Skip to content

Commit ce2408f

Browse files
laurentsimonlaurentsimon
authored
fix: checkout uses the wrong repository (#1113)
* update * update * update * update * update
1 parent a357a77 commit ce2408f

File tree

7 files changed

+75
-29
lines changed

7 files changed

+75
-29
lines changed

‎.github/workflows/builder_go_slsa3.yml

+12-12
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ jobs:
7373
runs-on: ubuntu-latest
7474
steps:
7575
- name: Check private repos
76-
uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22
76+
uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@main
7777
with:
7878
error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override."
7979
override: ${{ inputs.private-repository }}
@@ -85,7 +85,7 @@ jobs:
8585
steps:
8686
- name: Generate random 16-byte value (32-char hex encoded)
8787
id: rng
88-
uses: slsa-framework/slsa-github-generator/.github/actions/rng@e3220805577deb9d193f64e519abcb3b50851df5
88+
uses: slsa-framework/slsa-github-generator/.github/actions/rng@main
8989

9090
detect-env:
9191
outputs:
@@ -97,7 +97,7 @@ jobs:
9797
steps:
9898
- name: Detect the builder ref
9999
id: detect
100-
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd # tag=v1.2.0
100+
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@main # tag=v1.2.0
101101

102102
###################################################################
103103
# #
@@ -112,7 +112,7 @@ jobs:
112112
steps:
113113
- name: Generate builder binary
114114
id: generate
115-
uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@923a5a249d2ea820614a80486c9ef0857ced5321
115+
uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main
116116
with:
117117
repository: "${{ needs.detect-env.outputs.repository }}"
118118
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -142,10 +142,10 @@ jobs:
142142
go-env: ${{ steps.build-dry.outputs.go-env }}
143143
go-working-dir: ${{ steps.build-dry.outputs.go-working-dir }}
144144
runs-on: ubuntu-latest
145-
needs: [privacy-check, builder, rng]
145+
needs: [privacy-check, builder, rng, detect-env]
146146
steps:
147147
- name: Checkout builder repository
148-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
148+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
149149
with:
150150
repository: "${{ needs.detect-env.outputs.repository }}"
151151
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -188,10 +188,10 @@ jobs:
188188
outputs:
189189
go-binary-sha256: ${{ steps.upload.outputs.sha256 }}
190190
runs-on: ubuntu-latest
191-
needs: [privacy-check, builder, build-dry, rng]
191+
needs: [privacy-check, builder, build-dry, rng, detect-env]
192192
steps:
193193
- name: Checkout builder repository
194-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
194+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
195195
with:
196196
repository: "${{ needs.detect-env.outputs.repository }}"
197197
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -262,7 +262,7 @@ jobs:
262262
###################################################################
263263
provenance:
264264
runs-on: ubuntu-latest
265-
needs: [builder, build, build-dry, rng]
265+
needs: [builder, build, build-dry, rng, detect-env]
266266
permissions:
267267
id-token: write # Needed to create an OIDC token for keyless signing.
268268
contents: read
@@ -272,7 +272,7 @@ jobs:
272272
go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }}
273273
steps:
274274
- name: Checkout builder repository
275-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
275+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
276276
with:
277277
repository: "${{ needs.detect-env.outputs.repository }}"
278278
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -326,11 +326,11 @@ jobs:
326326
permissions:
327327
contents: write # Needed to write artifacts to a release.
328328
runs-on: ubuntu-latest
329-
needs: [build-dry, build, provenance]
329+
needs: [build-dry, build, provenance, detect-env]
330330
if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true
331331
steps:
332332
- name: Checkout builder repository
333-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
333+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
334334
with:
335335
repository: "${{ needs.detect-env.outputs.repository }}"
336336
ref: "${{ needs.detect-env.outputs.ref }}"

‎.github/workflows/builder_node_slsa3.yml

+10-10
Original file line numberDiff line numberDiff line change
@@ -133,7 +133,7 @@ jobs:
133133
runs-on: ubuntu-latest
134134
steps:
135135
- name: Check private repos
136-
uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22
136+
uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@main
137137
with:
138138
error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override."
139139
override: ${{ inputs.private-repository }}
@@ -145,7 +145,7 @@ jobs:
145145
steps:
146146
- name: Generate random 16-byte value (32-char hex encoded)
147147
id: rng
148-
uses: slsa-framework/slsa-github-generator/.github/actions/rng@e3220805577deb9d193f64e519abcb3b50851df5
148+
uses: slsa-framework/slsa-github-generator/.github/actions/rng@main
149149

150150
detect-env:
151151
outputs:
@@ -157,7 +157,7 @@ jobs:
157157
steps:
158158
- name: Detect the builder ref
159159
id: detect
160-
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd # tag=v1.2.0
160+
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@main # tag=v1.2.0
161161

162162
###################################################################
163163
# #
@@ -172,7 +172,7 @@ jobs:
172172
steps:
173173
- name: Generate builder
174174
id: generate
175-
uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@923a5a249d2ea820614a80486c9ef0857ced5321
175+
uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main
176176
with:
177177
repository: "${{ needs.detect-env.outputs.repository }}"
178178
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -200,10 +200,10 @@ jobs:
200200
node-tarball-sha256: ${{ steps.upload.outputs.sha256 }}
201201
node-tarball-name: ${{ steps.tarball.outputs.filename }}
202202
runs-on: ubuntu-latest
203-
needs: [privacy-check, builder, rng]
203+
needs: [privacy-check, builder, rng, detect-env]
204204
steps:
205205
- name: Checkout builder repository
206-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
206+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
207207
with:
208208
repository: "${{ needs.detect-env.outputs.repository }}"
209209
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -292,7 +292,7 @@ jobs:
292292
###################################################################
293293
provenance:
294294
runs-on: ubuntu-latest
295-
needs: [builder, build, rng]
295+
needs: [builder, build, rng, detect-env]
296296
permissions:
297297
id-token: write # Needed to create an OIDC token for keyless signing.
298298
contents: read
@@ -302,7 +302,7 @@ jobs:
302302
node-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }}
303303
steps:
304304
- name: Checkout builder repository
305-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
305+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
306306
with:
307307
repository: "${{ needs.detect-env.outputs.repository }}"
308308
ref: "${{ needs.detect-env.outputs.ref }}"
@@ -356,10 +356,10 @@ jobs:
356356
###################################################################
357357
publish:
358358
runs-on: ubuntu-latest
359-
needs: [build, provenance]
359+
needs: [build, provenance, detect-env]
360360
steps:
361361
- name: Checkout builder repository
362-
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@923a5a249d2ea820614a80486c9ef0857ced5321
362+
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
363363
with:
364364
repository: "${{ needs.detect-env.outputs.repository }}"
365365
ref: "${{ needs.detect-env.outputs.ref }}"

‎.github/workflows/generator_container_slsa3.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ jobs:
5454
runs-on: ubuntu-latest
5555
steps:
5656
- name: Check private repos
57-
uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@a3c7a56c8749c2c423f01bbcfd063315efc07a22
57+
uses: slsa-framework/slsa-github-generator/.github/actions/privacy-check@main
5858
with:
5959
error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override."
6060
override: ${{ inputs.private-repository }}
@@ -71,7 +71,7 @@ jobs:
7171
steps:
7272
- name: Detect the generator ref
7373
id: detect
74-
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@efb47d340c150ce456bf8bd554a131ac53b10ccd
74+
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@main
7575

7676
# generator builds the generator binary and runs it to generate SLSA
7777
# provenance.
@@ -91,7 +91,7 @@ jobs:
9191
packages: write # Needed to login and upload attestations to ghcr.io.
9292
steps:
9393
- name: Generate builder
94-
uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@923a5a249d2ea820614a80486c9ef0857ced5321
94+
uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main
9595
with:
9696
repository: "${{ needs.detect-env.outputs.repository }}"
9797
ref: "${{ needs.detect-env.outputs.ref }}"

‎.github/workflows/generator_generic_slsa3.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,7 @@ jobs:
163163
outputs:
164164
release-id: ${{ steps.release.outputs.id }}
165165
runs-on: ubuntu-latest
166-
needs: [generator]
166+
needs: [generator, detect-env]
167167
permissions:
168168
contents: write # Needed to write artifacts to a release.
169169
if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true

‎.github/workflows/release.yml

+25-2
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,39 @@ name: Builders realeaser
33
on:
44
# For manual tests.
55
workflow_dispatch:
6+
inputs:
7+
release-tag:
8+
description: 'Release tag to test'
9+
required: true
10+
type: string
611
push:
712
tags:
813
- "*" # triggers only if push new tag version, like `0.8.4` or else
914

1015
permissions: read-all
1116

1217
jobs:
18+
# Pre-release reference verification.
19+
pre-release-refs:
20+
name: pre release refs verification
21+
runs-on: ubuntu-latest
22+
steps:
23+
- uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # tag=v3.0.2
24+
- name: manual release ref
25+
env:
26+
RELEASE_TAG: "${{ inputs.release-tag }}"
27+
if: github.ref_type != 'tag'
28+
run: ./.github/workflows/scripts/pre-release/references.sh
29+
30+
- name: new tag release ref
31+
env:
32+
RELEASE_TAG: "${{ github.ref_name }}"
33+
if: github.ref_type == 'tag'
34+
run: ./.github/workflows/scripts/pre-release/references.sh
35+
1336
# Generic generator.
1437
generic-generator:
38+
needs: [pre-release-refs]
1539
permissions:
1640
id-token: write # For signing.
1741
contents: write # For asset uploads.
@@ -24,8 +48,7 @@ jobs:
2448

2549
# Go builder.
2650
go-builder:
27-
# Force the builds to rin sequentially, to avoid
28-
# the builder binaries being overwritten by each run.
51+
needs: [pre-release-refs]
2952
permissions:
3053
id-token: write # For signing.
3154
contents: write # For asset uploads.

‎.github/workflows/scripts/pre-release/references.sh

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
#!/bin/bash
2+
3+
# Verify that Action calls that are pinned (not locally called)
4+
# use the same referemnce as the relealse tag.
5+
# See reasoning in ./github/actions/README.md
6+
7+
set -euo pipefail
8+
9+
results=$(
10+
find .github/workflows/ -name '*.yaml' -o -name '*.yml' \
11+
| xargs grep -P "slsa-framework/slsa-github-generator/.github/actions/.*@(?!$RELEASE_TAG)" \
12+
|| true
13+
)
14+
if [[ "$results" != "" ]]; then
15+
echo "Some Actions are not referenced via the correct release tag \"$RELEASE_TAG\""
16+
echo "$results"
17+
exit 1
18+
fi
19+

‎RELEASE.md

+5-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,11 @@ $ export GH=/path/to/gh
3333

3434
## Pre-release tests
3535

36-
Needless to say, only think about a release when all the e2e tests in [github.com/slsa-framework/example-package/.github/workflows/](github.com/slsa-framework/example-package/.github/workflows/) are passing. (They run daily).
36+
Verify the references to the internal Actions by manually running the [release workflow](https://github.com/slsa-framework/slsa-github-generator/actions/workflows/release.yml). Ensure this workflow succeeds.
37+
38+
Code freeze the repository for 1-2 days.
39+
40+
Verify all the e2e tests in [github.com/slsa-framework/example-package/.github/workflows/](github.com/slsa-framework/example-package/.github/workflows/) are passing. (They run daily).
3741

3842
There is one integration test we cannot easily test "live", so we need to simulate it by changing the code: malicious verifier binary in assets. We want to be sure the builder fails if the verifier's binary is tampered with. For this:
3943

0 commit comments

Comments
 (0)