feat: Record the vars context.

[ianlewis]

Summary

Records the GitHub vars context in the SLSA invocation in all generators and builders.

generic generator, container generator, Go builder

The vars context is passed to the "builder" binary as a JSON blob via the GITHUB_VARS environment variable. The values are then recorded in the invocation.parameters.vars field of the provenance predicate. Masking of inputs or vars is not supported.

BYOB

The vars context is converted to JSON and passed to setup-generic by the TRW in the same way that the inputs context is added. Vars are then recorded in the SLSA token. Individual vars can be masked from the provenance as well via the slsa-masked-vars field in the same way as inputs.

verify-token reads the vars from the SLSA token and includes them in the final provenance.

Note that changes to the TRW are necessary to record the vars context.

TODO:

• Record vars in generic generator (actions run , test release)
• Record vars in container generator
• Record vars in Go builder
• Support recording vars in BYOB
• Record vars in npm builder
• Record vars in maven builder
• Record vars in gradle builder
• Record vars in bazel builder
• Document changes for TRWs

Updates #1555

Testing Process

• Add how to test.

Checklist

• Review the contributing guidelines
• Add a reference to related issues in the PR description.
• Update documentation if applicable (added [docs] Add inputs to provenance examples #3627 to track)
• Add unit tests if applicable.
• Add changes to the CHANGELOG if applicable.

[ianlewis]

Probably can split this into two PRs. One for the generic generator, container generator, and Go builder. One for BYOB and BYOB workflows. Each PR wouldn't really depend on the other.

[ianlewis]

Requiring changes to TRW inputs isn't ideal. Currently we need the TRW to pass the vars context to setup-generic because JavaScript actions don't have access to the vars context like they do for inputs (inputs are set to environment variables but vars aren't).

I wonder if I could create a wrap the current action in a composite action to get access to the vars context without needing it to be passed in an input.

[ianlewis]

I wonder if I could create a wrap the current action in a composite action to get access to the vars context without needing it to be passed in an input.

Looks like this won't work since the vars context isn't available to composite actions. I guess it's only available in workflows.

[ianlewis]

Breaking up this PR into multiple PRs. First of which is #3633 for the generic generator, container generator, and Go builder.

[ianlewis]

Recording vars for BYOB implemented in #3636. Closing this PR.