CI: Add workflow for SM security bumps#711
Conversation
Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
|
attestations is only for artifacts so we cannot use them here easily |
| - run: pip install requests | ||
| - run: python3 ./mozjs-sys/etc/sm-security-bump.py | ||
| - name: Create Pull Request | ||
| uses: peter-evans/create-pull-request@v8 |
There was a problem hiding this comment.
why not use gh pr create instead of a third party action?
There was a problem hiding this comment.
Because of other advance behavior: https://github.com/peter-evans/create-pull-request/tree/v8/?tab=readme-ov-file#action-behaviour, mainly when there is no changes.
There was a problem hiding this comment.
Interesting. That does sound useful. Could we pin the action to a hash instead, to make updates explicit even if the tag moves on?
sm-security-bump creates a release with artifacts (the source code archives), so we should be able to attest those, right? It's mainly about showing that the source code artifact we uploaded was done by CI, and can't have been modified by a human maintainer before uploading. |
I get error when quickly trying this in personal fork, so I would defer this for later. Until we land basic workflow on main I cannot do test runs here :( |
Some fixups for #711 --------- Signed-off-by: sagudev <16504129+sagudev@users.noreply.github.com>
2 participants
No description provided.