chore(config): standardize action mappings in artifact-retention.yml #487
+39
−7
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add sbom_reports to the compliance artifact retention tier (365 days) in artifact-retention.yml with SHA-pinned action references for anchore/sbom-action@v0.22.2 and actions/attest-sbom@v2.4.0. - Add sbom_reports artifact type with 365-day retention - Add sbom_reports to compliance required_artifacts list - Add sbom_reports compression setting in github_actions section - tool-checksums.json not updated (tracks binary tools, not GH Actions) Closes microsoft#453 Part of microsoft#256
Extract the actions: sub-schema from sbom_reports into a dedicated top-level action_mappings: section. This maps GitHub Actions to the artifact types they produce with SHA-pinned references for traceability. Artifact types covered: - security_reports: codeql-action, scorecard-action, dependency-review-action - build_artifacts: upload-artifact, attest-build-provenance - test_results: codecov-action - sbom_reports: sbom-action, attest-sbom All SHAs match the pins currently used in workflow files. Closes microsoft#483
3 tasks
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #487 +/- ##
==========================================
- Coverage 83.41% 83.39% -0.03%
==========================================
Files 20 20
Lines 3510 3510
==========================================
- Hits 2928 2927 -1
- Misses 582 583 +1
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
WilliamBerryiii
approved these changes
Feb 13, 2026
Member
WilliamBerryiii
left a comment
WilliamBerryiii
left a comment
There was a problem hiding this comment.
Once you resolve the conflicts, we'll get this merged. Thanks so much for taking this on!
Keep sbom_reports actions in the top-level action_mappings section (introduced by this PR) and remove the inline actions block that was re-added on main.
Contributor
Author
|
Done！ |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Standardize the
actions:sub-schema introduced in #479 by extracting it into a dedicated top-levelaction_mappings:section, as proposed in #483.Approach
Chose Option B from #483 — extract to a separate section. This keeps artifact type definitions uniform (all follow the same retention_days/description/compression_level pattern) while providing a centralized place for action-to-artifact traceability.
Changes
.github/artifact-retention.ymlactions:block fromsbom_reportsartifact typeaction_mappings:section mapping GitHub Actions to their artifact types:security_reportsgithub/codeql-action/analyze,github/codeql-action/upload-sarif,ossf/scorecard-action,actions/dependency-review-actionbuild_artifactsactions/upload-artifact,actions/attest-build-provenancetest_resultscodecov/codecov-actionsbom_reportsanchore/sbom-action,actions/attest-sbomAll SHAs match the pins currently used in workflow files.
Validation
Test-DependencyPinning.ps1— 100% complianceCloses #483
Depends on #479