update

Signed-off-by: laurentsimon <[email protected]>

.github/workflows/release.yml

@@ -0,0 +1,21 @@
+name: CLI release
+
+on:
+  # For manual tests.
+  workflow_dispatch:
+  push:
+    tags:
+      - "*" # triggers only if push new tag version, like `0.8.4` or else
+
+permissions: read-all
+
+jobs:
+  evaluator:
+    permissions:
+      id-token: write # For signing.
+      contents: write # For asset uploads.
+      actions: read # For the entrypoint.
+    uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
+    with:
+      go-version-file: "./cmd/evaluator/go.mod"
+      config-file: .github/workflows/release/slsa-evaluator.yml

.github/workflows/release/slsa-evaluator.yml

@@ -0,0 +1,36 @@
+# Version for this file.
+version: 1
+
+# (Optional) List of env variables used during compilation.
+env:
+  - GO111MODULE=on
+  - CGO_ENABLED=0
+
+# (Optional) Flags for the compiler.
+flags:
+  - -trimpath
+  - -tags=netgo
+
+# The OS to compile for. `GOOS` env variable will be set to this value.
+goos: linux
+
+# The architecture to compile for. `GOARCH` env variable will be set to this value.
+goarch: amd64
+
+# (Optional) Entrypoint to compile.
+# main: ./path/to/main.go
+
+# (Optional) Working directory. (default: root of the project)
+dir: ./cmd/evaluator
+
+# Binary output name.
+# {{ .Os }} will be replaced by goos field in the config file.
+# {{ .Arch }} will be replaced by goarch field in the config file.
+binary: binary-{{ .Os }}-{{ .Arch }}
+
+# (Optional) ldflags generated dynamically in the workflow, and set as the `evaluated-envs` input variables in the workflow.
+# ldflags:
+#   - "-X main.Version={{ .Env.VERSION }}"
+#   - "-X main.Commit={{ .Env.COMMIT }}"
+#   - "-X main.CommitDate={{ .Env.COMMIT_DATE }}"
+#   - "-X main.TreeState={{ .Env.TREE_STATE }}"

cmd/evaluator/internal/release/evaluate/evaluate.go

@@ -15,7 +15,7 @@ import (
 
 func usage(cli string) {
 	msg := "" +
-		"Usage: %s release evaluate orgPath projectsPath packageName creatorID [optional:environment]\n" +
+		"Usage: %s release evaluate orgPath projectsPath packageName [optional:environment]\n" +
 		"\n" +
 		"Example:\n" +
 		"%s release evaluate ./path/to/policy/org ./path/to/policy/projects laurentsimon/echo-server@sha256:xxxx prod\n" +
@@ -42,7 +42,7 @@ func Run(cli string, args []string) error {
 	if len(args) == 4 && args[3] != "" {
 		// Only set the env if it's not empty.
 		env = new(string)
-		*env = args[34]
+		*env = args[3]
 	}
 	digestsArr := strings.Split(digest, ":")
 	if len(digestsArr) != 2 {