actions/attest-build-provenance

Conditionally ovewrite attestations

Opened this issue · 0 comments

This might be tricky if the attestation store is append-only but, in the case of a rolling tag (let's name it early-access) which moves on a given period (let's say every push to main) the associated release points to the latest artifacts.

At the moment the attestations tab contains all attested artifacts according to the timeline, even if the artifact names are identical, see for example

https://github.com/jreleaser/jreleaser/attestations/1014782
https://github.com/jreleaser/jreleaser/attestations/1013783

In specific case for JReleaser's early-access release the tag & release overwrite any previously existing tag & release, thus there's only one active version of artifacts related to early-access. It would be good if attestations could also be overwritten. Due to the nature of attestations I suppose this behavior (if provided) should be guarded by a conditional flag and disabled by default.