GitHub Actions build type

GitHub Actions build type

The README says that a workflow’s identity in provenance is workflow_path, workflow_repository and runner_environment, as GitHub’s build type for SLSA provenance writes them, and that a workflow’s identity comes from the build type.¹

The workflow module says how each field follows it:²

• workflow_path is the file’s path from the repository root, as the build type writes workflow.path;
• workflow_repository is the repository that holds the file, as the build type writes workflow.repository: an HTTPS address without .git;
• runner_environment says whether a job’s runner is hosted by GitHub or by the repository’s owner, as the build type records it for a run, with the values github-hosted and self-hosted.

The module’s comments add that the build type forms a reusable workflow’s builder.id from the server’s address followed by the job’s workflow reference, which names the file and its ref. So a reusable workflow that generates provenance is the builder. The ref at which a run checks out the file belongs to the run, and the build type records it as workflow.ref, so the schema does not model it. The action module’s comment says that SLSA counts the actions a build runs among its steps, which the tenant defines. It adds that an action is never a build’s trust boundary, as a reusable workflow that signs provenance is.³

Footnotes

1. README.md, the What it models and Influences sections ↩

2. src/github_actions/schema/github_actions_workflow.yaml, the GhaWorkflow attributes and comments and the GhaReusableWorkflow comment ↩

3. src/github_actions/schema/github_actions_action.yaml, the first GhaAction comment ↩