Skip to content

Build

Build #128

Triggered via release May 3, 2026 14:30
@ebourgeoisebourgeois
published 18d05d1
Status Success
Total duration 12m 9s
Artifacts 22

build.yaml

on: release
🔐 Verify Signed Commits
6s
🔐 Verify Signed Commits
⚖️ Verify SPDX License Headers
6s
⚖️ Verify SPDX License Headers
🧾 Validate VEX Statements
0s
🧾 Validate VEX Statements
🛡️ Security Vulnerability Scan
28s
🛡️ Security Vulnerability Scan
🏗️ IaC Security Scan (Trivy config)
0s
🏗️ IaC Security Scan (Trivy config)
🧪 cargo-deny (License + Advisory + Sources)
0s
🧪 cargo-deny (License + Advisory + Sources)
🏷️ Extract Version Information
3s
🏷️ Extract Version Information
🎨 Check Formatting
0s
🎨 Check Formatting
Matrix: build
📦 Package Deployment Manifests
1m 33s
📦 Package Deployment Manifests
📎 Clippy
0s
📎 Clippy
Matrix: ✍️ Sign Binary Artifacts
🔬 Generate SLSA Provenance Subjects
3s
🔬 Generate SLSA Provenance Subjects
Matrix: docker
🏛️ Generate SLSA Provenance  /  detect-env
4s
🏛️ Generate SLSA Provenance / detect-env
Matrix: grype-triage
Matrix: attest
🏛️ Generate SLSA Provenance  /  generator
19s
🏛️ Generate SLSA Provenance / generator
🤖 Auto-VEX (reachability)
2m 18s
🤖 Auto-VEX (reachability)
🤖 Auto-VEX (presence)
2m 13s
🤖 Auto-VEX (presence)
🏛️ Generate SLSA Provenance  /  upload-assets
12s
🏛️ Generate SLSA Provenance / upload-assets
🧾 Assemble OpenVEX
15s
🧾 Assemble OpenVEX
🏛️ Generate SLSA Provenance  /  final
3s
🏛️ Generate SLSA Provenance / final
Matrix: grype
🚀 Upload Release Assets
6s
🚀 Upload Release Assets
Fit to window
Zoom out
Zoom in

Annotations

18 warnings
🛡️ Security Vulnerability Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
📦 Package Deployment Manifests
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🦀 Build - Linux ARM64
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🦀 Build - Linux x86_64
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / detect-env
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v2.1.0. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / generator
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256, ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check, actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34, actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / generator
Restore cache failed: Dependencies file is not found in /home/runner/work/5-spot/5-spot. Supported file pattern: go.sum
🏛️ Generate SLSA Provenance / upload-assets
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16, slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v2.1.0, softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🧪 Test
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🐳 Build and Push Docker Image - Distroless
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🐳 Build and Push Docker Image - Chainguard
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Variables should be defined before their use: Dockerfile.chainguard#L40
UndefinedVar: Usage of undefined variable '$BASE_IMAGE' More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
🔏 Attest Docker Image - Chainguard
Please check that the "artifact-metadata:write" permission has been included
🔏 Attest Docker Image - Chainguard
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
🔏 Attest Docker Image - Distroless
Please check that the "artifact-metadata:write" permission has been included
🔏 Attest Docker Image - Distroless
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
🤖 Auto-VEX (presence)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🤖 Auto-VEX (reachability)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 2nd, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
0.2.0.intoto.jsonl Expired
10 KB
sha256:6d4f4d0cf3b212b8477d0f41de4c51ac37cff984e974cfdc5123a387defb2f0f
5spot-linux-amd64
4.9 MB
sha256:d47855392066e8cac3b81624e60d5ad9e92c7647443eac30eb6fe4e7e34120d2
5spot-linux-amd64-signed
4.74 MB
sha256:2eab7303088326ed64427ea0adce623dcf02de1d75c14e35b1b14d5b9e0d81b5
5spot-linux-arm64
4.73 MB
sha256:96e78d70e97b53fc2836deaa2ec7422a2fa446d8c51bbcea47efa4ed236b2dc1
5spot-linux-arm64-signed
4.49 MB
sha256:7922f4afc6d5ca7d050f31b2e4e6f688bfe528a8e65e4347215e5ab8a0ece5d4
cargo-audit-report-release
416 Bytes
sha256:0f24f99a156ce26e62ba6a49d4a2fead4b0d8712d0b29b97bea0ef401785c4bc
deploy-manifests
19.1 KB
sha256:83d13ba000ba32d76fde60ef98107595e72d680c30940d98bc815ff1b6acf500
docker-sbom-Chainguard
8.18 KB
sha256:423c5ab53dd3ec0e7bb3f617cace49f3e143f6571c0123e27be20bf8c12c5410
docker-sbom-Distroless
106 KB
sha256:65430a4feea0a66911cc600b0883a6b008d2129947fb1c81b7f9591bd230b2bf
finos-5-spot_v0_2_0-distroless.cyclonedx.json
106 KB
sha256:0fbd710e23d8b8d242fd715cba5be42277dabe10d858d84a49b452a0325891a6
finos-5-spot_v0_2_0.cyclonedx.json
8.2 KB
sha256:cec2937ffbc1551c38da689a6e3c0c05e03219194019b1916274e81a9b347382
finos~5-spot~4KYDIA.dockerbuild
83.8 KB
sha256:648f7b2f1ea6d3f43f7d7b0dd0f51ef9333a2306be03180de859cdb228ca364c
finos~5-spot~HXKAKD.dockerbuild
132 KB
sha256:bb230ad576b0ba29835a0f6d5811f0cf6198ee4f0bd69b7b9bc0ff9eb4822929
grype-release-Chainguard
375 Bytes
sha256:b5923aa0923a04b334c58454e009e15cf8ff260c87e01642845233e90825627b
grype-release-Distroless
3.71 KB
sha256:d229bf6e9aa9dc38d4c5b49ecf3cde7fd195f5652c629458ede59bf185324df4
grype-triage-Chainguard
4.72 KB
sha256:16de462afce03ff7dd1cacd26f5c51508b40077fd4643b0da4e40d43e16bbb6b
grype-triage-Distroless
12 KB
sha256:25e92502a1df973a099135b033e56a956520a989b6b0e1df57acfe6cffee90d5
openvex
1.38 KB
sha256:fca04ab9d9d3c65a88c3f2781a88b3aa262ed7b4dbfaade21daee5cf53a8d45a
openvex-bundle
6.37 KB
sha256:39eb352fe4465fe02ed73d2cec8e27e81ca2fb5db55990c194bfe9a304706c32
vex-auto-presence
333 Bytes
sha256:47fb5638ffe0c90902f590fe06fc0a11f2cced1d89ec293669a87154d9aaf2ac
vex-auto-reachability
724 Bytes
sha256:9496f40a4a28777efc1d770e11ce9d91511c909c7219539d31f3812f61ff0493
vex-auto-reachability-evidence
1.2 KB
sha256:b393c17df666e33be6ad5250c06fc4158ed674d2d2c2e90e5069d8d64c8797f4