NAME

repomatic pack-attestation - Name an attestation bundle after the asset it attests

SYNOPSIS

repomatic pack-attestation [OPTIONS]

DESCRIPTION

Rename an attestation bundle after its subject, print the upload list.

actions/attest writes every bundle to the same `attestation.json` basename, so a release attaching several would keep only the last. This reads back the subjects the bundle actually attests, names it after them, and prints every file the release upload step should attach: the assets and their bundle, one path per line.

A bundle covering several assets has no single name to take, so pass --name to name the set instead.

With --require-declared, a file the project declares as an extra release asset but whose artifact never landed fails the command, before anything is attached: an immutable release could never gain it afterwards.

Idempotent: re-running copies the same bytes over the same name, and an upload replaces the assets of the same name.

OPTIONS

--bundle FILE: Attestation bundle written by actions/attest.
[required]
--dir DIRECTORY: Directory holding the attested assets, and where the bundle lands.
--name TEXT: Stem naming the set, for a bundle attesting more than one asset.
--require-declared / --no-require-declared: Fail unless the bundle attests every file the release-assets setting of [tool.repomatic] declares.
--verify / --no-verify: Check the provenance of every attested asset with gh attestation verify. Needs --repo.
--upload-to TAG: Attach the packed files to the release of this tag, replacing same-named assets. Needs --repo.
--repo TEXT: Repository the release belongs to. Defaults to $GITHUB_REPOSITORY.
--help / -h: Show this message and exit.

ENVIRONMENT

PACK_ATTESTATION_BUNDLE_PATH: Attestation bundle written by actions/attest.
PACK_ATTESTATION_ASSET_DIR: Directory holding the attested assets, and where the bundle lands.
PACK_ATTESTATION_SET_NAME: Stem naming the set, for a bundle attesting more than one asset.
PACK_ATTESTATION_REQUIRE_DECLARED: Fail unless the bundle attests every file the release-assets setting of [tool.repomatic] declares.
PACK_ATTESTATION_VERIFY: Check the provenance of every attested asset with gh attestation verify. Needs --repo.
PACK_ATTESTATION_UPLOAD_TO: Attach the packed files to the release of this tag, replacing same-named assets. Needs --repo.
GITHUB_REPOSITORY: Repository the release belongs to. Defaults to $GITHUB_REPOSITORY.
PACK_ATTESTATION_REPO: Repository the release belongs to. Defaults to $GITHUB_REPOSITORY.
PACK_ATTESTATION__CLICK_DEFAULT_HELP: Show this message and exit.

EXIT STATUS

0: Success.
1: A runtime error, an aborted prompt (Ctrl-D), or a declined confirmation.
2: A usage error: unknown option, invalid value, missing operand, or an unparsable configuration file.
130: Interrupted with Ctrl-C: the process ends by SIGINT, reported as 130.

EXAMPLES

Single asset, named papaya.tar.gz.attestation.json

repomatic pack\-attestation \-\-bundle "${BUNDLE_PATH}"

A glob's worth of assets, all covered by one bundle

repomatic pack\-attestation \-\-bundle b.json \-\-dir dist \-\-name papaya\-set

Check the provenance, then attach to a release draft

repomatic pack\-attestation \-\-bundle "${BUNDLE_PATH}" \-\-verify \-\-upload\-to v1.2.3

AUTHORS

Kevin Deldycke