actions · bdehamer · Nov 5, 2024 · Nov 1, 2024
@@ -117,18 +117,14 @@ See [action.yml](action.yml)
 
 Attestations are saved in the JSON-serialized [Sigstore bundle][6] format.
 
-If multiple subjects are being attested at the same time, each attestation will
-be written to the output file on a separate line (using the [JSON Lines][7]
-format).
+If multiple subjects are being attested at the same time, a single attestation
+will be created with references to each of the supplied subjects.
 
 ## Attestation Limits
 
 ### Subject Limits
 
-No more than 2500 subjects can be attested at the same time. Subjects will be
-processed in batches 50. After the initial group of 50, each subsequent batch
-will incur an exponentially increasing amount of delay (capped at 1 minute of
-delay per batch) to avoid overwhelming the attestation API.
+No more than 1024 subjects can be attested at the same time.
 
 ### Predicate Limits
 
@@ -269,7 +265,6 @@ jobs:
 [5]: https://cli.github.com/manual/gh_attestation_verify
 [6]:
   https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto
-[7]: https://jsonlines.org/
 [8]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns
 [9]:
   https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
@@ -46,8 +46,7 @@ const defaultInputs: main.RunInputs = {
   pushToRegistry: false,
   showSummary: true,
   githubToken: '',
-  privateSigning: false,
-  batchSize: 50
+  privateSigning: false
 }
 
 describe('action', () => {
@@ -290,15 +289,11 @@ describe('action', () => {
     })
   })
 
-  describe('when the subject count exceeds the batch size', () => {
+  describe('when the subject count is greater than 1', () => {
     let dir = ''
     const filename = 'subject'
-    let scope: nock.Scope
 
     beforeEach(async () => {
-      // Start from scratch
-      nock.cleanAll()
-
       const subjectCount = 5
       const content = 'file content'
 
@@ -309,38 +304,22 @@ describe('action', () => {
       // Add files for glob testing
       for (let i = 0; i < subjectCount; i++) {
         await fs.writeFile(path.join(dir, `${filename}-${i}`), content)
-
-        // Set-up a Fulcio mock for each subject
-        await mockFulcio({
-          baseURL: 'https://fulcio.githubapp.com',
-          strict: false
-        })
-
-        // Set-up a TSA mock for each subject
-        await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
-
-        // Set-up a GH API mock for each subject
-        mockAgent
-          .get('https://api.github.com')
-          .intercept({
-            path: /^\/repos\/.*\/.*\/attestations$/,
-            method: 'post'
-          })
-          .reply(201, { id: attestationID })
       }
 
-      // Set-up a OIDC token mock for each subject
-      scope = nock(tokenURL)
-        .get('/')
-        .query({ audience: 'sigstore' })
-        .times(subjectCount)
-        .reply(200, { value: oidcToken })
-
       // Set the GH context with private repository visibility and a repo owner.
       setGHContext({
         payload: { repository: { visibility: 'private' } },
         repo: { owner: 'foo', repo: 'bar' }
       })
+
+      // Set-up a Fulcio mock for each subject
+      await mockFulcio({
+        baseURL: 'https://fulcio.githubapp.com',
+        strict: false
+      })
+
+      // Set-up a TSA mock for each subject
+      await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
     })
 
     afterEach(async () => {
@@ -354,26 +333,16 @@ describe('action', () => {
         subjectPath: path.join(dir, `${filename}-*`),
         predicateType,
         predicate,
-        githubToken: 'gh-token',
-        batchSize: 2
+        githubToken: 'gh-token'
       }
       await main.run(inputs)
 
       expect(runMock).toHaveReturned()
       expect(setFailedMock).not.toHaveBeenCalled()
       expect(infoMock).toHaveBeenNthCalledWith(
         1,
-        expect.stringMatching('Processing subject batch 1/3')
-      )
-      expect(infoMock).toHaveBeenNthCalledWith(
-        10,
-        expect.stringMatching('Processing subject batch 2/3')
-      )
-      expect(infoMock).toHaveBeenNthCalledWith(
-        19,
-        expect.stringMatching('Processing subject batch 3/3')
+        expect.stringMatching('Attestation created for 5 subjects')
       )
-      expect(scope.isDone()).toBe(true)
     })
   })
 
@@ -382,7 +351,7 @@ describe('action', () => {
     const filename = 'subject'
 
     beforeEach(async () => {
-      const subjectCount = 2501
+      const subjectCount = 1025
       const content = 'file content'
 
       // Set-up temp directory
@@ -419,7 +388,7 @@ describe('action', () => {
       expect(runMock).toHaveReturned()
       expect(setFailedMock).toHaveBeenCalledWith(
         new Error(
-          'Too many subjects specified. The maximum number of subjects is 2500.'
+          'Too many subjects specified. The maximum number of subjects is 1024.'
         )
       )
     })

@@ -2,7 +2,11 @@ import crypto from 'crypto'
 import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'
-import { subjectFromInputs, SubjectInputs } from '../src/subject'
+import {
+  formatSubjectDigest,
+  subjectFromInputs,
+  SubjectInputs
+} from '../src/subject'
 
 describe('subjectFromInputs', () => {
   const blankInputs: SubjectInputs = {
@@ -360,3 +364,15 @@ describe('subjectFromInputs', () => {
     })
   })
 })
+
+describe('subjectDigest', () => {
+  it('returns the digest', () => {
+    const subject = {
+      name: 'foo',
+      digest: { sha1: 'deadbeef' }
+    }
+
+    const digest = formatSubjectDigest(subject)
+    expect(digest).toEqual('sha1:deadbeef')
+  })
+})