Skip to content

feat(pipelines): add git-archive built-in for local monorepo sources - #2549

Draft
astrojerms wants to merge 7 commits into
chainguard-dev:mainfrom
astrojerms:feat/git-archive-local-source
Draft

feat(pipelines): add git-archive built-in for local monorepo sources#2549
astrojerms wants to merge 7 commits into
chainguard-dev:mainfrom
astrojerms:feat/git-archive-local-source

address review: injection hardening, branch semantics, test-pipeline …

94e2476
Select commit
Loading
Failed to load commit list.
Chainguard Guardener / Enforce - Commit Signing succeeded Jul 2, 2026 in 1s

Successfully verified commit signature.

CLAIM DESCRIPTION
Found Git signature
Validated Git signature
Validated Rekor entry
Allowed by policy

Details

Certificate

Details
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 423334497166525660173230872971360509503756846300 (0x4a26f9b2d19085980771c6c9884173dc74e044dc)
    Signature Algorithm: ECDSA-SHA384
        Issuer: O=sigstore.dev,CN=sigstore-intermediate
        Validity
            Not Before: Jul 2 01:43:24 2026 UTC
            Not After : Jul 2 01:53:24 2026 UTC
        Subject:         Subject Public Key Info:
            Public Key Algorithm: ECDSA
                Public-Key: (256 bit)
                X:
                    83:7b:14:70:e6:c3:ff:9b:ed:c0:75:58:42:eb:28:
                    d4:72:7d:f9:59:a1:d9:de:c4:33:77:71:83:b4:d9:
                    d4:7b
                Y:
                    72:16:0d:75:ea:e9:0a:a7:f4:3a:73:39:eb:75:86:
                    d4:1d:02:7c:ee:43:b4:bf:0a:61:dd:ac:b9:e4:33:
                    70:ae
                Curve: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 Subject Key Identifier:
                B5:73:69:6F:D3:29:68:B3:8D:25:9A:11:43:59:0E:2F:07:71:E7:C5
            X509v3 Authority Key Identifier:
                keyid:DF:D3:E9:CF:56:24:11:96:F9:A8:D8:E9:28:55:A2:C6:2E:18:64:3F
            X509v3 Subject Alternative Name: critical
                email:jeremy.harrington@chainguard.dev
            oidcIssuer:
                https://accounts.google.com
            Unknown extension 1.3.6.1.4.1.57264.1.8
            Unknown extension 1.3.6.1.4.1.57264.1.24
            Signed Certificate Timestamp:
                BHoAeAB2AN09MGrGxxEyYxkeHJlnNwKiSl643jyt/4eKcoAvKe6OAAABnyB+vBkAAAQDAEcwRQIhAP7VCxSD34uITNoiCOYc8/rrpaWcWiJ3BXGkPrL0PJaHAiAEQ6XRRp7HPS1ZIC2M0R60g7UnS/dmml3y6REft22j8w==

    Signature Algorithm: ECDSA-SHA384
         30:66:02:31:00:e1:22:2d:66:d4:c4:c9:d0:de:fd:0c:5d:0f:
         61:5c:60:88:4a:72:c6:3d:27:21:1a:0e:ae:d8:19:dc:f8:be:
         ff:78:fd:4a:f5:fe:0d:70:24:19:f9:41:3b:c7:96:2d:cc:02:
         31:00:ba:13:9e:80:1a:f5:c4:d2:b7:28:93:24:a6:48:58:30:
         05:ee:8b:57:cd:ac:27:46:c3:bd:b8:49:74:5b:89:58:59:c8:
         16:be:f7:b0:0e:5c:57:54:45:b8:98:51:e1:3b

Rekor Entry

Details
{
  "body": "eyJhcGlWZXJzaW9uIjoiMC4wLjEiLCJraW5kIjoiaGFzaGVkcmVrb3JkIiwic3BlYyI6eyJkYXRhIjp7Imhhc2giOnsiYWxnb3JpdGhtIjoic2hhMjU2IiwidmFsdWUiOiI0MGY4MDQ3ZGY2MDkwNDE4MzYxMzJlNzVkOGE0ZjljMDYyYmJhYWQ5OTcyMjBmYWE0YmE3OGZlNmY1ZmMyN2NiIn19LCJzaWduYXR1cmUiOnsiY29udGVudCI6Ik1FVUNJSEdaWUNIa1FQenVyL1RlcGVVZVhDSytaZ3VOczV3VzZ6a1J1bTloWmoyV0FpRUFzUTdsWHhjUmErSEpZcHd2U0M2cEsxWWtSbWZ0anZYeW1ueituU3Myc2FjPSIsInB1YmxpY0tleSI6eyJjb250ZW50IjoiTFMwdExTMUNSVWRKVGlCRFJWSlVTVVpKUTBGVVJTMHRMUzB0Q2sxSlNVUk9la05EUVhKNVowRjNTVUpCWjBsVlUybGlOWE4wUjFGb1dtZElZMk5pU21sRlJub3pTRlJuVWs1M2QwTm5XVWxMYjFwSmVtb3dSVUYzVFhjS1RucEZWazFDVFVkQk1WVkZRMmhOVFdNeWJHNWpNMUoyWTIxVmRWcEhWakpOVWpSM1NFRlpSRlpSVVVSRmVGWjZZVmRrZW1SSE9YbGFVekZ3WW01U2JBcGpiVEZzV2tkc2FHUkhWWGRJYUdOT1RXcFpkMDU2UVhsTlJFVXdUWHBKTUZkb1kwNU5hbGwzVG5wQmVVMUVSVEZOZWtrd1YycEJRVTFHYTNkRmQxbElDa3R2V2tsNmFqQkRRVkZaU1V0dldrbDZhakJFUVZGalJGRm5RVVZuTTNOVlkwOWlSQzgxZG5SM1NGWlpVWFZ6YnpGSVNqa3JWbTFvTW1RM1JVMHpaSGdLWnpkVVdqRklkSGxHWnpFeE5uVnJTM0F2VVRaamVtNXlaRmxpVlVoUlNqZzNhMDh3ZG5kd2FETmhlVFUxUkU1M2NuRlBRMEZrYzNkblowaFlUVUUwUndwQk1WVmtSSGRGUWk5M1VVVkJkMGxJWjBSQlZFSm5UbFpJVTFWRlJFUkJTMEpuWjNKQ1owVkdRbEZqUkVGNlFXUkNaMDVXU0ZFMFJVWm5VVlYwV0U1d0NtSTVUWEJoVEU5T1NscHZVbEV4YTA5TWQyUjROVGhWZDBoM1dVUldVakJxUWtKbmQwWnZRVlV6T1ZCd2VqRlphMFZhWWpWeFRtcHdTMFpYYVhocE5Ga0tXa1E0ZDB4bldVUldVakJTUVZGSUwwSkRVWGRKYjBWbllXMVdlVnBYTVRWTWJXaG9ZMjVLY0dKdFpEQmlNalZCV1RKb2FHRlhOVzVrVjBaNVdrTTFhd3BhV0ZsM1MxRlpTMHQzV1VKQ1FVZEVkbnBCUWtGUlVXSmhTRkl3WTBoTk5reDVPV2haTWs1MlpGYzFNR041Tlc1aU1qbHVZa2RWZFZreU9YUk5RM05IQ2tOcGMwZEJVVkZDWnpjNGQwRlJaMFZJVVhkaVlVaFNNR05JVFRaTWVUbG9XVEpPZG1SWE5UQmplVFZ1WWpJNWJtSkhWWFZaTWpsMFRVWnpSME5wYzBjS1FWRlJRbWMzT0hkQlVtZEZWRkY0VEZFeWFGWmxSVEZWVjFoc1RsSkZSWGhVTVZKS1RrVXhSVkpVVWxCV1IzUXpWRzV3Vm1WRk1UWlNWazVKVFcxbmR3cGFSV2hEWldzNWNGWlliRk5oVmxZMVZXMHhSMkZzYTNsUFZFWnBZbXhLTmxSSE1XdGtiVWw1V2toT1lWVjZWbkZaYWtsM1RVbEhTMEpuYjNKQ1owVkZDa0ZrV2pWQloxRkRRa2gzUldWblFqUkJTRmxCTTFRd2QyRnpZa2hGVkVwcVIxSTBZMjFYWXpOQmNVcExXSEpxWlZCTE15OW9OSEI1WjBNNGNEZHZORUVLUVVGSFprbElOamhIVVVGQlFrRk5RVko2UWtaQmFVVkJMM1JWVEVaSlVHWnBOR2hOTW1sSlNUVm9lbm9yZFhWc2NGcDRZVWx1WTBaallWRXJjM1pST0Fwc2IyTkRTVUZTUkhCa1JrZHVjMk01VEZacloweFplbEpJY2xORWRGTmtURGt5WVdGWVpreHdSVklyTTJKaFVIcE5RVzlIUTBOeFIxTk5ORGxDUVUxRUNrRXlhMEZOUjFsRFRWRkVhRWxwTVcweFRWUktNRTQzT1VSR01GQlpWbmhuYVVWd2VYaHFNRzVKVW05UGNuUm5Xak5RYVNzdk0ybzVVM1pZSzBSWVFXc0tSMlpzUWs4NFpWZE1ZM2REVFZGRE5rVTFOa0ZIZGxoRk1ISmpiMnQ1VTIxVFJtZDNRbVUyVEZZNE1uTktNR0pFZG1Kb1NtUkdkVXBYUm01SlJuSTNNd3B6UVRWalZqRlNSblZLYUZJMFZITTlDaTB0TFMwdFJVNUVJRU5GVWxSSlJrbERRVlJGTFMwdExTMEsifX19fQ==",
  "integratedTime": 1782956604,
  "logID": "c0d23d6ad406973f9559f3ba2d1ca01f84147d8ffc5b8445c224f98b9591801d",
  "logIndex": 2043559609,
  "verification": {
    "inclusionProof": {
      "checkpoint": "rekor.sigstore.dev - 1193050959916656506\n1921655980\n71FfPVSVRp5J3gOsxHQW1ghcVw9AaKBSYs9ANqZ/H0A=\n\n— rekor.sigstore.dev wNI9ajBFAiEA+fHkDm+NSycbY9ikfZri5//0wpHu0t24PfVGPTtcPMACIAkxM2KGADBvRNC2hbJSeZUqcjSxxZ5qn5yh/jRCLBJl\n",
      "hashes": [
        "f9fab6f2909c4cb4ab3b796af1923757a8699c7d6f1b62d4ecc5ac70c935f161",
        "d3ef2c9ecd8163e787a87211857fd7d74c40451f0a6c0e68e5951904e8453875",
        "b37d82378ee002e942767468c5a8c378fcba50e4434d0e1f6a4aa2bf771b7708",
        "9a88c3fcddc52fbfd8eb9957e2ac31761a5a9575ee51497ae7d8d2afff4fc370",
        "fede80d25fc36ed469eaa2209813370fb284d5424aeb23762c0e9070985d70b9",
        "d3a891d15d55df45625561de3d14a46d5a30cee8881a496b59f3bde8686b9588",
        "2d13f5ebc585413d77a1369553e20e14a72ab7acd3bb17a85f695e3b5920c1a7",
        "fe24df423b948d391b26d274269c8773d2de4c9e773692af880a1582e5c161c8",
        "2daad0f4f06b45cbefbbfcef731a82b387e9915d0ff95ce561acd6aab361abd9",
        "b80756b96bf38ea6a158e04719de5d6043ef89da7b5bf4550c0a1278dc09dff2",
        "573435cf963361d3ee3b92f90d9156531fffbd915100269a8edd61162347ae7a",
        "1c0c86ca619d58ce892bbed9a21bbf0b1b12b591a2809704a4dbecc80f338193",
        "adcab4d297db1b0a2b77be8d1b03cd68142e1272e2f62cd21864c0ddb39d9a00",
        "10fdfa66d5c46e788f86f768994f8dafc95738c8fd05fc4ac09e2737a304e6e2",
        "418b352efbd48e2cf22bb8cac98d8c26001bfcba375fff6e491298fa27ad788f",
        "2ccec5e62c1b93c8c6dbd5f8170a6408de81a8309fb8d413973e42c905adf3bb",
        "fbf559e7a32c20fc4c8b22c0a1dcca5e8e53116750a77eb3f3da8b869ce5a00a",
        "75ac6665a6a3469655f89c4788e61984906248a379b9caa38765a719b1e18abc",
        "0ce09ea12328bc8bcb13192122f8aca30f40b8d5e0796b3810293247a11ca985"
      ],
      "logIndex": 1921655347,
      "rootHash": "ef515f3d5495469e49de03acc47416d6085c570f4068a05262cf4036a67f1f40",
      "treeSize": 1921655980
    },
    "signedEntryTimestamp": "MEQCIE4MsRnvp6LA3YpVsOEolzE06irJTLvhLQ+QWnhl7VYLAiAmjDDIwPPFLlx7ybo1jgIWeTIwBgXsmTwDOTqFpXlOnA=="
  }
}