This is a little program to generate SLSA provenance from CI build logs.
WORK IN PROGRESS - NOT YET WORKING
-
Create a new GitHub Personal Access Token (PAT) with the
workflow
scope. This is needed to fetch artifacts. -
Save the PAT to your ~/.netrc as a password for
api.github.com
:machine api.github.com login ... password ghp_...
-
Install NPM dependencies:
$ npm ci
-
Run the script:
$ node src/cli.js <actions-run-url>
Example:
$ node src/cli.js https://github.com/slsa-framework/github-actions-demo/actions/runs/1241960989