feat(action): attestation/create - Create attestation with PR map update
@aRustyDev is already working on this.
Since Jan 27, 2026.
Assessment
This issue has not been assessed yet.
Description
Parent Epic
Part of #22 (Atomic Release Pipeline Actions)
Priority
P0 - Core attestation functionality needed by all workflows
Description
Create a composite action that wraps actions/attest-build-provenance with a consistent interface matching our other attestation actions.
This provides a unified API for generating attestations and automatically updates the PR attestation map.
Inputs
| Input | Required | Default | Description |
|---|---|---|---|
subject-name |
Yes | - | Name for the attestation subject |
subject-digest |
Yes | - | SHA256 digest of the subject |
pr-number |
No | - | PR number to update attestation map |
check-name |
No | - | Check name for attestation map entry |
push-to-registry |
No | false |
Push attestation to GHCR |
token |
No | github.token |
GitHub token |
Outputs
| Output | Description |
|---|---|
attestation-id |
The generated attestation ID |
bundle-path |
Path to the attestation bundle |
Usage Example
- uses: arustydev/gha/actions/attestation/create@v1
id: attest
with:
subject-name: "my-chart-v1.2.3"
subject-digest: ${{ steps.digest.outputs.digest }}
pr-number: ${{ github.event.pull_request.number }}
check-name: "lint-test"
Implementation Notes
- Wraps
actions/attest-build-provenance@v2 - Optionally calls
attestation/update-pr-mapif pr-number provided - Provides consistent interface with other attestation actions
Source Reference
Used throughout helm-charts workflows:
validate-contribution-pr.yamlvalidate-atomic-chart-pr.yamlrelease-atomic-chart.yaml
- Dominant language
- Shell
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from aRustyDev/gh
-
dependencies github-actions
Difficulty 1/5 Under an hour Newbie friendliness 10/100
-
dependencies github-actions
Difficulty 1/5 Under an hour Newbie friendliness 15/100
-
dependencies github-actions
Difficulty 1/5 Under an hour Newbie friendliness 50/100
-
dependencies github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 20/100
-
dependencies github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 10/100
Similar issues
-
good-start
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
VilnaCRM-Org/user-service#497 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
conda-forge/spacy-feedstock#177 ·
-
area:jail bug security severity:low track:open-source
Difficulty 1/5 Under an hour Newbie friendliness 75/100