ci: add release workflow test at presubmit

[asraa]

Signed-off-by: Asra Ali [email protected]

To ensure that the release workflow will work before we push a release, because maybe the releaser config went stale.

fixes #211

[asraa]

@laurentsimon do you know why the go builder at v1.2.0 is failing?

[laurentsimon]

not sure. We don't officially support PR, maybe there's something going on there. Maybe the OIDC token is failing (not write access) and so the builder cannot figure its hash to checkout itself?

[laurentsimon]

repository:asraa/slsa-verifier
ref:add-test-presubmit

so it knows what to fetch. However, there's some code that validates the repo name, and only allow example-package and / or this repo.. maybe that's what's going on.

[asraa]

so it knows what to fetch. However, there's some code that validates the repo name, and only allow example-package and / or this repo.. maybe that's what's going on.

Ah I see. Maybe I should just run this on schedule instead.

[laurentsimon]

Btw, how are we going to keep this pre-submit in sync with the release workflow? I mean, that the versions are the same?Shall we use the same workflow and add a trigger to it? Or use a workflow_run trigger and trigger it on PR and during release?
(We'd need to add some code in the release trigger workflow to upload the provenance manually, since the trigger to the workflow_run would be different)

Do we need to compile-builder? I don't think it's necessary.

[asraa]

Shall we use the same workflow and add a trigger to it? Or use a workflow_run trigger and trigger in on PR and during release?

Yeah, let's nuke the separate workflow, and use the same one. Instead of on PR, we can trigger once daily or something on schedule just for testing?

This way we can still keep the on push tags for automatic upload

[laurentsimon]

so it knows what to fetch. However, there's some code that validates the repo name, and only allow example-package and / or this repo.. maybe that's what's going on.

Ah I see. Maybe I should just run this on schedule instead.

If that simplifies our life, I think that works. Let's create an issue when that happens.

[laurentsimon]

Can re-use this code https://github.com/slsa-framework/example-package/blob/main/.github/workflows/scripts/e2e-report-failure.sh

[laurentsimon]

Shall we use the same workflow and add a trigger to it? Or use a workflow_run trigger and trigger in on PR and during release?

Yeah, let's nuke the separate workflow, and use the same one. Instead of on PR, we can trigger once daily or something on schedule just for testing?

This way we can still keep the on push tags for automatic upload

+1. The code is for the generator anyway, so need to run on each PR.

[asraa]

nice! done

[laurentsimon]

Thanks!