Skip to content

Commit f9e31da

Browse files
laurentsimonlaurentsimon
authored
✨ Allow main branch only for trusted builder and e2e tests repos (#63)
* updates * updates * updates * updates * updates * updates * updates * updates * updates * updates * Fix unit tests * unit tests * updates * updates * updates * updates * updates
1 parent 87c9925 commit f9e31da

13 files changed

+383
-76
lines changed

‎.github/config-release.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Used for pre-submit tests.
2+
version: 1
3+
env:
4+
- GO111MODULE=on
5+
- CGO_ENABLED=0
6+
7+
flags:
8+
- -trimpath
9+
- -tags=netgo
10+
11+
goos: linux
12+
goarch: amd64
13+
binary: slsa-verifier-{{ .Os }}-{{ .Arch }}

‎.github/workflows/release.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Verifier releaser
2+
3+
on:
4+
# For manual tests.
5+
workflow_dispatch:
6+
push:
7+
tags:
8+
- "*" # triggers only if push new tag version, like `0.8.4`.
9+
10+
permissions: read-all
11+
12+
jobs:
13+
builder:
14+
permissions:
15+
id-token: write # For signing.
16+
contents: write # For asset uploads.
17+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
18+
with:
19+
go-version: 1.18
20+
config-file: .github/config-release.yml
21+
compile-builder: true

‎main_test.go

+41-39
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,10 @@ import (
44
"errors"
55
"testing"
66

7+
"github.com/slsa-framework/slsa-verifier/pkg"
8+
79
"github.com/google/go-cmp/cmp"
810
"github.com/google/go-cmp/cmp/cmpopts"
9-
pkg "github.com/slsa-framework/slsa-verifier/pkg"
1011
)
1112

1213
func errCmp(e1, e2 error) bool {
@@ -31,259 +32,260 @@ func Test_runVerify(t *testing.T) {
3132
{
3233
name: "valid main branch default",
3334
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
34-
source: "github.com/asraa/slsa-on-github-test",
35+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
3536
},
3637
{
3738
name: "valid main branch set",
3839
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
39-
source: "github.com/asraa/slsa-on-github-test",
40+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
4041
branch: "main",
4142
},
4243
{
4344
name: "wrong branch master",
4445
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
45-
source: "github.com/asraa/slsa-on-github-test",
46+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
4647
branch: "master",
4748
err: pkg.ErrorMismatchBranch,
4849
},
4950
{
5051
name: "wrong source append A",
5152
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
52-
source: "github.com/asraa/slsa-on-github-testA",
53+
source: "github.com/laurentsimon/slsa-verifier-test-genA",
5354
err: pkg.ErrorMismatchRepository,
5455
},
5556
{
5657
name: "wrong source prepend A",
5758
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
58-
source: "Agithub.com/asraa/slsa-on-github-test",
59+
source: "Agithub.com/laurentsimon/slsa-verifier-test-gen",
5960
err: pkg.ErrorMismatchRepository,
6061
},
6162
{
6263
name: "wrong source middle A",
6364
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
64-
source: "github.com/Aasraa/slsa-on-github-test",
65+
source: "github.com/Alaurentsimon/slsa-verifier-test-gen",
6566
err: pkg.ErrorMismatchRepository,
6667
},
6768
{
6869
name: "tag no match empty tag workflow_dispatch",
6970
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
70-
source: "github.com/asraa/slsa-on-github-test",
71+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
7172
ptag: pString("v1.2.3"),
7273
err: pkg.ErrorMismatchTag,
7374
},
7475
{
7576
name: "versioned tag no match empty tag workflow_dispatch",
7677
artifact: "./testdata/binary-linux-amd64-workflow_dispatch",
77-
source: "github.com/asraa/slsa-on-github-test",
78+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
7879
pversiontag: pString("v1"),
7980
err: pkg.ErrorInvalidSemver,
8081
},
8182
{
8283
name: "tag v1.2.3 no match v1.2.4",
8384
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
84-
source: "github.com/asraa/slsa-on-github-test",
85+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
8586
ptag: pString("v1.2.3"),
8687
err: pkg.ErrorMismatchTag,
8788
},
8889
{
8990
name: "tag v1.2 no match v1.2.4",
9091
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
91-
source: "github.com/asraa/slsa-on-github-test",
92+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
9293
ptag: pString("v1.2"),
9394
err: pkg.ErrorMismatchTag,
9495
},
9596
{
9697
name: "tag v1 no match v1.2.4",
9798
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
98-
source: "github.com/asraa/slsa-on-github-test",
99+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
99100
ptag: pString("v1"),
100101
err: pkg.ErrorMismatchTag,
101102
},
102103
// Provenance contains tag = v1.2.4.
103104
{
104105
name: "versioned v1.2.4 match push-v1.2.4",
105106
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
106-
source: "github.com/asraa/slsa-on-github-test",
107+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
107108
pversiontag: pString("v1.2.4"),
108109
},
109110
{
110111
name: "versioned v1.2 match push-v1.2.4",
111112
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
112-
source: "github.com/asraa/slsa-on-github-test",
113+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
113114
pversiontag: pString("v1.2"),
114115
},
115116
{
116117
name: "versioned v1 match push-v1.2.4",
117118
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
118-
source: "github.com/asraa/slsa-on-github-test",
119+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
119120
pversiontag: pString("v1"),
120121
},
121122
{
122123
name: "versioned v2 no match push-v1.2.4",
123124
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
124-
source: "github.com/asraa/slsa-on-github-test",
125+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
125126
pversiontag: pString("v2"),
126127
err: pkg.ErrorMismatchVersionedTag,
127128
},
128129
{
129130
name: "versioned v0 no match push-v1.2.4",
130131
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
131-
source: "github.com/asraa/slsa-on-github-test",
132+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
132133
pversiontag: pString("v0"),
133134
err: pkg.ErrorMismatchVersionedTag,
134135
},
135136
{
136137
name: "versioned v1.3 no match push-v1.2.4",
137138
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
138-
source: "github.com/asraa/slsa-on-github-test",
139+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
139140
pversiontag: pString("v1.3"),
140141
err: pkg.ErrorMismatchVersionedTag,
141142
},
142143
{
143144
name: "versioned v1.1 no match push-v1.2.4",
144145
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
145-
source: "github.com/asraa/slsa-on-github-test",
146+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
146147
pversiontag: pString("v1.1"),
147148
err: pkg.ErrorMismatchVersionedTag,
148149
},
149150
{
150151
name: "versioned v1.2.3 no match push-v1.2.4",
151152
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
152-
source: "github.com/asraa/slsa-on-github-test",
153+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
153154
pversiontag: pString("v1.2.3"),
154155
err: pkg.ErrorMismatchVersionedTag,
155156
},
156157
{
157158
name: "versioned v1.2.5 no match push-v1.2.4",
158159
artifact: "./testdata/binary-linux-amd64-push-v1.2.4",
159-
source: "github.com/asraa/slsa-on-github-test",
160+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
160161
pversiontag: pString("v1.2.5"),
161162
err: pkg.ErrorMismatchVersionedTag,
162163
},
163164
// Provenance contains tag = v2.
164165
{
165166
name: "versioned v2 match push-v2",
166167
artifact: "./testdata/binary-linux-amd64-push-v2",
167-
source: "github.com/asraa/slsa-on-github-test",
168+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
168169
pversiontag: pString("v2"),
169170
},
170171
{
171172
name: "versioned v2.0 match push-v2",
172173
artifact: "./testdata/binary-linux-amd64-push-v2",
173-
source: "github.com/asraa/slsa-on-github-test",
174+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
174175
pversiontag: pString("v2.0"),
175176
},
176177
{
177178
name: "versioned v2.1 no match push-v2",
178179
artifact: "./testdata/binary-linux-amd64-push-v2",
179-
source: "github.com/asraa/slsa-on-github-test",
180+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
180181
pversiontag: pString("v2.1"),
181182
err: pkg.ErrorMismatchVersionedTag,
182183
},
183184
{
184185
name: "versioned v1 no match push-v2",
185186
artifact: "./testdata/binary-linux-amd64-push-v2",
186-
source: "github.com/asraa/slsa-on-github-test",
187+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
187188
pversiontag: pString("v1"),
188189
err: pkg.ErrorMismatchVersionedTag,
189190
},
190191
{
191192
name: "versioned v3 no match push-v2",
192193
artifact: "./testdata/binary-linux-amd64-push-v2",
193-
source: "github.com/asraa/slsa-on-github-test",
194+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
194195
pversiontag: pString("v3"),
195196
err: pkg.ErrorMismatchVersionedTag,
196197
},
197198
{
198199
name: "versioned v1.2 no match push-v2",
199200
artifact: "./testdata/binary-linux-amd64-push-v2",
200-
source: "github.com/asraa/slsa-on-github-test",
201+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
201202
pversiontag: pString("v1.2"),
202203
err: pkg.ErrorMismatchVersionedTag,
203204
},
204205
{
205206
name: "versioned v3 no match push-v2",
206207
artifact: "./testdata/binary-linux-amd64-push-v2",
207-
source: "github.com/asraa/slsa-on-github-test",
208+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
208209
pversiontag: pString("v3"),
209210
err: pkg.ErrorMismatchVersionedTag,
210211
},
211212
{
212213
name: "versioned v0 no match push-v2",
213214
artifact: "./testdata/binary-linux-amd64-push-v2",
214-
source: "github.com/asraa/slsa-on-github-test",
215+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
215216
pversiontag: pString("v0"),
216217
err: pkg.ErrorMismatchVersionedTag,
217218
},
218219
// Provenance contains tag = v2.5.
219220
{
220221
name: "versioned v2.5 match push-v2.5",
221222
artifact: "./testdata/binary-linux-amd64-push-v2.5",
222-
source: "github.com/asraa/slsa-on-github-test",
223+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
223224
pversiontag: pString("v2.5"),
224225
},
225226
{
226227
name: "versioned v2.5.1 match push-v2.5",
227228
artifact: "./testdata/binary-linux-amd64-push-v2.5",
228-
source: "github.com/asraa/slsa-on-github-test",
229+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
229230
pversiontag: pString("v2.5.1"),
230231
err: pkg.ErrorMismatchVersionedTag,
231232
},
232233
{
233234
name: "versioned v2.5.3 match push-v2.5",
234235
artifact: "./testdata/binary-linux-amd64-push-v2.5",
235-
source: "github.com/asraa/slsa-on-github-test",
236+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
236237
pversiontag: pString("v2.5.3"),
237238
err: pkg.ErrorMismatchVersionedTag,
238239
},
239240
{
240241
name: "versioned v2 match push-v2.5",
241242
artifact: "./testdata/binary-linux-amd64-push-v2.5",
242-
source: "github.com/asraa/slsa-on-github-test",
243+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
243244
pversiontag: pString("v2"),
244245
},
245246
{
246247
name: "versioned v2.4 no match push-v2.5",
247248
artifact: "./testdata/binary-linux-amd64-push-v2.5",
248-
source: "github.com/asraa/slsa-on-github-test",
249+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
249250
pversiontag: pString("v2.4"),
250251
err: pkg.ErrorMismatchVersionedTag,
251252
},
252253
{
253254
name: "versioned v2.4.1 no match push-v2.5",
254255
artifact: "./testdata/binary-linux-amd64-push-v2.5",
255-
source: "github.com/asraa/slsa-on-github-test",
256+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
256257
pversiontag: pString("v2.4.1"),
257258
err: pkg.ErrorMismatchVersionedTag,
258259
},
259260
{
260261
name: "versioned v2.4.5 no match push-v2.5",
261262
artifact: "./testdata/binary-linux-amd64-push-v2.5",
262-
source: "github.com/asraa/slsa-on-github-test",
263+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
263264
pversiontag: pString("v2.4.5"),
264265
err: pkg.ErrorMismatchVersionedTag,
265266
},
266267
{
267268
name: "versioned v1 no match push-v2.5",
268269
artifact: "./testdata/binary-linux-amd64-push-v2.5",
269-
source: "github.com/asraa/slsa-on-github-test",
270+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
270271
pversiontag: pString("v1"),
271272
err: pkg.ErrorMismatchVersionedTag,
272273
},
273274
{
274275
name: "versioned v3 no match push-v2.5",
275276
artifact: "./testdata/binary-linux-amd64-push-v2.5",
276-
source: "github.com/asraa/slsa-on-github-test",
277+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
277278
pversiontag: pString("v3"),
278279
err: pkg.ErrorMismatchVersionedTag,
279280
},
280281
{
281282
name: "versioned v3.1 no match push-v2.5",
282283
artifact: "./testdata/binary-linux-amd64-push-v2.5",
283-
source: "github.com/asraa/slsa-on-github-test",
284+
source: "github.com/laurentsimon/slsa-verifier-test-gen",
284285
pversiontag: pString("v3.1"),
285286
err: pkg.ErrorMismatchVersionedTag,
286287
},
288+
// TODO(laurent): add tests for special cases of buidlers' ref.
287289
}
288290
for _, tt := range tests {
289291
tt := tt // Re-initializing variable so it is not changed while executing the closure below

0 commit comments

Comments
 (0)