Skip to content

Add examples for using use-witness with environment variables as emergency escape valve - #45

Draft
kriscoleman with Copilot wants to merge 2 commits into
mainfrom
copilot/add-examples-use-witness
Draft

Add examples for using use-witness with environment variables as emergency escape valve#45
kriscoleman with Copilot wants to merge 2 commits into
mainfrom
copilot/add-examples-use-witness

Conversation

Copilot AI commented Nov 10, 2025

Copy link
Copy Markdown

Provides documentation and examples for the use-witness parameter to quickly disable witness attestation during service outages (e.g., Fulcio down) without requiring a pull request.

Changes

Examples added (examples/ directory):

  • use-witness-with-env-var.yml - Basic repository variable pattern
  • emergency-disable-witness.yml - Multi-job emergency disable pattern
  • advanced-witness-control.yml - Fork-aware, branch-specific, and combined logic patterns
  • README.md - Setup instructions, use cases, best practices, and troubleshooting

Main README updated:

  • Added "Conditional Attestation with use-witness" section
  • Emergency disable procedure (set repository variable → immediate effect)
  • Link to examples

Usage

Control witness attestation via repository variable (Settings → Secrets and variables → Actions → Variables):

jobs:
  build:
    uses: testifysec/witness-run-action/.github/workflows/witness.yml@main
    with:
      # Disable by setting WITNESS_ENABLED='false' in repository settings
      use-witness: ${{ vars.WITNESS_ENABLED != 'false' }}
      step: build
      attestations: "git github environment"
      command: make build

Defaults to enabled when variable is unset. Change variable value to disable globally across all workflows without code changes.

Original prompt

This section details on the original issue you should resolve

<issue_title>chore: provide examples for users to use use-witness</issue_title>
<issue_description>provide examples for users to use use-witness with a env var configured for the action.

this is an escape valve for non-transient errors that might occur when using witness-run-action

for instance, if the public fulcio goes down, or something else downstream, this can be used to quickly disable witness without a pull request to unblock pipelines. </issue_description>

Comments on the Issue (you are @copilot in this section)


💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

Co-authored-by: kriscoleman <21978023+kriscoleman@users.noreply.github.com>
Copilot AI changed the title [WIP] Provide examples for configuring use-witness with env var Add examples for using use-witness with environment variables as emergency escape valve Nov 10, 2025
Copilot AI requested a review from kriscoleman November 10, 2025 18:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

chore: provide examples for users to use use-witness

2 participants