Skip to content

Commit 2541976

Browse files
Ian Lewislaurentsimon
Ian Lewis
and
laurentsimon
authored
Create a release as part of generic workflow (slsa-framework#413)
* Add ability to upload to a release * add release id output Co-authored-by: laurentsimon <[email protected]>
1 parent 8e5ff5c commit 2541976

File tree

2 files changed

+71
-21
lines changed

2 files changed

+71
-21
lines changed

‎.github/workflows/builder_go_slsa3.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ on:
4747
required: true
4848
type: string
4949
upload-assets:
50-
description: "Whether to upload assets to a GitHub release or not."
50+
description: "If true provenance is uploaded to a GitHub release for new tags."
5151
required: false
5252
type: boolean
5353
default: true
@@ -61,7 +61,7 @@ on:
6161
required: false
6262
type: string
6363
compile-builder:
64-
description: "Build the builder from source. This increases build time by ~2mn."
64+
description: "Build the builder from source. This increases build time by ~2m."
6565
required: false
6666
type: boolean
6767
default: false
@@ -181,7 +181,7 @@ jobs:
181181
go-version: ${{ inputs.go-version }}
182182

183183
- name: Download builder
184-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
184+
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0
185185
with:
186186
name: "${{ env.BUILDER_BINARY }}"
187187

@@ -241,7 +241,7 @@ jobs:
241241
go-version: ${{ inputs.go-version }}
242242

243243
- name: Download builder
244-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
244+
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0
245245
with:
246246
name: "${{ env.BUILDER_BINARY }}"
247247

@@ -328,7 +328,7 @@ jobs:
328328
needs: [build, build-dry]
329329
steps:
330330
- name: Download generated binary
331-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
331+
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0
332332
with:
333333
name: "${{ env.GENERATED_BINARY_NAME }}"
334334

@@ -373,7 +373,7 @@ jobs:
373373
go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }}
374374
steps:
375375
- name: Download builder
376-
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
376+
uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0
377377
with:
378378
name: "${{ env.BUILDER_BINARY }}"
379379

@@ -439,7 +439,7 @@ jobs:
439439
if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true
440440
steps:
441441
# Verify binary hash.
442-
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
442+
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0
443443
with:
444444
name: ${{ needs.build-dry.outputs.go-binary-name }}
445445
- name: Verify binary hash
@@ -458,7 +458,7 @@ jobs:
458458
echo "$UNTRUSTED_BINARY_HASH $UNTRUSTED_BINARY_NAME" | sha256sum --strict --check --status || exit -2
459459
460460
# Verify provenance hash.
461-
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
461+
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0.
462462
with:
463463
name: ${{ needs.provenance.outputs.go-provenance-name }}
464464
- name: Verify provenance hash

‎.github/workflows/generator_generic_slsa3.yml

+63-13
Original file line numberDiff line numberDiff line change
@@ -30,29 +30,34 @@ env:
3030
VERIFIER_RELEASE_BINARY_SHA256: 60c91c9d5b9a059e37ac46da316f20c81da335b5d00e1f74d03dd50f819694bd
3131
VERIFIER_RELEASE: v1.1.1
3232

33-
###################################################################
34-
# #
35-
# Input and output argument definitions #
36-
# #
37-
###################################################################
3833
on:
3934
workflow_call:
4035
inputs:
4136
base64-subjects:
4237
description: "Artifacts for which to generate provenance, formatted the same as the output of sha256sum (SHA256 NAME\\n[...]) and base64 encoded."
4338
required: true
4439
type: string
40+
upload-to-release:
41+
description: "If true provenance is uploaded to a GitHub release for new tags."
42+
required: false
43+
type: boolean
44+
default: true
4545
compile-generator:
46-
description: "Build the generator from source. This increases build time by ~2mn."
46+
description: "Build the generator from source. This increases build time by ~2m."
4747
required: false
4848
type: boolean
4949
default: false
5050
outputs:
51+
release-id:
52+
description: "The name of the release where provenance was uploaded."
53+
value: ${{ jobs.create-release.outputs.release-id }}
5154
attestation-name:
5255
description: "The artifact name of the signed provenance"
5356
value: ${{ jobs.generator.outputs.attestation-name }}
5457

5558
jobs:
59+
# detect-env detects the reusable workflow's repository and ref for use later
60+
# in the workflow.
5661
detect-env:
5762
outputs:
5863
repository: ${{ steps.detect.outputs.repository }}
@@ -65,14 +70,19 @@ jobs:
6570
id: detect
6671
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@d995948e8d53cc639c0d3ef69db31dbc243519c4
6772

68-
###################################################################
69-
# #
70-
# Build the generator #
71-
# #
72-
###################################################################
73+
# generator builds the generator binary and runs it to generate SLSA
74+
# provenance.
75+
#
76+
# If `compile-generator` is true then the generator is compiled
77+
# from source at the ref detected by `detect-env`.
78+
#
79+
# If `compile-generator` is false, then the generator binary is downloaded
80+
# with the release at the ref detected by `detect-env`. This must be a tag
81+
# reference.
7382
generator:
7483
outputs:
7584
attestation-name: ${{ steps.sign-prov.outputs.attestation-name }}
85+
attestation-sha256: ${{ steps.sign-prov.outputs.attestation-sha256 }}
7686
runs-on: ubuntu-latest
7787
needs: [detect-env]
7888
permissions:
@@ -133,8 +143,11 @@ jobs:
133143
set -euo pipefail
134144
# Create and sign provenance
135145
# This sets attestation-name to the name of the signed DSSE envelope.
136-
./"$BUILDER_BINARY" attest --subjects "${SUBJECTS}" -g attestation.intoto.jsonl
137-
echo "::set-output name=attestation-name::attestation.intoto.jsonl"
146+
attestation_name="attestation.intoto.jsonl"
147+
./"$BUILDER_BINARY" attest --subjects "${SUBJECTS}" -g $attestation_name
148+
attestation_sha256=$(sha256sum $attestation_name | awk '{print $1}')
149+
echo "::set-output name=attestation-name::$attestation_name"
150+
echo "::set-output name=attestation-sha256::$attestation_sha256"
138151
139152
- name: Upload the signed provenance
140153
uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
@@ -143,3 +156,40 @@ jobs:
143156
path: "${{ steps.sign-prov.outputs.attestation-name }}"
144157
if-no-files-found: error
145158
retention-days: 5
159+
160+
# create-release creates a release and uploads provenance to the release if
161+
# `upload-to-release` is true.
162+
create-release:
163+
outputs:
164+
release-id: ${{ steps.release.outputs.id }}
165+
runs-on: ubuntu-latest
166+
needs: [generator]
167+
permissions:
168+
contents: write
169+
if: startsWith(github.ref, 'refs/tags/') && inputs.upload-to-release == true
170+
steps:
171+
# Verify provenance hash.
172+
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0
173+
with:
174+
name: ${{ needs.generator.outputs.attestation-name }}
175+
- name: Verify provenance hash
176+
env:
177+
UNTRUSTED_PROVENANCE_NAME: "${{ needs.generator.outputs.attestation-name }}"
178+
UNTRUSTED_PROVENANCE_HASH: "${{ needs.generator.outputs.attestation-sha256 }}"
179+
run: |
180+
set -euo pipefail
181+
182+
echo "hash of provenance $UNTRUSTED_PROVENANCE_NAME should be $UNTRUSTED_PROVENANCE_HASH"
183+
184+
COMPUTED_HASH=$(sha256sum "$UNTRUSTED_PROVENANCE_NAME" | awk '{print $1}')
185+
echo "provenance hash computed is $COMPUTED_HASH"
186+
187+
# Compare hashes. Explicit exit to be safe.
188+
echo "$UNTRUSTED_PROVENANCE_HASH $UNTRUSTED_PROVENANCE_NAME" | sha256sum --strict --check --status || exit -2
189+
190+
- name: Release
191+
uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5 # v0.1.14
192+
id: release
193+
with:
194+
files: |
195+
${{ needs.generator.outputs.attestation-name }}

0 commit comments

Comments
 (0)