chore(deps): update slsa-framework/slsa-github-generator action to v1.10.0 #290

Fixed: Publishing for non-scoped packages was fixed (See
#2359)
Fixed: Documentation was updated to clarify that the GitHub Actions
deployment event is not supported.
Changed: The file extension for the generated provenance file was changed
from .sigstore to .build.slsa in order to make it easier to identify
provenance files regardless of file format.
Fixed: The publish action was fixed to address an issue with the package
name when using Node 16.

`v1.7.0`

Compare Source

This release includes the first beta release of the
Container-based builder.
The Container-based builder provides a GitHub Actions reusable workflow that can
be used to invoke a container image with a user-specified command to generate an
artifact and SLSA Build L3 compliant provenance.

v1.7.0: Go builder

Added: A new
go-version-file
input was added. This allows you to specify a go.mod file in order to track
which version of Go is used for your project.

`v1.6.0`

Compare Source

This release includes the first beta release of the
Node.js builder.
The Node.js builder provides a GitHub Actions reusable workflow that can be
called to build a Node.js package, generate SLSA Build L3 compliant provenance,
and publish it to the npm registry along with the package.

Summary of changes

Go builder

New Features

A new
prerelease
input was added to allow users to create releases marked as prerelease when
upload-assets is set to true.
A new input draft-release was added to allow users to create releases marked
as draft when upload-assets is set to true.
A new output go-provenance-name added which can be used to retrieve the name
of the provenance file generated by the builder.

Generic generator

New Features

A new input draft-release was added to allow users to create releases marked
as draft when upload-assets is set to true.

Container generator

The Container Generator was updated to use cosign v2.0.0. No changes to the
workflow's inputs or outputs were made.

Changelog since v1.5.0

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

viezly · 2023-05-12T01:38:22Z

Pull request by bot. No need to analyze

paul-the-alien

Greetings! Thanks for opening a PR

senior-dev-bot · 2023-05-12T01:38:25Z

Hi there! 👋 Thanks for opening a PR. 🎉
To get the most out of Senior Dev, please uninstall the app from your organization, then re-install it into your organization. You can uninstall the app here 🚀

performance-testing-bot · 2023-05-12T01:38:26Z

Unable to verify url with installation ID

guide-bot · 2023-05-12T01:38:26Z

Thanks for opening this Pull Request!
We need you to:

Fill out the description.

Action: Edit description and replace <!- ... --> with actual values.
Complete the activities.

Action: Complete If you want to rebase/retry this PR, check this box

If an activity is not applicable, use '~activity description~' to mark it not applicable.

difflens · 2023-05-12T01:38:27Z

View changes in DiffLens

difflens · 2023-06-09T16:16:04Z

View changes in DiffLens

difflens · 2023-06-09T16:16:07Z

View changes in DiffLens

difflens · 2023-06-09T16:16:08Z

View changes in DiffLens

sonarcloud · 2023-06-09T16:16:53Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

difflens · 2023-06-19T14:06:24Z

View changes in DiffLens

difflens · 2023-07-16T15:44:24Z

View changes in DiffLens

difflens · 2023-08-04T06:02:06Z

View changes in DiffLens

difflens · 2023-08-04T06:02:06Z

View changes in DiffLens

difflens · 2023-08-04T06:02:07Z

View changes in DiffLens

senior-dev-bot · 2023-08-04T06:02:07Z

Hi there! 👋 Thanks for opening a PR. 🎉
To get the most out of Senior Dev, please uninstall the app from your organization, then re-install it into your organization. You can uninstall the app here 🚀

difflens · 2023-08-25T21:11:23Z

View changes in DiffLens

difflens · 2023-08-25T21:11:23Z

View changes in DiffLens

pull-request-quantifier-deprecated · 2023-08-25T21:11:26Z

This PR has 2 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Extra Small
Size       : +1 -1
Percentile : 0.8%

Total files changed: 1

Change summary by file extension:
.yml : +1 -1

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

difflens · 2023-08-25T21:11:26Z

View changes in DiffLens

sonarcloud · 2023-08-25T21:12:07Z

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information

difflens · 2023-11-13T10:28:23Z

View changes in DiffLens

aviator-app · 2023-12-03T10:33:41Z

Current Aviator status

Aviator will automatically update this comment as the status of the PR changes.
Comment /aviator refresh to force Aviator to re-examine your PR (or learn about other /aviator commands).

This pull request is currently open (not queued).

How to merge

To merge this PR, comment /aviator merge or add the mergequeue label.

See the real-time status of this PR on the Aviator webapp.

Use the Aviator Chrome Extension to see the status of your PR within GitHub.

difflens · 2023-12-03T10:33:43Z

View changes in DiffLens

pull-request-quantifier-deprecated · 2024-03-21T01:30:06Z

This PR has 2 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Extra Small
Size       : +1 -1
Percentile : 0.8%

Total files changed: 1

Change summary by file extension:
.yml : +1 -1

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

coderabbitai · 2024-03-21T01:30:06Z

Important

Auto Review Skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>.
- Generate unit-tests for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit tests for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai generate interesting stats about this repository and render them as a table.
- @coderabbitai show all the console.log statements in this repository.
- @coderabbitai read src/utils.ts and generate unit tests.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger a review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
The JSON schema for the configuration file is available here.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/coderabbit-overrides.v2.json

CodeRabbit Discord Community

Join our Discord Community to get help, request features, and share feedback.

difflens · 2024-03-21T01:30:08Z

View changes in DiffLens

difflens · 2024-03-21T01:30:09Z

View changes in DiffLens

pull-request-quantifier-deprecated · 2024-03-21T08:11:36Z

This PR has 2 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Extra Small
Size       : +1 -1
Percentile : 0.8%

Total files changed: 1

Change summary by file extension:
.yml : +1 -1

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

difflens · 2024-03-21T08:11:38Z

View changes in DiffLens

difflens · 2024-03-21T08:11:39Z

View changes in DiffLens

….10.0

pull-request-quantifier-deprecated · 2024-03-21T13:40:40Z

This PR has 2 quantified lines of changes. In general, a change size of upto 200 lines is ideal for the best PR experience!

Quantification details

Label      : Extra Small
Size       : +1 -1
Percentile : 0.8%

Total files changed: 1

Change summary by file extension:
.yml : +1 -1

Change counts above are quantified counts, based on the PullRequestQuantifier customizations.

Why proper sizing of changes matters

Optimal pull request sizes drive a better predictable PR flow as they strike a
balance between between PR complexity and PR review overhead. PRs within the
optimal size (typical small, or medium sized PRs) mean:

Fast and predictable releases to production:
- Optimal size changes are more likely to be reviewed faster with fewer
  iterations.
- Similarity in low PR complexity drives similar review times.
Review quality is likely higher as complexity is lower:
- Bugs are more likely to be detected.
- Code inconsistencies are more likely to be detected.
Knowledge sharing is improved within the participants:
- Small portions can be assimilated better.
Better engineering practices are exercised:
- Solving big problems by dividing them in well contained, smaller problems.
- Exercising separation of concerns within the code changes.

What can I do to optimize my changes

Use the PullRequestQuantifier to quantify your PR accurately
- Create a context profile for your repo using the context generator
- Exclude files that are not necessary to be reviewed or do not increase the review complexity. Example: Autogenerated code, docs, project IDE setting files, binaries, etc. Check out the Excluded section from your prquantifier.yaml context profile.
- Understand your typical change complexity, drive towards the desired complexity by adjusting the label mapping in your prquantifier.yaml context profile.
- Only use the labels that matter to you, see context specification to customize your prquantifier.yaml context profile.
Change your engineering behaviors
- For PRs that fall outside of the desired spectrum, review the details and check if:
  - Your PR could be split in smaller, self-contained PRs instead
  - Your PR only solves one particular issue. (For example, don't refactor and code new features in the same PR).

How to interpret the change counts in git diff output

One line was added: +1 -0
One line was deleted: +0 -1
One line was modified: +1 -1 (git diff doesn't know about modified, it will
interpret that line like one addition plus one deletion)
Change percentiles: Change characteristics (addition, deletion, modification)
of this PR in relation to all other PRs within the repository.

Was this comment helpful? 👍 :ok_hand: :thumbsdown: (Email)
Customize PullRequestQuantifier for this repository.

difflens · 2024-03-21T13:40:42Z

View changes in DiffLens

difflens · 2024-03-21T13:40:42Z

View changes in DiffLens

sonarcloud · 2024-03-21T13:41:27Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

difflens · 2024-07-22T19:45:46Z

View changes in DiffLens

difflens · 2024-08-28T14:39:56Z

View changes in DiffLens

difflens · 2024-10-20T13:09:02Z

View changes in DiffLens

pull-request-size bot added the size/XS label May 12, 2023

paul-the-alien bot reviewed May 12, 2023

View reviewed changes

pull-request-quantifier-deprecated bot added the Extra Small label May 12, 2023

paul-the-alien bot added the stale label May 28, 2023

renovate bot changed the title ~~chore(deps): update slsa-framework/slsa-github-generator action to v1.6.0~~ chore(deps): update slsa-framework/slsa-github-generator action to v1.7.0 Jun 9, 2023

renovate bot force-pushed the renovate/slsa-framework-slsa-github-generator-1.x branch from 594568c to 1ac34b9 Compare June 9, 2023 16:15

renovate bot changed the title ~~chore(deps): update slsa-framework/slsa-github-generator action to v1.7.0~~ chore(deps): update slsa-framework/slsa-github-generator action to v1.8.0 Aug 4, 2023

renovate bot force-pushed the renovate/slsa-framework-slsa-github-generator-1.x branch from 1ac34b9 to 3ffee09 Compare August 4, 2023 06:01

renovate bot changed the title ~~chore(deps): update slsa-framework/slsa-github-generator action to v1.8.0~~ chore(deps): update slsa-framework/slsa-github-generator action to v1.9.0 Aug 25, 2023

renovate bot force-pushed the renovate/slsa-framework-slsa-github-generator-1.x branch from 3ffee09 to ac66051 Compare August 25, 2023 21:11

renovate bot changed the title ~~chore(deps): update slsa-framework/slsa-github-generator action to v1.9.0~~ chore(deps): update slsa-framework/slsa-github-generator action to v1.9.1 Mar 21, 2024

renovate bot force-pushed the renovate/slsa-framework-slsa-github-generator-1.x branch from ac66051 to 7978dab Compare March 21, 2024 01:30

renovate bot changed the title ~~chore(deps): update slsa-framework/slsa-github-generator action to v1.9.1~~ chore(deps): update slsa-framework/slsa-github-generator action to v1.9.0 Mar 21, 2024

renovate bot force-pushed the renovate/slsa-framework-slsa-github-generator-1.x branch from 7978dab to 406249d Compare March 21, 2024 08:11

chore(deps): update slsa-framework/slsa-github-generator action to v1…

f05019d

….10.0

renovate bot changed the title ~~chore(deps): update slsa-framework/slsa-github-generator action to v1.9.0~~ chore(deps): update slsa-framework/slsa-github-generator action to v1.10.0 Mar 21, 2024

renovate bot force-pushed the renovate/slsa-framework-slsa-github-generator-1.x branch from 406249d to f05019d Compare March 21, 2024 13:40

chore(deps): update slsa-framework/slsa-github-generator action to v1.10.0 #290

Are you sure you want to change the base?

chore(deps): update slsa-framework/slsa-github-generator action to v1.10.0 #290

Conversation

renovate bot commented May 12, 2023 • edited Loading

Release Notes

v1.10.0

v1.10.0: TUF fix

v1.10.0: Gradle Builder

v1.10.0: Go Builder

v1.10.0: Container Generator

v1.9.1

v1.9.0

v1.9.0: BYOB framework (beta)

v1.9.0: Maven builder (beta)

v1.9.0: Gradle builder (beta)

v1.9.0: JReleaser builder

v1.8.0

v1.8.0: Generic Generator

v1.8.0: Node.js Builder (beta)

v1.7.0

v1.7.0: Go builder

v1.6.0

Summary of changes

Go builder

New Features

Generic generator

New Features

Container generator

Changelog since v1.5.0

Configuration

viezly bot commented May 12, 2023

paul-the-alien bot left a comment

Choose a reason for hiding this comment

senior-dev-bot bot commented May 12, 2023

performance-testing-bot bot commented May 12, 2023

guide-bot bot commented May 12, 2023

difflens bot commented May 12, 2023

difflens bot commented Jun 9, 2023

difflens bot commented Jun 9, 2023

difflens bot commented Jun 9, 2023

sonarcloud bot commented Jun 9, 2023

difflens bot commented Jun 19, 2023

difflens bot commented Jul 16, 2023

difflens bot commented Aug 4, 2023

difflens bot commented Aug 4, 2023

difflens bot commented Aug 4, 2023

senior-dev-bot bot commented Aug 4, 2023

difflens bot commented Aug 25, 2023

difflens bot commented Aug 25, 2023

pull-request-quantifier-deprecated bot commented Aug 25, 2023

What can I do to optimize my changes

How to interpret the change counts in git diff output

difflens bot commented Aug 25, 2023

sonarcloud bot commented Aug 25, 2023

difflens bot commented Nov 13, 2023

aviator-app bot commented Dec 3, 2023 • edited Loading

Current Aviator status

How to merge

difflens bot commented Dec 3, 2023

pull-request-quantifier-deprecated bot commented Mar 21, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

coderabbitai bot commented Mar 21, 2024

Auto Review Skipped

Chat

CodeRabbit Commands (invoked as PR comments)

CodeRabbit Configration File (.coderabbit.yaml)

CodeRabbit Discord Community

difflens bot commented Mar 21, 2024

difflens bot commented Mar 21, 2024

pull-request-quantifier-deprecated bot commented Mar 21, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

difflens bot commented Mar 21, 2024

difflens bot commented Mar 21, 2024

pull-request-quantifier-deprecated bot commented Mar 21, 2024

What can I do to optimize my changes

How to interpret the change counts in git diff output

difflens bot commented Mar 21, 2024

renovate bot commented May 12, 2023 •

edited

Loading

`v1.10.0`

`v1.9.1`

`v1.9.0`

`v1.8.0`

`v1.7.0`

`v1.6.0`

aviator-app bot commented Dec 3, 2023 •

edited

Loading

CodeRabbit Configration File (`.coderabbit.yaml`)