Generate Provenance workflow (kumahq/kuma)

The Generate Provenance workflow from kumahq/kuma, explained and optimized by Latchkey.

CI health: B - good

Run this on Latchkey for self-healing, caching, and up to 58% lower cost.

Grade your own workflow free or run it on Latchkey →

Source: kumahq/kuma.github/workflows/_provenance.yamlLicense Apache-2.0View source

What it does

This is the Generate Provenance workflow from the kumahq/kuma repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Generate Provenance
on:
  workflow_call:
    inputs:
      BINARY_ARTIFACTS_HASH_AS_FILE:
        required: true
        type: string
        description: file containing hash for all compressed binary artifacts
      IMAGES:
        required: true
        type: string
        description: JSON string containing all IMAGES
      IMAGE_DIGESTS:
        required: true
        type: string
        description: JSON string containing all image digests
      REGISTRY:
        required: true
        type: string
        description: registry name
      NOTARY_REPOSITORY:
        required: true
        type: string
        description: notary repository
permissions: {}
jobs:
  artifact-provenance:
    permissions:
      contents: write # To add assets to a release
      actions: read # For getting workflow run info to build provenance
      id-token: write # needed for signing the images
    # need to use non hash version because of: https://github.com/slsa-framework/slsa-github-generator/issues/3498
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ inputs.BINARY_ARTIFACTS_HASH_AS_FILE }}
      upload-assets: ${{ github.ref_type == 'tag' }}
      upload-tag-name: ${{ github.ref_name }}
      provenance-name: ${{ github.event.repository.name }}.intoto.jsonl
      draft-release: "true"

  # Provenance job for all images manifests
  # SLSA generator is a reusable workflow
  # pull-request event is [not supported](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#supported-triggers)
  # runs-on option is [not supported](https://github.com/orgs/community/discussions/25783)
  # ENV option is [not supported](https://github.com/orgs/community/discussions/26671)
  # Reusable workflow doesn't support exrernal COSIGN_REPOSITORY via input / env variable
  # TODO:
  #   Split provenance jobs for internal / official releases when repositories are split
  images-provenance:
    permissions:
      contents: read
      actions: read # For getting workflow run info to build provenance
      id-token: write # needed for signing the images
      packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
    strategy:
      fail-fast: true
      matrix:
        IMAGE: ${{ fromJSON(inputs.IMAGES) }}
    # need to use non hash version because of: https://github.com/slsa-framework/slsa-github-generator/issues/3498
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ inputs.REGISTRY }}/${{ matrix.IMAGE }}
      digest: ${{ fromJSON(inputs.IMAGE_DIGESTS)[matrix.IMAGE] }}
      provenance-repository: ${{ inputs.REGISTRY }}/${{ inputs.NOTARY_REPOSITORY }}
      registry-username: ${{ vars.DOCKER_USERNAME }}
      provenance-registry-username: ${{ vars.DOCKER_USERNAME }}
    secrets:
      registry-password: ${{ secrets.DOCKER_API_KEY }}
      provenance-registry-password: ${{ secrets.DOCKER_API_KEY }}

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Generate Provenance
on:
  workflow_call:
    inputs:
      BINARY_ARTIFACTS_HASH_AS_FILE:
        required: true
        type: string
        description: file containing hash for all compressed binary artifacts
      IMAGES:
        required: true
        type: string
        description: JSON string containing all IMAGES
      IMAGE_DIGESTS:
        required: true
        type: string
        description: JSON string containing all image digests
      REGISTRY:
        required: true
        type: string
        description: registry name
      NOTARY_REPOSITORY:
        required: true
        type: string
        description: notary repository
permissions: {}
jobs:
  artifact-provenance:
    timeout-minutes: 30
    permissions:
      contents: write # To add assets to a release
      actions: read # For getting workflow run info to build provenance
      id-token: write # needed for signing the images
    # need to use non hash version because of: https://github.com/slsa-framework/slsa-github-generator/issues/3498
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ inputs.BINARY_ARTIFACTS_HASH_AS_FILE }}
      upload-assets: ${{ github.ref_type == 'tag' }}
      upload-tag-name: ${{ github.ref_name }}
      provenance-name: ${{ github.event.repository.name }}.intoto.jsonl
      draft-release: "true"
 
  # Provenance job for all images manifests
  # SLSA generator is a reusable workflow
  # pull-request event is [not supported](https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#supported-triggers)
  # runs-on option is [not supported](https://github.com/orgs/community/discussions/25783)
  # ENV option is [not supported](https://github.com/orgs/community/discussions/26671)
  # Reusable workflow doesn't support exrernal COSIGN_REPOSITORY via input / env variable
  # TODO:
  #   Split provenance jobs for internal / official releases when repositories are split
  images-provenance:
    timeout-minutes: 30
    permissions:
      contents: read
      actions: read # For getting workflow run info to build provenance
      id-token: write # needed for signing the images
      packages: write # Required for publishing provenance. Issue: https://github.com/slsa-framework/slsa-github-generator/tree/main/internal/builders/container#known-issues
    strategy:
      fail-fast: true
      matrix:
        IMAGE: ${{ fromJSON(inputs.IMAGES) }}
    # need to use non hash version because of: https://github.com/slsa-framework/slsa-github-generator/issues/3498
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ inputs.REGISTRY }}/${{ matrix.IMAGE }}
      digest: ${{ fromJSON(inputs.IMAGE_DIGESTS)[matrix.IMAGE] }}
      provenance-repository: ${{ inputs.REGISTRY }}/${{ inputs.NOTARY_REPOSITORY }}
      registry-username: ${{ vars.DOCKER_USERNAME }}
      provenance-registry-username: ${{ vars.DOCKER_USERNAME }}
    secrets:
      registry-password: ${{ secrets.DOCKER_API_KEY }}
      provenance-registry-password: ${{ secrets.DOCKER_API_KEY }}

What changed

Add a job timeout so a hung step cannot burn hours of runner time.

1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

This workflow runs 2 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.