Update `gh attestation verify` table output #10104

malancas · 2024-12-19T19:48:43Z

Add more detailed signer and builder information to the table printed by default when running gh attestation verify. Currently the table will print the signer repository and workflow but the table headers do not clarify this. So if a user verifies an attestation that was signed with a reusable workflow housed in another repository or organization, this will be printed as the "repo" and "workflow", which is confusing.

cc #9850

Signed-off-by: Meredith Lancaster <malancas@github.com>

…alancas/cli into update-attestation-verify-table-output

malancas · 2025-01-08T18:56:42Z

Table output when the signer and builder repositories and workflows are identical.

malancas · 2025-01-08T18:57:43Z

Table output when the signer and builder repositories and workflows are different.
Note that the lines wrap in this screenshot. Another option would be to ditch a table view and use bullets points instead to display this information.

Signed-off-by: Meredith Lancaster <malancas@github.com>

phillmv

@malancas

🤔 🤔 🤔

What if we go EVEN SIMPLER and only show you:
id, signer workflow, build repo?

or

id, workflow run url, build repo?

(i mention attestation id here only because I assume we'll need some way to interact with them for our upcoming plans to allow attestation deletion. it's ok if we introduce it later)

Failing that, yeah, maybe it's worth trying to see how it looks as indent adjusted bullet points, eh? this will probably line wrap too often to be used reliably & truncation feels like the wrong move.

(feel free to mock this up in an editor instead of editing the code)

pkg/cmd/attestation/verify/verify.go

Co-authored-by: Phill MV <phillmv@github.com>

malancas · 2025-01-13T20:37:00Z

@malancas

🤔 🤔 🤔

What if we go EVEN SIMPLER and only show you:
id, signer workflow, build repo?

or

id, workflow run url, build repo?

(i mention attestation id here only because I assume we'll need some way to interact with them for our upcoming plans to allow attestation deletion. it's ok if we introduce it later)

Failing that, yeah, maybe it's worth trying to see how it looks as indent adjusted bullet points, eh? this will probably line wrap too often to be used reliably & truncation feels like the wrong move.

(feel free to mock this up in an editor instead of editing the code)

I'm down to just simplify it to signer workflow, build repo for now. If it's cool with you, I may introduce attestation ID later.

malancas · 2025-01-13T21:46:24Z

@phillmv I tried cutting down the table to just print the signer workflow URL and the build repo but the column headers still end up wrapping. So here is what the output looks like when we use bullet points instead:

If you like that, I'll push the changes.

phillmv · 2025-01-15T19:14:17Z

We talked about this in zoom. Let's try,

Build repo
Build workflow
Signer repo
signer workflow?
maybe a -- to sepearate n+1 attestations.

plus maybe bolding.

and just ship it, let's get it out.

Signed-off-by: Meredith Lancaster <malancas@github.com>

…alancas/cli into update-attestation-verify-table-output

malancas · 2025-01-15T21:15:37Z

The pushed changes print the output with bullet points. See the attached image

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas · 2025-01-22T20:28:26Z

Signed-off-by: Meredith Lancaster <malancas@github.com>

…alancas/cli into update-attestation-verify-table-output

malancas · 2025-01-23T16:22:21Z

phillmv

Let's ship it!

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.65.0` -> `v2.66.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.66.1`](https://github.com/cli/cli/releases/tag/v2.66.1): GitHub CLI 2.66.1 [Compare Source](cli/cli@v2.66.0...v2.66.1) #### Hotfix: `gh pr view` fails with provided URL This addresses a regression in `gh pr view` was reported in [#10352](cli/cli#10352). This regression was due to a change in `v2.66.0` that no longer allowed `gh pr` subcommands to execute properly outside of a git repo. #### What's Changed - Hotfix: `gh pr view` fails with provided URL by [@jtmcg](https://github.com/jtmcg) in cli/cli#10354 **Full Changelog**: cli/cli@v2.66.0...v2.66.1 ### [`v2.66.0`](https://github.com/cli/cli/releases/tag/v2.66.0): GitHub CLI 2.66.0 [Compare Source](cli/cli@v2.65.0...v2.66.0) #### `gh pr view` and `gh pr status` now respect common triangular workflow configurations Previously, `gh pr view` and `gh pr status` would fail for pull request's (MR) open in triangular workflows. This was due to `gh` being unable to identify the MR's corresponding remote and branch refs on GitHub. Now, `gh pr view` and `gh pr status` should successfully identify the MR's refs when the following common git configurations are used: - [`branch.<branchName>.pushremote`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-branchltnamegtpushRemote) is set - [`remote.pushDefault`](https://git-scm.com/docs/git-config#Documentation/git-config.txt-remotepushDefault) is set Branch specific configuration, the former, supersedes repo specific configuration, the latter. Additionally, if the [`@{push}` revision syntax](https://git-scm.com/docs/gitrevisions#Documentation/gitrevisions.txt-emltbranchnamegtpushemegemmasterpushemempushem) for git resolves for a branch, `gh pr view` and `gh pr status` should work regardless of additional config settings. For more information, see - cli/cli#9363 - cli/cli#9364 - cli/cli#9365 - cli/cli#9374 #### `gh secret list`, `gh secret set`, and `gh secret delete` now require repository selection when multiple `git` remotes are present Previously, `gh secret list`, `gh secret set`, and `gh secret delete` would determine which remote to target for interacting with GitHub Actions secrets. Remotes marked as default using `gh repo set-default` or through other `gh` commands had higher priority when figuring out which repository to interact with. This could have unexpected outcomes when using `gh secret` commands with forked repositories as the upstream repository would generally be selected. Now, `gh secret` commands require users to disambiguate which repository should be the target if multiple remotes are present and the `-R, --repo` flag is not provided. For more information, see cli/cli#4688 #### Extension update notices now notify once every 24 hours per extension and can be disabled Previously, the GitHub CLI would notify users about newer versions every time an extension was executed. This did not match GitHub CLI notices, which only notified users once every 24 hours and could be disabled through an environment variable. Now, extension update notices will behave similar to GitHub CLI notices. To disable extension update notices, set the `GH_NO_EXTENSION_UPDATE_NOTIFIER` environment variable. For more information, see cli/cli#9925 #### What's Changed ##### ✨ Features - Draft for discussing testing around extension update checking behavior by [@andyfeller](https://github.com/andyfeller) in cli/cli#9985 - Make extension update check non-blocking by [@andyfeller](https://github.com/andyfeller) in cli/cli#10239 - Ensure extension update notices only notify once within 24 hours, provide ability to disable all extension update notices by [@andyfeller](https://github.com/andyfeller) in cli/cli#9934 - feat: make the extension upgrade fancier by [@nobe4](https://github.com/nobe4) in cli/cli#10194 - fix: padded display by [@nobe4](https://github.com/nobe4) in cli/cli#10216 - Update `gh attestation` attestation bundle fetching logic by [@malancas](https://github.com/malancas) in cli/cli#10185 - Require repo disambiguation for secret commands by [@williammartin](https://github.com/williammartin) in cli/cli#10209 - show error message for rerun workflow older than a month ago by [@iamrajhans](https://github.com/iamrajhans) in cli/cli#10227 - Update `gh attestation verify` table output by [@malancas](https://github.com/malancas) in cli/cli#10104 - Enable MSI building for Windows arm64 by [@dennisameling](https://github.com/dennisameling) in cli/cli#10297 - feat: Add support for creating autolink references by [@hoffm](https://github.com/hoffm) in cli/cli#10180 - Find MRs using `@{push}` by [@Frederick888](https://github.com/Frederick888) in cli/cli#9208 - feat: Add support for viewing autolink references by [@hoffm](https://github.com/hoffm) in cli/cli#10324 - Update `gh attestation` bundle fetching logic by [@malancas](https://github.com/malancas) in cli/cli#10339 ##### 🐛 Fixes - gh gist delete: prompt for gist id by [@danochoa](https://github.com/danochoa) in cli/cli#10154 - Better handling for waiting for codespaces to become ready by [@cmbrose](https://github.com/cmbrose) in cli/cli#10198 - Fix: `gh gist view` and `gh gist edit` prompts with no TTY by [@mateusmarquezini](https://github.com/mateusmarquezini) in cli/cli#10048 - Remove naked return values from `ReadBranchConfig` and `prSelectorForCurrentBranch` by [@jtmcg](https://github.com/jtmcg) in cli/cli#10197 - Add job to deployment workflow to validate the tag name for a given release by [@jtmcg](https://github.com/jtmcg) in cli/cli#10121 - \[gh run list] Stop progress indicator on failure from `--workflow` flag by [@iamazeem](https://github.com/iamazeem) in cli/cli#10323 - Update deployment.yml by [@andyfeller](https://github.com/andyfeller) in cli/cli#10340 ##### 📚 Docs & Chores - Add affected version heading to bug report issue form by [@BagToad](https://github.com/BagToad) in cli/cli#10269 - chore: fix some comments by [@petercover](https://github.com/petercover) in cli/cli#10296 - Update triage.md to reflect FR experiment outcome by [@jtmcg](https://github.com/jtmcg) in cli/cli#10196 - Clear up --with-token fine grained PAT usage by [@williammartin](https://github.com/williammartin) in cli/cli#10186 - Correct help documentation around template use in `gh issue create` by [@andyfeller](https://github.com/andyfeller) in cli/cli#10208 - chore: fix some function names in comment by [@zhuhaicity](https://github.com/zhuhaicity) in cli/cli#10225 - Tiny typo fix by [@robmorgan](https://github.com/robmorgan) in cli/cli#10265 - add install instructions for Manjaro Linux by [@AMS21](https://github.com/AMS21) in cli/cli#10236 - Update test to be compatible with latest Glamour v0.8.0 by [@ottok](https://github.com/ottok) in cli/cli#10151 - Add more `gh attestation verify` integration tests by [@malancas](https://github.com/malancas) in cli/cli#10102 #####

Dependencies - Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 by [@dependabot](https://github.com/dependabot) in cli/cli#10215 - Bump github.com/sigstore/protobuf-specs from 0.3.2 to 0.3.3 by [@dependabot](https://github.com/dependabot) in cli/cli#10214 - Bump github.com/gabriel-vasile/mimetype from 1.4.7 to 1.4.8 by [@dependabot](https://github.com/dependabot) in cli/cli#10184 - Bump google.golang.org/protobuf from 1.36.2 to 1.36.3 by [@dependabot](https://github.com/dependabot) in cli/cli#10250 - Bump golangci-linter and address failures to prepare for Go 1.24 strictness by [@mikelolasagasti](https://github.com/mikelolasagasti) in cli/cli#10279 - Bump github.com/google/go-containerregistry from 0.20.2 to 0.20.3 by [@dependabot](https://github.com/dependabot) in cli/cli#10257 - Bump actions/attest-build-provenance from 2.1.0 to 2.2.0 by [@dependabot](https://github.com/dependabot) in cli/cli#10300 - Bump google.golang.org/protobuf from 1.36.3 to 1.36.4 by [@dependabot](https://github.com/dependabot) in cli/cli#10306 - Upgrade sigstore-go to v0.7.0: fixes [#10114](cli/cli#10114) formatting issue by [@codysoyland](https://github.com/codysoyland) in cli/cli#10309 - Bump github.com/in-toto/attestation from 1.1.0 to 1.1.1 by [@dependabot](https://github.com/dependabot) in cli/cli#10319 #### New Contributors Big thank you to our many new *and* longtime contributors making this release happen!! ❤️ ✨ - [@zhuhaicity](https://github.com/zhuhaicity) made their first contribution in cli/cli#10225 - [@danochoa](https://github.com/danochoa) made their first contribution in cli/cli#10154 - [@robmorgan](https://github.com/robmorgan) made their first contribution in cli/cli#10265 - [@iamrajhans](https://github.com/iamrajhans) made their first contribution in cli/cli#10227 - [@AMS21](https://github.com/AMS21) made their first contribution in cli/cli#10236 - [@petercover](https://github.com/petercover) made their first contribution in cli/cli#10296 - [@ottok](https://github.com/ottok) made their first contribution in cli/cli#10151 - [@dennisameling](https://github.com/dennisameling) made their first contribution in cli/cli#10297 - [@iamazeem](https://github.com/iamazeem) made their first contribution in cli/cli#10323 - [@Frederick888](https://github.com/Frederick888) made their first contribution in cli/cli#9208 **Full Changelog**: cli/cli@v2.65.0...v2.66.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

malancas and others added 7 commits December 19, 2024 07:18

simplify func params

ce6150d

Signed-off-by: Meredith Lancaster <malancas@github.com>

update verify output table

73cd38a

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into update-attestation-verify-table-output

eb9eb26

remove commented out code

1e91828

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into update-attestation-verify-table-output

1aa10cd

update test fixtures to include buildConfigURI

1c16e12

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'update-attestation-verify-table-output' of github.com:m…

b48471b

…alancas/cli into update-attestation-verify-table-output

malancas marked this pull request as ready for review January 8, 2025 18:58

malancas requested a review from a team as a code owner January 8, 2025 18:58

cliAutomation added the external pull request originating outside of the CLI core team label Jan 8, 2025

update table column headers

c2fdac2

Signed-off-by: Meredith Lancaster <malancas@github.com>

phillmv reviewed Jan 10, 2025

View reviewed changes

pkg/cmd/attestation/verify/verify.go Outdated Show resolved Hide resolved

Update pkg/cmd/attestation/verify/verify.go

2ddfe86

Co-authored-by: Phill MV <phillmv@github.com>

Merge branch 'trunk' into update-attestation-verify-table-output

ab26df3

malancas added 3 commits January 15, 2025 14:11

print attestation output info as bullet points instead of table

2ffce8a

Signed-off-by: Meredith Lancaster <malancas@github.com>

drop unused handler method

555c9b6

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'update-attestation-verify-table-output' of github.com:m…

4967eaf

…alancas/cli into update-attestation-verify-table-output

malancas and others added 5 commits January 15, 2025 14:17

delete unused function

6d2f71d

Signed-off-by: Meredith Lancaster <malancas@github.com>

formatting

4fb265c

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'trunk' into update-attestation-verify-table-output

423a764

add tty check

daf6354

Signed-off-by: Meredith Lancaster <malancas@github.com>

skip check

5d26f0b

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas requested a review from phillmv January 16, 2025 17:44

bold bullet point list header text

2ec70a5

Signed-off-by: Meredith Lancaster <malancas@github.com>

reorder policy enforcement criteria print out

5f6e720

Signed-off-by: Meredith Lancaster <malancas@github.com>

malancas and others added 3 commits January 22, 2025 13:28

Merge branch 'trunk' into update-attestation-verify-table-output

6d48557

remove bolding from bullet point output

4134f96

Signed-off-by: Meredith Lancaster <malancas@github.com>

Merge branch 'update-attestation-verify-table-output' of github.com:m…

5624ed8

…alancas/cli into update-attestation-verify-table-output

phillmv approved these changes Jan 23, 2025

View reviewed changes

malancas merged commit c0c1618 into cli:trunk Jan 23, 2025

malancas deleted the update-attestation-verify-table-output branch May 28, 2025 22:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update `gh attestation verify` table output #10104

Update `gh attestation verify` table output #10104

Uh oh!

malancas commented Dec 19, 2024 •

edited

Loading

Uh oh!

malancas commented Jan 8, 2025

Uh oh!

malancas commented Jan 8, 2025

Uh oh!

phillmv left a comment

Uh oh!

Uh oh!

malancas commented Jan 13, 2025

Uh oh!

malancas commented Jan 13, 2025 •

edited

Loading

Uh oh!

phillmv commented Jan 15, 2025

Uh oh!

malancas commented Jan 15, 2025

Uh oh!

malancas commented Jan 22, 2025

Uh oh!

malancas commented Jan 23, 2025

Uh oh!

phillmv left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Update gh attestation verify table output #10104

Update gh attestation verify table output #10104

Uh oh!

Conversation

malancas commented Dec 19, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

malancas commented Jan 8, 2025

Uh oh!

malancas commented Jan 8, 2025

Uh oh!

phillmv left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

malancas commented Jan 13, 2025

Uh oh!

malancas commented Jan 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

phillmv commented Jan 15, 2025

Uh oh!

malancas commented Jan 15, 2025

Uh oh!

malancas commented Jan 22, 2025

Uh oh!

malancas commented Jan 23, 2025

Uh oh!

phillmv left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Update `gh attestation verify` table output #10104

Update `gh attestation verify` table output #10104

malancas commented Dec 19, 2024 •

edited

Loading

malancas commented Jan 13, 2025 •

edited

Loading