Skip to content

Watch-mapper status-amplification mitigation (#48) #100

Watch-mapper status-amplification mitigation (#48)

Watch-mapper status-amplification mitigation (#48) #100

Triggered via push April 26, 2026 00:37
Status Success
Total duration 13m 25s
Artifacts 18

build.yaml

on: push
🔐 Verify Signed Commits
8s
🔐 Verify Signed Commits
⚖️ Verify SPDX License Headers
4s
⚖️ Verify SPDX License Headers
🧾 Validate VEX Statements
0s
🧾 Validate VEX Statements
🛡️ Security Vulnerability Scan
25s
🛡️ Security Vulnerability Scan
🏗️ IaC Security Scan (Trivy config)
21s
🏗️ IaC Security Scan (Trivy config)
🧪 cargo-deny (License + Advisory + Sources)
24s
🧪 cargo-deny (License + Advisory + Sources)
🏷️ Extract Version Information
3s
🏷️ Extract Version Information
🎨 Check Formatting
0s
🎨 Check Formatting
Matrix: build
📦 Package Deployment Manifests
📦 Package Deployment Manifests
📎 Clippy
0s
📎 Clippy
Matrix: ✍️ Sign Binary Artifacts
🔬 Generate SLSA Provenance Subjects
6s
🔬 Generate SLSA Provenance Subjects
Matrix: docker
🏛️ Generate SLSA Provenance  /  detect-env
6s
🏛️ Generate SLSA Provenance / detect-env
Matrix: attest
Matrix: grype-triage
🏛️ Generate SLSA Provenance  /  generator
23s
🏛️ Generate SLSA Provenance / generator
🤖 Auto-VEX (presence)
2m 27s
🤖 Auto-VEX (presence)
🏛️ Generate SLSA Provenance  /  upload-assets
🏛️ Generate SLSA Provenance / upload-assets
🧾 Assemble OpenVEX
25s
🧾 Assemble OpenVEX
🏛️ Generate SLSA Provenance  /  final
2s
🏛️ Generate SLSA Provenance / final
Matrix: grype
🚀 Upload Release Assets
0s
🚀 Upload Release Assets
Fit to window
Zoom out
Zoom in

Annotations

16 warnings
🏗️ IaC Security Scan (Trivy config)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🛡️ Security Vulnerability Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🦀 Build - Linux ARM64
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🦀 Build - Linux x86_64
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / detect-env
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v2.1.0. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / generator
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256, ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check, actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34, actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / generator
Restore cache failed: Dependencies file is not found in /home/runner/work/5-spot/5-spot. Supported file pattern: go.sum
🧪 Test
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🐳 Build and Push Docker Image - Chainguard
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Variables should be defined before their use: Dockerfile.chainguard#L40
UndefinedVar: Usage of undefined variable '$BASE_IMAGE' More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
🐳 Build and Push Docker Image - Distroless
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🔏 Attest Docker Image - Chainguard
Please check that the "artifact-metadata:write" permission has been included
🔏 Attest Docker Image - Chainguard
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
🔏 Attest Docker Image - Distroless
Please check that the "artifact-metadata:write" permission has been included
🔏 Attest Docker Image - Distroless
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
🤖 Auto-VEX (presence)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
0.0.0-main.2026-04-26.100.intoto.jsonl Expired
10.1 KB
sha256:79f75907db9950e41f6597b32970681a809c289b7b7873a8f7865b58652ecb3f
5spot-linux-amd64 Expired
5.2 MB
sha256:d89c2c05d57f6b124610d60ba58a7e6a0fef11d2e88228adf88675c3364c2feb
5spot-linux-amd64-signed
5.03 MB
sha256:7ab1cce48fc8bedd6958aa48844299db770961eff317d3e0fc040bee26fa34ab
5spot-linux-arm64 Expired
5 MB
sha256:1cf0180ac003e5a8589614886430ef7ced8ce2804b349de2c4907b65f9b49466
5spot-linux-arm64-signed
4.75 MB
sha256:d05542c5a03f9cfb70c611c31dfaaeb0ae64cbfca0b6bcc66c9fc837581859c8
cargo-audit-report
418 Bytes
sha256:87d0b96dd87cbc2cbdcae1a8cd7e943c408b9098dadcbe0e5489aa88ead7d06f
docker-sbom-Chainguard
8.18 KB
sha256:92cdbd0be907dda7d040a052dde3566be77cfa0a579d05118b80db5643d581c3
docker-sbom-Distroless
106 KB
sha256:7d56a399eb644b7fae1913958ab386a46377c0b8ddc8313eb28719b990798dd0
finos-5-spot_main-2026-04-26-distroless.cyclonedx.json
106 KB
sha256:85e410e844903d426b61980282b93dd669514f46b6a6829844351fabff8fc1b1
finos-5-spot_main-2026-04-26.cyclonedx.json
8.21 KB
sha256:1f9adf243aa12c93bfa525d7c44564cd4573c9dedef4f52b7306f937547051d2
finos~5-spot~TK8OWU.dockerbuild
133 KB
sha256:0242b6f72088fefa0cf2cb4872ce6ffd64482cdce6cab5fd9641be61934ba495
finos~5-spot~VJ2ILN.dockerbuild
76.1 KB
sha256:51bb5acf07803386bd02473b843a75faf94e9368f0a99783ae7b0c1930e9021b
grype-push-Chainguard-100
3.69 KB
sha256:d1379bc1010dffb120f2d66967b855957aef60f31556b571f2b927d3f207b7bb
grype-push-Distroless-100
3.71 KB
sha256:61839e4aea4aafe82245b5d1975ff5fb10e73762694837762bd10ec99bc565c7
grype-triage-Chainguard
12.5 KB
sha256:e8716a353938555588fe64278e534b7d966d5c5a2d888ce4d48d3ce284bf3a01
grype-triage-Distroless
12.5 KB
sha256:4a463117adf3ce03022cbff34583f7ba7df73680d96f120dea735bb64c9e22e5
openvex
1.73 KB
sha256:e9d917a3f1ce24c93a558330e2d09b97a6ddcae2367ed5f9538316d3ef3a566d
vex-auto-presence
584 Bytes
sha256:6ab8c6d90ff5e194b4455194f53478b28a299ac57792e3ff49022a1f6831fe19