[ronens88]

Summary

Adds a kms input to cimon-action/attest for signing provenance with a KMS key. HashiCorp Vault transit is the supported backend: kms: vault://<key-name>, with the Vault connection in the job's VAULT_ADDR and VAULT_TOKEN environment variables.

- uses: cycodelabs/cimon-action/attest@v1
  env:
    VAULT_ADDR: https://vault.example.com:8200
    VAULT_TOKEN: ${{ secrets.VAULT_TOKEN }}
  with:
    subjects: dist/my-app
    kms: vault://cimon-signing
    include-timestamp: true
    timestamp-server-url: http://timestamp.sectigo.com
    fail-on-error: true

Changes

• attest/action.yml: new kms input. include-timestamp and timestamp-server-url descriptions now cover KMS signing.
• attest/index.js:
  • forwards kms as --kms;
  • forwards --include-timestamp=true and --timestamp-server-url for KMS signing when include-timestamp is true, the same rule as for sign-key;
  • uploads the signed provenance artifact for KMS signing as it does for sign-key.
• attest/README.md: KMS signing section with the Vault variables, transit mount and key types, how verifiers get the public key, and the new row in the inputs table.

attest/dist/index.js is rebuilt with ncc 0.38.4, matching the workflow's output, and committed.

Rebuild attest dist workflow

Folded in from #136. The rebuild-dist job checks out the PR head SHA, so the working copy is a detached HEAD, and the bare git push in its auto-commit step failed with fatal: You are not currently on a branch (seen on this PR's first run).

• The auto-commit step pushes to the PR branch by name, leased on the PR head SHA the run built from: git push --force-with-lease="refs/heads/$PR_HEAD_REF:$PR_HEAD_SHA" origin "HEAD:refs/heads/$PR_HEAD_REF". Both values come from github.event.pull_request.head through env:. The push lands only while the branch still points at that SHA; if it moved forward, was reset to an earlier commit, or was deleted during the run, the push is rejected.
• The workflow also runs when .github/workflows/build-attest-dist.yaml changes, so edits to it are exercised on their own PR.
• The fork guard and the "exactly one changed file" check are unchanged.

The step script was extracted from the workflow and run against a local bare remote, checked out at a detached PR head with the bundle rebuilt:

The previous step exits 128 (You are not currently on a branch) whenever the bundle needs a commit, whatever the branch state. With this change:

Case	Result
PR branch unchanged	exit 0, bot commit pushed on top of the PR head
PR branch moved forward	rejected (stale info), branch unchanged
PR branch reset to an earlier commit	rejected, branch unchanged; a push without the lease lands here
PR branch deleted	rejected, branch stays deleted; a push without the lease recreates it
Bundle already in sync	exit 0, dist already up to date

On this PR the bundle is already in sync, so the workflow exits early. The push path runs on the next PR that changes attest/index.js without committing the bundle. A push made with GITHUB_TOKEN does not start new workflow runs, so the bot commit carries no checks of its own; push another commit or re-run the workflows if checks are needed on it.

Compatibility

The kms input requires cimon v1.0.28 or later. The action installs the latest cimon release at runtime, so this should merge once v1.0.28 is published. Workflows that do not set kms are unaffected. The workflow fix does not depend on the cimon release.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-26T12:24:38.866400Z	8181d81	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8181d81b71

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".