Fix Aspire skills attestation build type - #17521
Merged
David Pine (IEvangelist) merged 1 commit intoMay 27, 2026
Merged
Conversation
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
David Pine (IEvangelist)
requested review from
James Newton-King (JamesNK),
David Fowler (davidfowl) and
Mitch Denny (mitchdenny)
as code owners
May 27, 2026 03:31
Contributor
|
🚀 Dogfood this PR with:
curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 17521Or
iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 17521" |
David Fowler (davidfowl)
approved these changes
May 27, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Aspire CLI’s Aspire-skills attestation verification to accept GitHub’s current actions/attest-build-provenance@v3 build type URI (https://actions.github.io/buildtypes/workflow/v1) so aspire agent init --skills ... can install the released microsoft/aspire-skills v0.0.1 bundle while keeping the existing repo/workflow/ref constraints and strengthening test coverage around those checks.
Changes:
- Update
AspireSkillsInstallerexpected provenancebuildTypeto GitHub’s current workflow build type URI. - Extend provenance verifier tests to cover the new build type and confirm mismatched repo/workflow/ref are still rejected.
- Add assertions in the skills installer tests to ensure the attestation verifier is called with the expected inputs.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| tests/Aspire.Cli.Tests/Agents/SigstoreNpmProvenanceCheckerTests.cs | Adds coverage for verifying the GitHub workflow build type URI and rejection cases. |
| tests/Aspire.Cli.Tests/Agents/AspireSkillsInstallerTests.cs | Verifies installer passes expected repo/workflow/buildType/ref/version into the attestation verifier. |
| src/Aspire.Cli/Agents/AspireSkills/AspireSkillsInstaller.cs | Updates the expected provenance build type URI used for GitHub release asset verification. |
David Pine (IEvangelist)
enabled auto-merge (squash)
May 27, 2026 03:39
Contributor
|
Re-running the failed jobs in the CI workflow for this pull request because 1 job was identified as retry-safe transient failures in the CI run attempt.
|
Contributor
|
❓ CLI E2E Tests unknown — 107 passed, 0 failed, 2 unknown (commit View all recordings
📹 Recordings uploaded automatically from CI run #26489060404 |
Contributor
|
✅ No documentation update needed. docs_required → already documented by name Triggered signals (2): Both signals point to the
This PR is a bug fix: it updates the expected SLSA provenance |
Collaborator
|
/backport to release/13.4 |
Contributor
|
Started backporting to |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
aspire agent init --skills aspire,aspireify,aspire-deploymentfailed to install the releasedmicrosoft/aspire-skillsv0.0.1 bundle because the Aspire skills release-asset provenance verifier expected the stale SLSA GitHub Actions build type URL. GitHub release asset attestations produced byactions/attest-build-provenance@v3now reporthttps://actions.github.io/buildtypes/workflow/v1.This updates the Aspire skills installer to require the actual GitHub release-asset build type while preserving the existing source repository, workflow path, and tag ref validation. The generic provenance verifier tests now cover the GitHub release-asset build type and verify mismatched repo/workflow/ref values are still rejected.
User-facing usage
Users can initialize the externally bundled Aspire skills from the signed GitHub release asset:
Security considerations
This changes the expected provenance
buildTypefor Aspire skills GitHub release assets to GitHub's current workflow build type. It does not disable attestation verification or broaden source repository, workflow path, or tag ref checks.Validation:
Fixes # (issue)
Checklist
<remarks />and<code />elements on your triple slash comments?