Action defaults to Sigstore/Fulcio even when file-based signing is configured

[colek42]

Description

The witness-run-action (v0.3.3) attempts to use Sigstore/Fulcio for signing even when signer-file-key-path is explicitly configured for file-based signing. This causes the action to fail when ACTIONS_ID_TOKEN_REQUEST_URL is not set, despite file-based signing not requiring OIDC tokens.

Steps to Reproduce

1. Configure workflow with file-based signing:

- name: Run tests with witness attestation
  uses: testifysec/witness-run-action@v0.3.3
  with:
    step: test
    attestations: "github git environment"
    command: go test -v ./...
    signer-file-key-path: witness-key.pem
    attestor-github-jwks-url: "http://host.docker.internal:8081/.well-known/jwks"

2. Run the workflow in an environment without Sigstore/Fulcio OIDC setup

Actual Behavior

The action fails with:

level=error msg="failed to create fulcio signer: ACTIONS_ID_TOKEN_REQUEST_URL is not set"
level=error msg="failed to load signers: failed to load any signers"
Error: The process '/usr/bin/sh' failed with exit code 1

Expected Behavior

When signer-file-key-path is configured, the action should use file-based signing and not attempt to initialize Fulcio/Sigstore signers. File-based signing should not require ACTIONS_ID_TOKEN_REQUEST_URL or other OIDC-related environment variables.

Environment

• Action version: v0.3.3
• Runner: nektos/act (local GitHub Actions runner)
• OS: Linux (ubuntu-latest container)

Workaround

Currently using witness binary directly instead of the action wrapper:

- name: Install witness
  run: |
    # Download and install witness binary
    
- name: Run tests with witness attestation
  run: |
    ./witness run \
      --step test \
      --attestations github,git,environment \
      --signer-file-key-path witness-key.pem \
      --attestor-github-jwksurl http://host.docker.internal:8081/.well-known/jwks \
      --outfile test.att \
      -- go test -v ./...

This works correctly and respects file-based signing without requiring Sigstore/Fulcio.

Suggested Fix

The action should:

1. Check if signer-file-key-path is provided
2. If yes, skip Fulcio/Sigstore signer initialization
3. Only initialize Fulcio/Sigstore signers when explicitly requested or when no other signer is configured

Additional Context

This issue was discovered while building an attestation dataset generation framework for machine learning pipelines that uses local file-based signing with a mock GitHub OIDC server for testing purposes.