Remove the mTLS check and resumption change, as this was a red herrin… #241
ebourgeoisbuild.yaml
on: push
🔐 Verify Signed Commits
7s
⚖️ Verify SPDX License Headers
6s
🧾 Validate VEX Statements
🔏 Validate Auto-VEX Sign-off
1m 57s
🛡️ Security Vulnerability Scan
14s
🏗️ IaC Security Scan (Trivy config)
19s
🧪 cargo-deny (License + Advisory + Sources)
23s
Matrix: ✍️ Sign Binary Artifacts
Matrix: docker
Matrix: grype-triage
Matrix: attest
Matrix: grype
🚀 Upload Release Assets
0s
Annotations
17 warnings
|
🛡️ Security Vulnerability Scan
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4, actions/upload-artifact@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🔏 Validate Auto-VEX Sign-off
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🦀 Build - Linux ARM64
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🦀 Build - Linux x86_64
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🏛️ Generate SLSA Provenance / detect-env
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@v2.1.0. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🏛️ Generate SLSA Provenance / generator
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256, ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check, actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683, actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34, actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🏛️ Generate SLSA Provenance / generator
Restore cache failed: Dependencies file is not found in /home/runner/work/5-spot/5-spot. Supported file pattern: go.sum
|
|
🧪 Test
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🐳 Build and Push Docker Image - Distroless
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🐳 Build and Push Docker Image - Chainguard
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093, docker/login-action@v3, docker/setup-buildx-action@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
Variables should be defined before their use:
Dockerfile.chainguard#L40
UndefinedVar: Usage of undefined variable '$BASE_IMAGE'
More info: https://docs.docker.com/go/dockerfile/rule/undefined-var/
|
|
🔏 Attest Docker Image - Chainguard
Please check that the "artifact-metadata:write" permission has been included
|
|
🔏 Attest Docker Image - Chainguard
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
|
|
🔏 Attest Docker Image - Distroless
Please check that the "artifact-metadata:write" permission has been included
|
|
🔏 Attest Docker Image - Distroless
Failed to create storage record: Error: Failed to persist storage record: no artifacts found - https://docs.github.com/rest/orgs/artifact-metadata#create-artifact-metadata-storage-record
|
|
🤖 Auto-VEX (presence)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
🤖 Auto-VEX (reachability)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/cache@v4. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
Artifacts
Produced during runtime
| Name | Size | Digest | |
|---|---|---|---|
|
0.0.0-main.2026-06-30.241.intoto.jsonl
Expired
|
10.4 KB |
sha256:f0cd267cae72cd3e4e5bf6601a16bec311e35f7c4f6eb437bc224ae39a86d2f8
|
|
|
5spot-linux-amd64
Expired
|
13.1 MB |
sha256:6e4edff34870b0faec12649806a904cf6e255eac72965198a95171933347391f
|
|
|
5spot-linux-amd64-signed
|
5.05 MB |
sha256:33e144f8c19483813a164c20bf34c9f780348d697178c1897e4cd34434b04e16
|
|
|
5spot-linux-arm64
Expired
|
12.6 MB |
sha256:b35a7f6e46b638222bb54fcdbb6dc7d21f11daf4d1b3514128d9dc2a984976bd
|
|
|
5spot-linux-arm64-signed
|
4.77 MB |
sha256:b05a53c24143fc743c23c88a761812add0adec55395d22bfdc6c2feecb51e584
|
|
|
cargo-audit-report
|
426 Bytes |
sha256:106bdf6701e360c7d755189beba0b33b181da68d2f7764ee9f867a8bd595d6f8
|
|
|
docker-sbom-Chainguard
|
8.18 KB |
sha256:0668f753f43b05b3581f83fcf58100ba702d784dbfdbc9ef83a6edbab76f3f17
|
|
|
docker-sbom-Distroless
|
106 KB |
sha256:fe3352b0e827b279e218c9869365b6928ef05e490fdc70172f45222531bef6d1
|
|
|
finos-5-spot_main-2026-06-30-distroless.cyclonedx.json
|
106 KB |
sha256:994112205fdf4fcf51c17acadf20e0747caf28b4bb4c712797be807017e82962
|
|
|
finos-5-spot_main-2026-06-30.cyclonedx.json
|
8.21 KB |
sha256:e47a5b596987caba47f08826909ccfa69e2561597f43cca1d5dc13f714595c87
|
|
|
finos~5-spot~C01NZN.dockerbuild
|
128 KB |
sha256:835d0789c43e90c995e018ed3c5e01b8408ccd56e81cb74e2288cb226a2999fe
|
|
|
finos~5-spot~O482OF.dockerbuild
|
89.2 KB |
sha256:c958fdc12f3c0b16e99d0c71f06e71a848dae89b88c0c478d9d850b79ba71da5
|
|
|
grype-push-Chainguard-241
|
369 Bytes |
sha256:b38087025d31db3f6599f3be25ce85b231442dbe84d266ce93c0e90ba2226155
|
|
|
grype-push-Distroless-241
|
3.71 KB |
sha256:dc9b01b9979b2ff89629b8d3b563e5f0a962d98b0cd4d64d03673225ad0bd42d
|
|
|
grype-triage-Chainguard
|
5.13 KB |
sha256:814d814cc41179dc066af61bc058188d55567aff75cc7c2e7a0fff803228352f
|
|
|
grype-triage-Distroless
|
13.1 KB |
sha256:2747e4fb2d7de360fd86e7cbf870ec19d5f7353d5b9908b72862b8e99fed1bf6
|
|
|
openvex
|
1.41 KB |
sha256:85ed1a955e1ab77e1ecc6170c51e9642e5133c279945177d444d2b1ea742a338
|
|
|
vex-auto-presence
|
334 Bytes |
sha256:aa4450e0cbf56ffbd5cde67c34fdd00b1274c548a4586c247b58357d991770c4
|
|
|
vex-auto-reachability
|
724 Bytes |
sha256:bc1ce73f664843b81f62920715f8df4fbd18025340138fefaeb2ef0f18ebe714
|
|
|
vex-auto-reachability-evidence
|
1.2 KB |
sha256:f4edde084ed8d348e8171dc0ccf4b89c37130a14c3da4ac8cba800421e43aa8d
|
|