github/workflows/build-redis-6.0.yml (2 hunks)
- .github/workflows/build-redis-6.2.yml (2 hunks)
- .github/workflows/build-redis-7.0.yml (2 hunks)
- .github/workflows/build-redis-7.2.yml (2 hunks)
- .github/workflows/build-valkey-7.2.yml (2 hunks)
Additional comments not posted (20)
.github/workflows/build-valkey-7.2.yml (2)
54-56: Review the attestation step configuration.The step configuration for
actions/attest-build-provenance@v1seems correct, but verify that thesubject-pathpattern${{ runner.temp }}/*.tar.zstdcorrectly matches the intended artifacts.
21-24: Ensure appropriate scope of permissions.Permissions for
contents,id-token, andattestationsare set towrite. Confirm that these permissions are necessary and minimal for the required operations to enhance security.Verification successful
Permissions are appropriate and necessary.
The permissions
contents: write,id-token: write, andattestations: writein the workflow file are justified based on the operations performed:
contents: writeis required for thegh release uploadcommand in theuploadstep.
id-token: writeandattestations: writeare required foractions/attest-build-provenance@v1.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the permissions set are necessary for the operations performed. # Test: Review the GitHub Actions documentation and the specific needs of the steps in the workflow. echo "Review GitHub Actions permissions documentation and workflow requirements."Length of output: 158
Script:
#!/bin/bash # Extract and display the steps in the specified GitHub Actions workflow file for analysis. # Locate the workflow file workflow_file=$(fd build-valkey-7.2.yml .github/workflows) # Display the steps in the workflow file yq e '.jobs.build.steps' "$workflow_file"Length of output: 233
Script:
#!/bin/bash # Extract and display the steps in the specified GitHub Actions workflow file for analysis. # Locate the workflow file workflow_file=$(fd build-valkey-7.2.yml .github/workflows) # Extract and display the steps section grep -A 50 'steps:' "$workflow_file" | sed '/^[[:space:]]*$/q'Length of output: 393
Script:
#!/bin/bash # Extract and display the entire workflow file for any additional steps and check the build script for required permissions. # Locate the workflow file workflow_file=$(fd build-valkey-7.2.yml .github/workflows) # Display the entire workflow file cat "$workflow_file" # Locate the build script build_script=$(fd build-valkey-with-openssl3.sh) # Display the contents of the build script cat "$build_script"Length of output: 4997
.github/workflows/build-redis-7.2.yml (2)
26-29: Confirm the necessity of broad permissions.Permissions for
contents,id-token, andattestationsare set towrite. Ensure that these permissions are strictly necessary for the tasks performed by the workflow.Verification successful
Confirm the necessity of broad permissions.
Permissions for
contents,id-token, andattestationsare set towrite. These permissions are necessary for the tasks performed by the workflow:
contents: writeis required for thegh release uploadcommand.
id-token: writeis likely needed for authentication purposes.
attestations: writeis needed for theactions/attest-build-provenanceaction.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the necessity of the permissions set in the workflow. # Test: Review the GitHub Actions permissions documentation and the specific needs of the steps in the workflow. echo "Review GitHub Actions permissions documentation and workflow requirements."Length of output: 158
Script:
#!/bin/bash # Extract and review the steps in the .github/workflows/build-redis-7.2.yml file to understand the necessity of the permissions. # Print the steps section from the workflow file awk '/steps:/,0' .github/workflows/build-redis-7.2.ymlLength of output: 1226
59-61: Check the attestation step configuration for Redis.The attestation step uses
actions/attest-build-provenance@v1with asubject-pathof${{ runner.temp }}/*.tar.zstd. Validate that this path correctly targets the artifacts produced by Redis builds.Verification successful
The attestation step configuration is correct.
The
subject-pathin the attestation step uses the pattern${{ runner.temp }}/*.tar.zstd, which correctly targets the Redis artifacts produced and stored in the temporary directory.
- The build step moves the Redis binary to
${{ runner.temp }}/redis-$REDIS_VERSION-$REDIS_OS-$REDIS_ARCH.tar.zstd, which matches thesubject-pathpattern.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify that the subject-path pattern matches the intended artifacts for Redis. # Test: Check the runner's temporary directory for the presence of `.tar.zstd` files specific to Redis. echo "List Redis-specific files in ${RUNNER_TEMP} to verify match with '*.tar.zstd'"Length of output: 142
Script:
#!/bin/bash # Description: Verify that the subject-path pattern matches the intended artifacts for Redis. # Test: List the contents of the temporary directory and check for .tar.zstd files # Assuming a standard temporary directory path for the runner TEMP_DIR=${RUNNER_TEMP:-/tmp} # List .tar.zstd files in the temp directory echo "Listing .tar.zstd files in $TEMP_DIR:" ls $TEMP_DIR/*.tar.zstd 2>/dev/nullLength of output: 113
Script:
#!/bin/bash # Description: Extract build steps from the workflow file to understand artifact storage location. # Search for steps containing artifact storage information in the build-redis-7.2.yml file workflow_file=$(fd build-redis-7.2.yml) # Print lines containing 'artifact' or 'store' grep -i -E 'artifact|store' "$workflow_file"Length of output: 109
Script:
#!/bin/bash # Description: Locate the build-redis-7.2.yml file and extract lines containing artifact storage information. # Locate the build-redis-7.2.yml file workflow_file=$(fd build-redis-7.2.yml) # Check if the file was found if [ -n "$workflow_file" ]; then # Print lines containing 'artifact' or 'store' grep -i -E 'artifact|store' "$workflow_file" else echo "build-redis-7.2.yml file not found." fiLength of output: 139
Script:
#!/bin/bash # Description: Search for all YAML files in the .github/workflows directory to locate the build-redis-7.2.yml file. # List all YAML files in the .github/workflows directory fd .yml .github/workflowsLength of output: 534
Script:
#!/bin/bash # Description: Extract lines containing artifact storage information from the build-redis-7.2.yml file. # Define the path to the workflow file workflow_file=".github/workflows/build-redis-7.2.yml" # Print lines containing 'artifact' or 'store' grep -i -E 'artifact|store' "$workflow_file"Length of output: 121
Script:
#!/bin/bash # Description: Display the entire content of the build-redis-7.2.yml file for manual inspection. # Define the path to the workflow file workflow_file=".github/workflows/build-redis-7.2.yml" # Display the content of the file cat "$workflow_file"Length of output: 1758
.github/workflows/build-redis-3.0.yml (2)
61-63: Ensure correct attestation for older Redis builds.The attestation step for Redis 3.0 uses the same configuration as newer versions. Verify that the
subject-pathis correctly configured to capture the artifacts of Redis 3.0.Verification successful
Ensure correct attestation for older Redis builds.
The attestation step for Redis 3.0 uses the same configuration as newer versions. The
subject-pathis correctly configured to capture the artifacts of Redis 3.0.
- The artifacts are named in the format
redis-$REDIS_VERSION-$REDIS_OS-$REDIS_ARCH.tar.zstdand stored in the${RUNNER_TEMP}directory.- The
subject-path${{ runner.temp }}/*.tar.zstdcorrectly matches this pattern.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Ensure the attestation step is correctly configured for older Redis versions. # Test: Check the artifacts generated for Redis 3.0 to ensure they match the `subject-path` specified. echo "List Redis 3.0-specific files in ${RUNNER_TEMP} to confirm match with '*.tar.zstd'"Length of output: 152
Script:
#!/bin/bash # Description: Inspect the build workflow for Redis 3.0 to understand artifact generation and paths used. # Locate the build workflow file for Redis 3.0 workflow_file=$(fd build-redis-3.0.yml .github/workflows) # Print the content of the build workflow file cat "$workflow_file"Length of output: 1828
28-31: Verify the appropriateness of permissions for older Redis version.Given that this workflow handles an older version of Redis, confirm that the permissions
contents: write,id-token: write, andattestations: writeare appropriate and not excessive.Verification successful
Permissions are appropriate for Redis 3.0 workflow.
The permissions
contents: write,id-token: write, andattestations: writeare necessary for the operations performed in the workflow, including checking out the repository, uploading release assets, and attesting build provenance.
actions/checkout@v4requirescontents: write.- GitHub CLI upload in the
uploadstep requirescontents: write.actions/attest-build-provenance@v1requiresid-token: writeandattestations: write.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Assess if the set permissions are appropriate for the older version of Redis. # Test: Review the specific operations performed by Redis 3.0 in the workflow and check against GitHub Actions permissions documentation. echo "Review operations for Redis 3.0 and verify permissions against GitHub documentation."Length of output: 178
Script:
#!/bin/bash # Extract the operations performed in the Redis 3.0 workflow # Display the relevant section of the workflow file echo "Operations in .github/workflows/build-redis-3.0.yml:" awk '/jobs:/,/permissions:/' .github/workflows/build-redis-3.0.ymlLength of output: 548
Script:
#!/bin/bash # Extract the detailed steps within the build job in the Redis 3.0 workflow # Display the detailed steps of the build job echo "Detailed steps in the build job of .github/workflows/build-redis-3.0.yml:" awk '/jobs:/,/permissions:/ {flag=1; next} /permissions:/ {flag=0} flag {print}' .github/workflows/build-redis-3.0.ymlLength of output: 1505
.github/workflows/build-redis-3.2.yml (2)
34-37: Assess permissions for Redis 3.2 workflow.Ensure that the permissions
contents: write,id-token: write, andattestations: writeare justified and minimal for the operations in the Redis 3.2 workflow.Verification successful
Permissions for Redis 3.2 workflow are justified.
The specified permissions (
contents: write,id-token: write, andattestations: write) are appropriate and necessary for the operations performed in the Redis 3.2 workflow.
contents: write: Required for checking out the repository and uploading build artifacts.id-token: write: Likely required by theactions/attest-build-provenancestep.attestations: write: Necessary for the attestation step.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the necessity and scope of the permissions for Redis 3.2. # Test: Review the specific needs of Redis 3.2 in the workflow against the GitHub Actions permissions documentation. echo "Assess permissions for Redis 3.2 against GitHub Actions documentation."Length of output: 150
Script:
#!/bin/bash # Extract and display the steps of the Redis 3.2 workflow to understand the necessity of the specified permissions. # Display the steps in the workflow file yq e '.jobs.build.steps' .github/workflows/build-redis-3.2.ymlLength of output: 132
Script:
#!/bin/bash # Extract and display the steps of the Redis 3.2 workflow to understand the necessity of the specified permissions. # Use sed to extract the steps section from the workflow file sed -n '/jobs:/,/steps:/p' .github/workflows/build-redis-3.2.yml | sed -n '/steps:/,$p'Length of output: 98
Script:
#!/bin/bash # Extract and display the steps of the Redis 3.2 workflow to understand the necessity of the specified permissions. # Use sed to extract the steps section from the workflow file, including the lines after 'steps:' sed -n '/steps:/,$p' .github/workflows/build-redis-3.2.ymlLength of output: 1218
67-69: Check attestation configuration for Redis 3.2.The attestation step configuration for Redis 3.2 should be verified to ensure that the
subject-pathaccurately targets the artifacts produced.Verification successful
Check attestation configuration for Redis 3.2.
The attestation step configuration for Redis 3.2 appears to be correctly set up to target the artifacts produced. The
subject-pathaccurately references the temporary directory and matches the artifact naming pattern.
- The
subject-pathis set to${{ runner.temp }}/*.tar.zstd.- The artifacts are moved and uploaded using the same temporary directory and naming convention.
Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the attestation step configuration for Redis 3.2. # Test: Check the artifacts for Redis 3.2 in the runner's temporary directory to ensure they match the specified `subject-path`. echo "Confirm attestation path for Redis 3.2 matches with '*.tar.zstd' files in ${RUNNER_TEMP}"Length of output: 164
Script:
#!/bin/bash # Description: Verify the attestation step configuration for Redis 3.2. # Test: List the artifacts in the runner's temporary directory and check if they match the specified `subject-path`. echo "Listing files in the runner's temporary directory:" ls "${RUNNER_TEMP}" echo "Checking for files matching '*.tar.zstd' in the runner's temporary directory:" find "${RUNNER_TEMP}" -name '*.tar.zstd'Length of output: 408
Script:
#!/bin/bash # Description: Verify the attestation step configuration for Redis 3.2. # Test: Ensure the temporary directory environment variable is set correctly. if [ -z "${RUNNER_TEMP}" ]; then echo "RUNNER_TEMP environment variable is not set." exit 1 fi # List the artifacts in the runner's temporary directory and check if they match the specified `subject-path`. echo "Listing files in the runner's temporary directory:" ls "${RUNNER_TEMP}" echo "Checking for files matching '*.tar.zstd' in the runner's temporary directory:" find "${RUNNER_TEMP}" -name '*.tar.zstd'Length of output: 123
Script:
#!/bin/bash # Description: Search the workflow file for references to the temporary directory. # Locate the workflow file workflow_file=$(fd build-redis-3.2.yml) # Check if the workflow file exists if [ -z "$workflow_file" ]; then echo "Workflow file not found." exit 1 fi # Search for references to the temporary directory in the workflow file echo "Searching for references to the temporary directory in the workflow file:" grep -E 'RUNNER_TEMP|temp' "$workflow_file"Length of output: 126
Script:
#!/bin/bash # Description: List all YAML files in the .github/workflows directory to locate the correct workflow file. # List all YAML files in the .github/workflows directory echo "Listing all YAML files in the .github/workflows directory:" fd .yml .github/workflows # Check if the build-redis-3.2.yml file exists if fd build-redis-3.2.yml .github/workflows; then echo "build-redis-3.2.yml file found." else echo "build-redis-3.2.yml file not found." exit 1 fiLength of output: 815
Script:
#!/bin/bash # Description: Search the build-redis-3.2.yml workflow file for references to the temporary directory and artifact paths. # Search for references to the temporary directory and artifact paths in the build-redis-3.2.yml file echo "Searching for references to the temporary directory and artifact paths in the build-redis-3.2.yml file:" grep -E 'RUNNER_TEMP|temp|artifact|subject-path' .github/workflows/build-redis-3.2.ymlLength of output: 597
.github/workflows/build-redis-4.0.yml (2)
35-38: Permissions set for attesting build provenance are appropriate.The permissions
contents: write,id-token: write, andattestations: writeare essential for the new functionality to attest build provenance. This setup aligns with the security practices necessary for handling build artifacts and credentials.
68-70: New step to attest build provenance added correctly.The use of
actions/attest-build-provenance@v1with the specifiedsubject-pathis correctly implemented. It ensures that the build artifacts are properly attested, which enhances the security and traceability of the build process..github/workflows/build-redis-5.0.yml (2)
35-38: Permissions set correctly for build provenance.The permissions necessary for the attestation of build artifacts are correctly configured. This consistency across workflow files maintains a standard security level for all build processes.
68-70: Attest build provenance step correctly implemented.The addition of the
actions/attest-build-provenance@v1step is consistent with the other workflow files, ensuring that all builds have verifiable provenance..github/workflows/build-redis-6.2.yml (2)
35-38: Permissions for attesting build provenance are correctly set.The permissions
contents: write,id-token: write, andattestations: writeare essential for the new functionality to attest build provenance. This setup aligns with the security practices necessary for handling build artifacts and credentials.
68-70: Consistent implementation of the attest build provenance step.The use of
actions/attest-build-provenance@v1with the specifiedsubject-pathis correctly implemented across different workflow files. This consistency is key to ensuring the security and traceability of the build process..github/workflows/build-redis-7.0.yml (2)
36-39: Permissions set correctly for build provenance.The permissions necessary for the attestation of build artifacts are correctly configured. This consistency across workflow files maintains a standard security level for all build processes.
69-71: Attest build provenance step implemented correctly.The addition of the
actions/attest-build-provenance@v1step is consistent with the other workflow files, ensuring that all builds have verifiable provenance..github/workflows/build-redis-6.0.yml (2)
41-44: Permissions Set Appropriately for Build ProvenanceThe permissions
contents: write,id-token: write, andattestations: writeare essential for the new build provenance step. This setup ensures the workflow has the necessary access to perform its tasks.
74-76: Ensure Correct Path Specification for Build ArtifactsThe
subject-pathspecified uses a wildcard pattern to select artifacts. Confirm that all relevant build artifacts are named appropriately and stored at${{ runner.temp }}to match this pattern effectively.Would you like assistance in setting up a test step to verify this before deployment?
Verification successful
Verification Successful: Correct Path Specification for Build Artifacts
The
subject-pathspecified in the workflow correctly uses a wildcard pattern to select artifacts. The build artifacts are named appropriately and stored in${{ runner.temp }}to match this pattern effectively.
- The
mvcommand ensures that the artifacts are placed in the${{ runner.temp }}directory with names matching the pattern*.tar.zstd.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the naming and location of build artifacts # Test: List files in the temporary directory. Expect: Files matching the '*.tar.zstd' pattern. ls -l ${{ runner.temp }}/*.tar.zstdLength of output: 95
Script:
#!/bin/bash # Search for the usage of `${{ runner.temp }}` within the GitHub Actions workflow files to gather more context. rg --fixed-strings '${{ runner.temp }}' .github/workflowsLength of output: 980
Script:
#!/bin/bash # Extract lines from the workflow files that lead up to the `subject-path` usage to gather more context. rg -C 10 --fixed-strings 'subject-path: ${{ runner.temp }}/*.tar.zstd' .github/workflowsLength of output: 9499
.github/workflows/build-redis-2.8.yml (2)
45-48: Permissions Set Appropriately for Build ProvenanceThe permissions
contents: write,id-token: write, andattestations: writeare set correctly to support the build provenance attestation process.
78-80: Check Artifact Path ConfigurationThe
subject-pathis set to${{ runner.temp }}/*.tar.zstd. Ensure that all artifacts follow this naming convention and are stored in the specified directory.Would you like help in adding a pre-deployment verification step to ensure all artifacts meet the required criteria?
Verification successful
Artifact Path Configuration Verified
The
subject-pathis correctly set to${{ runner.temp }}/*.tar.zstdand matches the artifact creation commands found in the repository.
build-redis-with-openssl3.shbuild-redis-with-openssl1.1.shbuild-redis.shThese scripts create
.tar.zstdfiles in the$RUNNER_TEMPdirectory, confirming the correct configuration.Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash # Description: Verify the naming and storage location of artifacts # Test: List files in the specified temporary directory. Expect: Files matching the '*.tar.zstd' pattern. ls -l ${{ runner.temp }}/*.tar.zstdLength of output: 95
Script:
#!/bin/bash # Search for artifact creation patterns in the repository rg --glob '**/*.yml' 'tar.*\.zstd'Length of output: 36
Script:
#!/bin/bash # Search for tar commands in the repository rg 'tar' --glob '**/*.yml'Length of output: 112
Script:
#!/bin/bash # Search for actions/upload-artifact steps in the repository rg 'actions/upload-artifact' --glob '**/*.yml'Length of output: 46
Script:
#!/bin/bash # Search for tar commands across all files in the repository rg 'tar'Length of output: 16239
Summary by CodeRabbit
contents,id-token, andattestations.actions/attest-build-provenance@v1.