Struct GitHubSource 

pub struct GitHubSource { /* private fields */ }

GitHub source for fetching artifact attestations from GitHub’s API

Implementations

impl GitHubSource

pub fn new( owner: impl Into<String>, repo: impl Into<String>, token: Option<&str>, ) -> Result<Self>

Create a new GitHubSource targeting https://api.github.com.

pub fn with_base_url( owner: impl Into<String>, repo: impl Into<String>, token: Option<&str>, base_url: &str, ) -> Result<Self>

Create a new GitHubSource targeting a custom API base URL (e.g. a GitHub Enterprise Server instance such as https://github.enterprise.com/api/v3).

pub fn with_client( owner: impl Into<String>, repo: impl Into<String>, client: AttestationClient, ) -> Self

Create a new GitHubSource from an already-built AttestationClient, allowing the caller to configure the HTTP client (base URL, token, etc.) independently.

pub fn builder() -> GitHubSourceBuilder

Start building a GitHubSource with a fluent builder.

Trait Implementations

impl AttestationSource for GitHubSource

fn fetch_attestations<'life0, 'life1, 'async_trait>( &'life0 self, artifact: &'life1 ArtifactRef, ) -> Pin<Box<dyn Future<Output = Result<Vec<Attestation>>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Fetch attestations for an artifact from the configured GitHub API.

Note: this filters the GitHub API response to SLSA provenance v1 (https://slsa.dev/provenance/v1) because GitHubSource is intended for SLSA verification via the generic verify_artifact + SlsaVerifier flow. Callers who need the unfiltered attestation set (e.g. non-SLSA bundles such as SPDX SBOMs) should use crate::verify_github_attestation / crate::verify_github_attestation_with_base_url, which send no predicate filter, or drive AttestationClient directly.

fn source_type(&self) -> &'static str

Get the source type name for logging