Skip to content
Draft
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -253,10 +253,6 @@ the specific image being attested is identified by the supplied digest.
Attestation bundles are stored in the OCI registry according to the [Cosign
Bundle Specification][10].

If the `push-to-registry` option is set to true, the Action will also
emit an Artifact Metadata Storage Record. If you do not want to emit a
storage record, set `create-storage-record` to `false`.

> **NOTE**: When pushing to Docker Hub, please use "index.docker.io" as the
> registry portion of the image name.

Expand Down Expand Up @@ -304,6 +300,23 @@ jobs:
push-to-registry: true
```

#### Artifact Metadata Storage Records

If the `push-to-registry` option is set to true, the Action will also
emit an [Artifact Metadata Storage Record](https://docs.github.com/en/rest/orgs/artifact-metadata?apiVersion=2022-11-28#create-artifact-metadata-storage-record).
Storage records enrich artifact metadata by capturing storage
related details, such as which registry an image is hosted on
and whether it's marked as active.

If you do not want to emit a storage record, set `create-storage-record` to `false`.

> **NOTE**: Storage records can only be created for artifacts
> built from organization owned repositories.

All artifacts with storage records are available for view by navigating to
the `Linked Artifacts` page in your organization by navigating to
`https://github.com/orgs/<myorg>/artifacts`

### Integration with `actions/upload-artifact`

If you'd like to create an attestation for an archive created with the
Expand Down