GlcoinCore/mempool
1
0
Fork 0
mirror of https://github.com/mempool/mempool.git synced 2026-08-13 12:33:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Update .github/workflows/dependabot-provenance-check.yml

Browse source 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This commit is contained in:
Felipe Knorr Kuhn 2026-04-01 16:15:15 +09:00 • committed by GitHub
parent dc7e2bdd82
commit a33fd143e3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 11 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
.github/workflows/dependabot-provenance-check.yml vendored
View file

@ -37,11 +37,21 @@ jobs:
id: npm-provenance
run: |
IFS=',' read -ra DEPS <<< "${{ steps.metadata.outputs.dependency-names }}"
NEW_VERSION="${{ steps.metadata.outputs.new-version }}"
UPDATED_DEPS_JSON='${{ steps.metadata.outputs.updated-dependencies-json }}'
FAILED_DEPS=""
for DEP in "${DEPS[@]}"; do
DEP=$(echo "$DEP" | xargs)
NEW_VERSION=$(echo "$UPDATED_DEPS_JSON" | jq -r --arg name "$DEP" '
.[] | select(.dependency-name == $name) | .new-version
' | head -n 1)
if [ -z "$NEW_VERSION" ] || [ "$NEW_VERSION" = "null" ]; then
echo "::error::Could not determine updated version for dependency $DEP from Dependabot metadata"
FAILED_DEPS="${FAILED_DEPS:+$FAILED_DEPS, }$DEP"
continue
fi
echo "::group::Checking provenance for $DEP@$NEW_VERSION"
ATTESTATIONS=$(npm view "$DEP@$NEW_VERSION" --json 2>/dev/null | jq -r '.dist.attestations // empty')