Skip to content

Commit 5982322

Browse files
jkjelljkjell
authored
fix(ci): save attestations and upload to workflow run instead of sending to archivista (#783)
Signed-off-by: John Kjell <john.kjell@control-plane.io>
1 parent 9feec51 commit 5982322

2 files changed

Lines changed: 177 additions & 121 deletions

File tree

‎.github/workflows/pipeline.yml‎

Lines changed: 83 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -13,96 +13,99 @@
1313
# limitations under the License.
1414

1515
permissions:
16-
contents: read # This is required for actions/checkout
16+
contents: read # This is required for actions/checkout
1717
name: pipeline
1818
on:
19-
push:
20-
tags:
21-
- v*
22-
branches:
23-
- main
24-
pull_request:
19+
push:
20+
tags:
21+
- v*
22+
branches:
23+
- main
24+
pull_request:
2525
jobs:
26-
fmt:
27-
uses: ./.github/workflows/witness.yml
28-
permissions:
29-
id-token: write # This is required for requesting the JWT
30-
contents: read # This is required for actions/checkout
31-
with:
32-
pull_request: ${{ github.event_name == 'pull_request' }}
33-
step: static-analysis
34-
attestations: "github"
35-
command: go fmt ./...
26+
fmt:
27+
uses: ./.github/workflows/witness.yml
28+
permissions:
29+
id-token: write # This is required for requesting the JWT
30+
contents: read # This is required for actions/checkout
31+
with:
32+
pull_request: ${{ github.event_name == 'pull_request' }}
33+
step: static-analysis
34+
attestations: "github"
35+
command: go fmt ./...
3636

37-
static_analysis:
38-
uses: ./.github/workflows/witness.yml
39-
permissions:
40-
id-token: write # This is required for requesting the JWT
41-
contents: read # This is required for actions/checkout
42-
with:
43-
pull_request: ${{ github.event_name == 'pull_request' }}
44-
step: static-analysis
45-
attestations: "github"
46-
command: go vet ./...
37+
static_analysis:
38+
uses: ./.github/workflows/witness.yml
39+
permissions:
40+
id-token: write # This is required for requesting the JWT
41+
contents: read # This is required for actions/checkout
42+
with:
43+
pull_request: ${{ github.event_name == 'pull_request' }}
44+
step: static-analysis
45+
attestations: "github"
46+
command: go vet ./...
4747

48-
tests:
49-
needs: [fmt, static_analysis]
50-
uses: ./.github/workflows/witness.yml
51-
permissions:
52-
id-token: write # This is required for requesting the JWT
53-
contents: read # This is required for actions/checkout
54-
with:
55-
pull_request: ${{ github.event_name == 'pull_request' }}
56-
step: "tests"
57-
attestations: "github"
58-
command: |
59-
make clean
60-
make test
48+
tests:
49+
needs: [fmt, static_analysis]
50+
uses: ./.github/workflows/witness.yml
51+
permissions:
52+
id-token: write # This is required for requesting the JWT
53+
contents: read # This is required for actions/checkout
54+
with:
55+
pull_request: ${{ github.event_name == 'pull_request' }}
56+
step: "tests"
57+
attestations: "github"
58+
command: |
59+
make clean
60+
make test
6161
62-
release:
63-
needs: tests
64-
permissions:
65-
id-token: write
66-
contents: write
67-
packages: write
68-
runs-on: ubuntu-latest
69-
if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
62+
release:
63+
needs: tests
64+
permissions:
65+
id-token: write
66+
contents: write
67+
packages: write
68+
runs-on: ubuntu-latest
69+
if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
7070

71-
steps:
72-
- name: Harden Runner
73-
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
74-
with:
75-
egress-policy: audit
71+
steps:
72+
- name: Harden Runner
73+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
74+
with:
75+
egress-policy: audit
7676

77-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
78-
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
79-
with:
80-
go-version-file: "go.mod"
77+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
78+
with:
79+
persist-credentials: false
80+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
81+
with:
82+
go-version-file: "go.mod"
83+
cache: false
8184

82-
- name: Login to GitHub Container Registry
83-
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
84-
with:
85-
registry: ghcr.io
86-
username: ${{ github.actor }}
87-
password: ${{ secrets.GITHUB_TOKEN }}
85+
- name: Login to GitHub Container Registry
86+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
87+
with:
88+
registry: ghcr.io
89+
username: ${{ github.actor }}
90+
password: ${{ secrets.GITHUB_TOKEN }}
8891

89-
- name: Set up QEMU
90-
uses: docker/setup-qemu-action@v4
92+
- name: Set up QEMU
93+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
9194

92-
- name: Set up Docker Buildx
93-
uses: docker/setup-buildx-action@v4
95+
- name: Set up Docker Buildx
96+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
9497

95-
- name: Download GoReleaser
96-
run: go install github.com/goreleaser/goreleaser@v1.23.0
98+
- name: Download GoReleaser
99+
run: go install github.com/goreleaser/goreleaser@v1.23.0
97100

98-
- name: Run GoReleaser
99-
uses: testifysec/witness-run-action@7aa15e327829f1f2a523365c564c948d5dde69dd
100-
env:
101-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
102-
GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
103-
with:
104-
witness-install-dir: /opt/witness
105-
version: 0.9.1
106-
step: "build"
107-
attestations: "github"
108-
command: goreleaser release --clean
101+
- name: Run GoReleaser
102+
uses: testifysec/witness-run-action@7aa15e327829f1f2a523365c564c948d5dde69dd
103+
env:
104+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
105+
GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
106+
with:
107+
witness-install-dir: /opt/witness
108+
version: 0.9.1
109+
step: "build"
110+
attestations: "github"
111+
command: goreleaser release --clean

‎.github/workflows/witness.yml‎

Lines changed: 94 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Copyright 2023 The Archivista Contributors
1+
# Copyright 2023 The Witness Contributors
22
#
33
# Licensed under the Apache License, Version 2.0 (the "License");
44
# you may not use this file except in compliance with the License.
@@ -13,52 +13,105 @@
1313
# limitations under the License.
1414

1515
on:
16-
workflow_call:
17-
inputs:
18-
pull_request:
19-
required: true
20-
type: boolean
21-
command:
22-
required: true
23-
type: string
24-
step:
25-
required: true
26-
type: string
27-
attestations:
28-
required: true
29-
type: string
16+
workflow_call:
17+
inputs:
18+
pull_request:
19+
required: true
20+
type: boolean
21+
artifact-download:
22+
required: false
23+
type: string
24+
artifact-upload-name:
25+
required: false
26+
type: string
27+
artifact-upload-path:
28+
required: false
29+
type: string
30+
pre-command:
31+
required: false
32+
type: string
33+
command:
34+
required: true
35+
type: string
36+
step:
37+
required: true
38+
type: string
39+
attestations:
40+
required: true
41+
type: string
3042

3143
permissions:
3244
contents: read
3345

3446
jobs:
35-
witness:
36-
runs-on: ubuntu-22.04
37-
permissions:
38-
contents: read
39-
id-token: write
40-
steps:
41-
- name: Harden Runner
42-
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
43-
with:
44-
egress-policy: audit
47+
witness:
48+
runs-on: ubuntu-latest
49+
permissions:
50+
contents: read
51+
id-token: write
52+
steps:
53+
- name: Harden Runner
54+
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
55+
with:
56+
egress-policy: audit
4557

46-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47-
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
48-
with:
49-
go-version-file: "go.mod"
58+
- name: Checkout
59+
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
60+
with:
61+
persist-credentials: false
62+
- name: Setup Go
63+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
64+
with:
65+
go-version-file: "go.mod"
5066

51-
- if: ${{ inputs.pull_request == false }}
52-
uses: testifysec/witness-run-action@7aa15e327829f1f2a523365c564c948d5dde69dd
53-
with:
54-
witness-install-dir: /opt/witness
55-
version: 0.9.1
56-
step: ${{ inputs.step }}
57-
attestations: ${{ inputs.attestations }}
58-
command: /bin/sh -c "${{ inputs.command }}"
67+
- if: ${{ inputs.artifact-download != '' }}
68+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
69+
with:
70+
name: ${{ inputs.artifact-download }}
71+
path: /tmp
5972

60-
- if: ${{ inputs.pull_request == true }}
61-
run: ${{ inputs.command }}
73+
- if: ${{ inputs.pre-command != '' && inputs.pull_request == false }}
74+
uses: testifysec/witness-run-action@7aa15e327829f1f2a523365c564c948d5dde69dd
75+
with:
76+
step: pre-${{ inputs.step }}
77+
attestations: ${{ inputs.attestations }}
78+
version: 0.11.0
79+
outfile: pre-${{ inputs.step }}-attestation.json
80+
enable-archivista: false
81+
witness-install-dir: /usr/local/bin
82+
command: /bin/sh -c "${{ inputs.pre-command }}"
83+
- if: ${{ inputs.pre-command != '' && inputs.pull_request == false }}
84+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
85+
with:
86+
name: pre-${{ inputs.step }}-attestation
87+
path: pre-${{ inputs.step }}-attestation.json
88+
- if: ${{ inputs.pre-command != '' && inputs.pull_request == true }}
89+
run: bash -c "${INPUTS_COMMAND}"
90+
env:
91+
INPUTS_PRE_COMMAND: ${{ inputs.pre-command }}
6292

63-
- if: ${{ inputs.step == 'tests' }}
64-
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
93+
- if: ${{ inputs.pull_request == false }}
94+
uses: testifysec/witness-run-action@7aa15e327829f1f2a523365c564c948d5dde69dd
95+
with:
96+
step: ${{ inputs.step }}
97+
attestations: ${{ inputs.attestations }}
98+
version: 0.11.0
99+
outfile: ${{ inputs.step }}-attestation.json
100+
enable-archivista: false
101+
witness-install-dir: /usr/local/bin
102+
command: /bin/sh -c "${{ inputs.command }}"
103+
- if: ${{ inputs.pull_request == false }}
104+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
105+
with:
106+
name: ${{ inputs.step }}-attestation
107+
path: ${{ inputs.step }}-attestation.json
108+
- if: ${{ inputs.pull_request == true }}
109+
run: bash -c "${INPUTS_COMMAND}"
110+
env:
111+
INPUTS_COMMAND: ${{ inputs.command }}
112+
113+
- if: ${{ inputs.artifact-upload-path != '' && inputs.artifact-upload-name != ''}}
114+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
115+
with:
116+
name: ${{ inputs.artifact-upload-name }}
117+
path: ${{ inputs.artifact-upload-path }}

0 commit comments

Comments
 (0)