Skip to content

v0.2.2

v0.2.2 #166

Triggered via release May 31, 2026 13:04
@ebourgeoisebourgeois
published v0.2.2
Status Success
Total duration 13m 1s
Artifacts 22

build.yaml

on: release
🔐 Verify Signed Commits
6s
🔐 Verify Signed Commits
⚖️ Verify SPDX License Headers
5s
⚖️ Verify SPDX License Headers
🧾 Validate VEX Statements
0s
🧾 Validate VEX Statements
🛡️ Security Vulnerability Scan
25s
🛡️ Security Vulnerability Scan
🏗️ IaC Security Scan (Trivy config)
0s
🏗️ IaC Security Scan (Trivy config)
🧪 cargo-deny (License + Advisory + Sources)
0s
🧪 cargo-deny (License + Advisory + Sources)
🏷️ Extract Version Information
6s
🏷️ Extract Version Information
🎨 Check Formatting
0s
🎨 Check Formatting
Matrix: build
📦 Package Deployment Manifests
1m 32s
📦 Package Deployment Manifests
📎 Clippy
0s
📎 Clippy
Matrix: ✍️ Sign Binary Artifacts
🔬 Generate SLSA Provenance Subjects
4s
🔬 Generate SLSA Provenance Subjects
Matrix: docker
🏛️ Generate SLSA Provenance  /  detect-env
4s
🏛️ Generate SLSA Provenance / detect-env
Matrix: grype-triage
Matrix: attest
🏛️ Generate SLSA Provenance  /  generator
26s
🏛️ Generate SLSA Provenance / generator
🤖 Auto-VEX (reachability)
2m 41s
🤖 Auto-VEX (reachability)
🤖 Auto-VEX (presence)
2m 32s
🤖 Auto-VEX (presence)
🏛️ Generate SLSA Provenance  /  upload-assets
9s
🏛️ Generate SLSA Provenance / upload-assets
🧾 Assemble OpenVEX
16s
🧾 Assemble OpenVEX
🏛️ Generate SLSA Provenance  /  final
3s
🏛️ Generate SLSA Provenance / final
Matrix: grype
🚀 Upload Release Assets
5s
🚀 Upload Release Assets
Fit to window
Zoom out
Zoom in

Annotations

18 warnings
🛡️ Security Vulnerability Scan
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4, actions/upload-artifact@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
📦 Package Deployment Manifests
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🦀 Build - Linux ARM64
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🦀 Build - Linux x86_64
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / detect-env
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v2.1.0. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / generator
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256, ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check, actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34, actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🏛️ Generate SLSA Provenance / generator
Restore cache failed: Dependencies file is not found in /home/runner/work/5-spot/5-spot. Supported file pattern: go.sum
🏛️ Generate SLSA Provenance / upload-assets
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16, slsa-framework/slsa-github-generator/.github/actions/compute-sha256@v2.1.0, softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🧪 Test
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🐳 Build and Push Docker Image - Distroless
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🐳 Build and Push Docker Image - Chainguard
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
Variables should be defined before their use: Dockerfile.chainguard#L40
UndefinedVar: Usage of undefined variable '$BASE_IMAGE' More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
🔏 Attest Docker Image - Distroless
Please check that the "artifact-metadata:write" permission has been included
🔏 Attest Docker Image - Distroless
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
🔏 Attest Docker Image - Chainguard
Please check that the "artifact-metadata:write" permission has been included
🔏 Attest Docker Image - Chainguard
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
🤖 Auto-VEX (presence)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
🤖 Auto-VEX (reachability)
Node.js 20 actions are deprecated. The following actions are running on Node.js 20 and may not work as expected: actions/cache@v4. Actions will be forced to run with Node.js 24 by default starting June 16th, 2026. Node.js 20 will be removed from the runner on September 16th, 2026. Please check if updated versions of these actions are available that support Node.js 24. To opt into Node.js 24 now, set the FORCE_JAVASCRIPT_ACTIONS_TO_NODE24=true environment variable on the runner or in your workflow file. Once Node.js 24 becomes the default, you can temporarily opt out by setting ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/

Artifacts

Produced during runtime
Name Size Digest
0.2.2.intoto.jsonl Expired
10.5 KB
sha256:1377411873ef45746183d0aa2e454d347039b6b6980d33d1cf8606b2915f97dd
5spot-linux-amd64
5.17 MB
sha256:400f24aef020c4864b5cfb4c4b2d7b477aa757b9da409019cca24861c28cad9f
5spot-linux-amd64-signed
5.01 MB
sha256:f128b3080f10de1cc72375c8001d508c02c03c0f14d79ff2801e59c5ed6ca1e7
5spot-linux-arm64
4.99 MB
sha256:c1f662cb823b514acf92015c1b61440a6c65268c765f53b798a669e79c3b83bf
5spot-linux-arm64-signed
4.74 MB
sha256:38cde3f59afdb0cb039399f249a535da0a61384907f92c97804fb0c820c29fb0
cargo-audit-report-release
419 Bytes
sha256:28b91853f44009db3bc19b1e168f2749e48caddd1f193190ba19a4338d1b0f7c
deploy-manifests
21.5 KB
sha256:28872b441fc61a98d3bf82f155236fe2c805c7e59555c13c62eb3f14c0679838
docker-sbom-Chainguard
8.18 KB
sha256:ee3fb22fdf58ec442c5f105e9430e828fe7996e84bc8a244078fdca6122c7a3c
docker-sbom-Distroless
106 KB
sha256:7b3a8e5526d06f01f1ee7fab2a7f4609a8d3ff4db738112dbc2b2e9c7cc3ea93
finos-5-spot_v0_2_2-distroless.cyclonedx.json
106 KB
sha256:dda5f01c510574fb0ae96361f8519f3497f64d1d0e7320b742b4d3c7c92ddae7
finos-5-spot_v0_2_2.cyclonedx.json
8.2 KB
sha256:05e9d3c8dbbf811fdb98124c7b8ac0ff2e02d4a878706d34feb90a7c4e13b04c
finos~5-spot~F55P0E.dockerbuild
132 KB
sha256:b7ca4a0ab407de8ca0a527af9cefc698d1631d1f6c7239e6a44d10296b955229
finos~5-spot~J4IRYZ.dockerbuild
84.9 KB
sha256:86d084b7636af2bc95e2a0b8d99a34ec85d48564146660d7f022ee6caebaf952
grype-release-Chainguard
375 Bytes
sha256:71bfb1840321e291af2e7a3435b6c2cf5811fb61b1e37fbb8a6e0497fc3c6812
grype-release-Distroless
3.71 KB
sha256:9ef47ec7d156b41cd6ff95545ebb81627b0655c4ad65fde38ba20b379d3eefdb
grype-triage-Chainguard
4.72 KB
sha256:1de6792fb5e3746d35567e3afffa8bba5ccf1f18af867f198e28b73c35107375
grype-triage-Distroless
12 KB
sha256:c4bc878be53d1a1818b3999058238580f4cdd51638324f36389764a7c1a8855b
openvex
1.39 KB
sha256:2fdaaf9b3bde5c04293cc2910a9f19d9f33942165b0147e46739f4de697cf6cb
openvex-bundle
6.42 KB
sha256:39a5e811bb43b5ea016a523971ee6eb959c27a8c31545669b716c7939925c86e
vex-auto-presence
332 Bytes
sha256:59250e4404be2a97db03aa3976c54e209218ce2fcc2a6ad07b0f2eda3a753610
vex-auto-reachability
723 Bytes
sha256:a1004fec14dae4a615d7c0887ecf924195da65829b847c4d0d9ca9f3002be5a3
vex-auto-reachability-evidence
1.2 KB
sha256:70bbbda76fdd09f138b31de8ad2b508e66ff200f2bb7cc4ea2ab37b913814bb8