Record what a GitHub Actions workflow built
curl --request POST \
--url https://patch.gg/api/v1/provenance \
--header 'Content-Type: application/json' \
--data '
{
"token": "<string>",
"files": [
{
"path": "<string>",
"sha256": "<string>"
}
]
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({token: '<string>', files: [{path: '<string>', sha256: '<string>'}]})
};
fetch('https://patch.gg/api/v1/provenance', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://patch.gg/api/v1/provenance"
payload = {
"token": "<string>",
"files": [
{
"path": "<string>",
"sha256": "<string>"
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"recorded": 123,
"repository": "<string>",
"commit": "<string>",
"workflow_ref": "<string>"
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}Releases
Record what a GitHub Actions workflow built
Send this from the workflow that builds a release’s programs, with permissions: id-token: write. token is the run’s GitHub Actions token, asked for with this environment’s host as its audience (patch.gg, or staging.patch.gg on staging). GitHub signs it, and it names the repo, the commit and the workflow, so the review knows the files came from that workflow at that commit. The run has to be on GitHub’s own runners, from a workflow file in the same repo at the commit it builds. A release that names that same commit then has those files’ PA-321 dropped (each one’s PA-325 says why), and the review still reads them. A run from any other commit, even an earlier one, doesn’t count.
POST
/
provenance
Record what a GitHub Actions workflow built
curl --request POST \
--url https://patch.gg/api/v1/provenance \
--header 'Content-Type: application/json' \
--data '
{
"token": "<string>",
"files": [
{
"path": "<string>",
"sha256": "<string>"
}
]
}
'const options = {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({token: '<string>', files: [{path: '<string>', sha256: '<string>'}]})
};
fetch('https://patch.gg/api/v1/provenance', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://patch.gg/api/v1/provenance"
payload = {
"token": "<string>",
"files": [
{
"path": "<string>",
"sha256": "<string>"
}
]
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"recorded": 123,
"repository": "<string>",
"commit": "<string>",
"workflow_ref": "<string>"
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}{
"error": {
"code": "version_exists",
"message": "<string>",
"details": "<unknown>"
}
}Body
application/json