Skip to content

Use GH attestation and organise workflows better - #139

Merged
asgrim merged 2 commits into
php:mainfrom
asgrim:consolidate-release-pipelines
Nov 27, 2024
Merged

Use GH attestation and organise workflows better#139
asgrim merged 2 commits into
php:mainfrom
asgrim:consolidate-release-pipelines

Conversation

@asgrim

Copy link
Copy Markdown
Contributor

Fixes#132

@asgrimasgrim added the enhancement New feature or request label Nov 27, 2024
Comment thread.github/workflows/build-phar.yml Outdated
It does not make sense to do so; nor do PR submitters have permission to do so.
We can't write attestations to `php/pie` in an unprivileged context, otherwise
anyone could send a PR with malicious code, store attestation that `php/pie`
built the PHAR, and it would look genuine.
@asgrim
asgrimforce-pushed the consolidate-release-pipelines branch from 8263560 to 41a9bd4CompareNovember 27, 2024 19:45
@asgrimasgrim added this to the 0.3.0 milestone Nov 27, 2024
@asgrim
asgrim merged commit 8f18c18 into php:mainNov 27, 2024
@asgrim
asgrim deleted the consolidate-release-pipelines branch November 27, 2024 20:50
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancementNew feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Consolidate release pipelines

2 participants

@asgrim@TimWolla