chore(actions): Add doc how to verify GitHub Attestations with GitHub cli and verify release artifacts with Cosign by ViacheslavKudinov · Pull Request #2846 · integrations/terraform-provider-github

ViacheslavKudinov · 2025-10-29T23:47:31Z

Resolves #NaN

Before the change?

There is no doc how to verify attestations

After the change?

Add how to use verification of attestations with GitHub CLI
https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/use-artifact-attestations
Add Cosign verification

Pull request checklist

Schema migrations have been created if needed (example)
Tests for the changes have been added (for bug fixes / features)
Docs have been reviewed and added / updated if needed (for bug fixes / features)

Does this introduce a breaking change?

Please see our docs on breaking changes to help!

Yes
No

Signed-off-by: Viacheslav Kudinov <[email protected]>

ViacheslavKudinov · 2025-10-30T04:19:43Z

Any known thing why we may regret by adding attestation?

Just loudly thinking if anything we need to consider

Signed-off-by: Viacheslav Kudinov <[email protected]>

ViacheslavKudinov · 2025-12-08T13:58:24Z

@nickfloyd @stevehipwell I've updated PR to resolve conflicts after workflows were updated.
Now it includes only doc how to do verification of attestations.

Please, feel free to suggest any updates.

stevehipwell

Would it be possible to add the cosign equivalents of the gh commands? We also ought to provide the command to verify the SHA256SUMS file signature.

ViacheslavKudinov · 2025-12-11T10:09:34Z

@stevehipwell i've updated doc.
It is not exactly equivalents as with Cosign is only signed checksum file,
but anyway i tried to cover what we can do with current settings to verify the SHA256SUMS file signature and then with checksum the artifact(s).

Please, let me know if something else was expected or i've missed.

stevehipwell

I've added some comments, note that you can also verify the attestations with cosign.

Co-authored-by: Steve Hipwell <[email protected]>

ViacheslavKudinov · 2026-01-16T17:52:59Z

@ViacheslavKudinov this is looking really good. I've just added a couple of simple suggestions (note the headings one applies to all heading not just the one I highlighted).

@stevehipwell thanks for the suggestions. I had a chance to make the changes.

Could you check how it looks now ?
Anything else would be good to update?

Thank you in advance.

stevehipwell

I think the headings still need to be capitalized, I've mad some changes in the spirit of being concise but the real point is to get the capitalization right.

Co-authored-by: Steve Hipwell <[email protected]>

ViacheslavKudinov · 2026-01-16T19:52:28Z

I think the headings still need to be capitalized, I've mad some changes in the spirit of being concise but the real point is to get the capitalization right.

Oh, sorry i didn't get it correctly.

Is it some "known rule" how capitalization should happen in "heading" ?

I'm not aware that there is something in place, but doesn't mean it is not there.

stevehipwell

Thanks for your patience @ViacheslavKudinov.

LGTM

stevehipwell · 2026-02-02T17:12:03Z

@ViacheslavKudinov could you please rebase this?

ViacheslavKudinov · 2026-02-02T17:22:52Z

@ViacheslavKudinov could you please rebase this?

@stevehipwell merged "main" into this branch via UI

… cli and verify release artifacts with Cosign (integrations#2846) * Add GH attestation on release Signed-off-by: Viacheslav Kudinov <[email protected]> * Add information that attestations are available sine v6.9.0 Signed-off-by: Viacheslav Kudinov <[email protected]> * Add Cosign verification * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Use ${version} in all the commands Signed-off-by: Viacheslav Kudinov <[email protected]> * Add Cosign attestation verification * Use artifact variable Signed-off-by: Viacheslav Kudinov <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update headings and blockquote * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> * Update VERIFY_ATTESTATIONS.md Co-authored-by: Steve Hipwell <[email protected]> --------- Signed-off-by: Viacheslav Kudinov <[email protected]> Co-authored-by: Viacheslav Kudinov <[email protected]> Co-authored-by: Steve Hipwell <[email protected]>

ViacheslavKudinov force-pushed the maintenance/add-attestation branch from 10dbe42 to cc98a12 Compare October 29, 2025 23:50

Add GH attestation on release

4d2ad53

Signed-off-by: Viacheslav Kudinov <[email protected]>

ViacheslavKudinov force-pushed the maintenance/add-attestation branch from cc98a12 to 4d2ad53 Compare October 29, 2025 23:50

ViacheslavKudinov marked this pull request as ready for review October 29, 2025 23:52

ViacheslavKudinov mentioned this pull request Oct 29, 2025

Add SLSA Go releaser workflow #2830

Closed

5 tasks

ViacheslavKudinov changed the title ~~chore(Actions): Add GH attestation on release process~~ chore(actions): Add GH attestation on release process Nov 1, 2025

nickfloyd added this to Terraform Provider Nov 20, 2025

github-project-automation Bot moved this to Backlog in Terraform Provider Nov 20, 2025

nickfloyd added this to the v7 Next milestone Nov 20, 2025

nickfloyd moved this from Backlog to On Deck in Terraform Provider Nov 20, 2025

Merge branch 'main' into maintenance/add-attestation

aced599

github-actions Bot added the Type: Maintenance Any dependency, housekeeping, and clean up Issue or PR label Nov 23, 2025

Merge branch 'main' into maintenance/add-attestation

b5c9194

ViacheslavKudinov changed the title ~~chore(actions): Add GH attestation on release process~~ chore(actions): Add doc how to verify GH attestations Dec 8, 2025

Add information that attestations are available sine v6.9.0

8ce6580

Signed-off-by: Viacheslav Kudinov <[email protected]>

deiga approved these changes Dec 9, 2025

View reviewed changes

Merge branch 'main' into maintenance/add-attestation

5f9d9a5

stevehipwell requested changes Dec 9, 2025

View reviewed changes

ViacheslavKudinov force-pushed the maintenance/add-attestation branch from c992315 to 56c8a2e Compare December 10, 2025 21:47

ViacheslavKudinov changed the title ~~chore(actions): Add doc how to verify GH attestations~~ chore(actions): Add doc how to verify GH attestations with GitHub cli and verify release artifacts with Cosign Dec 10, 2025

ViacheslavKudinov force-pushed the maintenance/add-attestation branch from 56c8a2e to 17126dc Compare December 10, 2025 21:54

Add Cosign verification

00de37c

ViacheslavKudinov force-pushed the maintenance/add-attestation branch from 17126dc to 00de37c Compare December 10, 2025 22:02

ViacheslavKudinov requested a review from stevehipwell December 10, 2025 22:12

stevehipwell requested changes Dec 12, 2025

View reviewed changes

Comment thread VERIFY_ATTESTATIONS.md Outdated

Comment thread VERIFY_ATTESTATIONS.md Outdated

Comment thread VERIFY_ATTESTATIONS.md Outdated

ViacheslavKudinov and others added 2 commits December 12, 2025 17:11

Update VERIFY_ATTESTATIONS.md

d032e0a

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

199e2e6

Co-authored-by: Steve Hipwell <[email protected]>

ViacheslavKudinov and others added 3 commits January 16, 2026 18:36

Update VERIFY_ATTESTATIONS.md

a1082cb

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

58a7f7e

Co-authored-by: Steve Hipwell <[email protected]>

Update headings and blockquote

1c5420e

ViacheslavKudinov requested a review from stevehipwell January 16, 2026 17:50

stevehipwell requested changes Jan 16, 2026

View reviewed changes

ViacheslavKudinov and others added 9 commits January 16, 2026 20:47

Update VERIFY_ATTESTATIONS.md

c6d03e4

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

b30fff1

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

3cd061e

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

3a3fd17

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

c2010ac

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

8184730

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

188c567

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

9fb5298

Co-authored-by: Steve Hipwell <[email protected]>

Update VERIFY_ATTESTATIONS.md

329ea41

Co-authored-by: Steve Hipwell <[email protected]>

Merge branch 'main' into maintenance/add-attestation

04783a6

stevehipwell approved these changes Jan 20, 2026

View reviewed changes

stevehipwell added the Type: Documentation Improvements or additions to documentation label Jan 20, 2026

stevehipwell modified the milestones: v7 Next, v6.11.0 Release Jan 20, 2026

stevehipwell enabled auto-merge (squash) February 2, 2026 17:11

stevehipwell disabled auto-merge February 2, 2026 17:11

Merge branch 'main' into maintenance/add-attestation

bbad219

stevehipwell enabled auto-merge (squash) February 2, 2026 18:35

stevehipwell merged commit bbf7abb into integrations:main Feb 2, 2026
7 checks passed

github-project-automation Bot moved this from On Deck to Done in Terraform Provider Feb 2, 2026

Conversation

ViacheslavKudinov commented Oct 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Before the change?

After the change?

Pull request checklist

Does this introduce a breaking change?

Uh oh!

ViacheslavKudinov commented Oct 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ViacheslavKudinov commented Dec 8, 2025

Uh oh!

stevehipwell left a comment

Choose a reason for hiding this comment

Uh oh!

ViacheslavKudinov commented Dec 11, 2025

Uh oh!

stevehipwell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ViacheslavKudinov commented Jan 16, 2026

Uh oh!

stevehipwell left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ViacheslavKudinov commented Jan 16, 2026

Uh oh!

stevehipwell left a comment

Choose a reason for hiding this comment

Uh oh!

stevehipwell commented Feb 2, 2026

Uh oh!

ViacheslavKudinov commented Feb 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ViacheslavKudinov commented Oct 29, 2025 •

edited

Loading

ViacheslavKudinov commented Oct 30, 2025 •

edited

Loading