Describe the feature or problem you’d like to solve

gh attestations verify ... allows the user to verify various properties in the attestation, such as the source repo with --repo and the signing workflow with --signer-repo. You can also verify the signing workflow's ref with --cert-identity.

The problem is that there may be many artifacts that come from a source repo, so I can't easily be sure if the artifact came from approved changes, in the case of protected mainline branches or tags. Furthermore, verifying the source commit sha will allow me to pinpoint the exact code that produced the artifact.

Proposed solution

I would like for be able to verify the source repo's ref, and also the source repo's commit sha, so I can easily be more sure about my received artifacts:

• --ref
• --commit

While we are making these changes, we may also add:

• signer-ref
• signer-commit

Additional context

My current solution is cumbersome, involving --jq and piping to grep:

SOURCE_REPO="ramonpetgrave/github-build-attestations-rw"
SOURCE_REF="refs/heads/main"
SIGNER_WORKFLOW_CERT_IDENTITY="https://github.com/ramonpetgrave/github-build-attestations-rw/.github/workflows/attest-build-provenance-slsa3-rw.yml@refs/heads/dev"
gh attestation verify $ARTIFACT_PATH \
    --deny-self-hosted-runners \
    --repo "$SOURCE_REPO"  \
    --cert-identity "$SIGNER_WORKFLOW_CERT_IDENTITY" 
    --format json --jq '.[].verificationResult.signature.certificate.sourceRepositoryRef' \
| grep "^$SOURCE_REF$"