Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

Copilot
Copy link
Contributor

@Copilot Copilot AI commented Oct 22, 2025

Per: #11993

What Changed

Updated both gh release verify and gh release verify-asset commands to retrieve attestations using the release predicate sentinel value "release" instead of the explicit predicate type string "https://in-toto.io/attestation/release/v0.1".

Why

The GitHub Attestation API supports a sentinel value "release" for the predicate type parameter, which allows the API to return attestations with any release predicate version (v0.1, v0.2, etc.) in a single request. This makes the CLI more resilient to future predicate version updates without requiring code changes.

Previously, the commands were hardcoded to fetch only v0.1 release predicates, which would miss any attestations created with newer predicate versions.

Changes

  • pkg/cmd/release/verify/verify.go: Line 138 - Changed PredicateType from shared.ReleasePredicateType to "release"
  • pkg/cmd/release/verify-asset/verify_asset.go: Line 150 - Changed PredicateType from shared.ReleasePredicateType to "release"
  • pkg/cmd/attestation/api/mock_client.go: Added support for the "release" sentinel value in test mocks

Testing

All existing tests pass, including:

  • pkg/cmd/release/verify tests
  • pkg/cmd/release/verify-asset tests
  • pkg/cmd/attestation/api tests

The mock client was updated to properly simulate the GitHub API's behavior when receiving the sentinel value.

Fixes the issue described in https://github.com/cli/cli/blob/trunk/pkg/cmd/release/verify/verify.go#L138 and https://github.com/cli/cli/blob/trunk/pkg/cmd/release/verify-asset/verify_asset.go#L150

Original prompt

This section details on the original issue you should resolve

<issue_title>gh release Verification with Sentinel</issue_title>
<issue_description>## What?
Update both the gh release verify and gh release verify-asset commands to retrieve attestations using the release predicate sentinel value "release" instead of using an explicit predicate type string. This will allow us to retrieve both v0.1 and v0.2 release predicates in the same request.

Relevant lines of code are:

Comments on the Issue (you are @copilot in this section)

Fixes github/package-security#3724


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@Copilot Copilot AI changed the title [WIP] Update gh release verify commands for sentinel value Use "release" sentinel value for release attestation verification Oct 22, 2025
@Copilot Copilot AI requested a review from bdehamer October 22, 2025 15:30
Copilot finished work on behalf of bdehamer October 22, 2025 15:30
Signed-off-by: Brian DeHamer <[email protected]>
@bdehamer bdehamer marked this pull request as ready for review October 22, 2025 16:12
@bdehamer bdehamer requested a review from a team as a code owner October 22, 2025 16:12
@Copilot Copilot AI review requested due to automatic review settings October 22, 2025 16:12
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the gh release verify and gh release verify-asset commands to use the "release" sentinel value instead of the hardcoded predicate type URL when fetching attestations. This change makes the CLI version-agnostic and able to retrieve release attestations regardless of their predicate version (v0.1, v0.2, etc.) without requiring code changes for future versions.

Key Changes:

  • Updated predicate type parameter from explicit URL to "release" sentinel value in both verify commands
  • Removed the now-unused ReleasePredicateType constant
  • Updated mock client to simulate the API's sentinel value behavior

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
pkg/cmd/release/verify/verify.go Changed predicate type from constant to "release" sentinel
pkg/cmd/release/verify-asset/verify_asset.go Changed predicate type from constant to "release" sentinel
pkg/cmd/release/shared/attestation.go Removed unused ReleasePredicateType constant
pkg/cmd/attestation/api/mock_client.go Updated mock to handle "release" sentinel value

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Copy link
Contributor

@ejahnGithub ejahnGithub left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@bdehamer bdehamer merged commit 9571971 into trunk Oct 23, 2025
12 checks passed
@bdehamer bdehamer deleted the copilot/update-gh-release-verification branch October 23, 2025 16:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants