CTLog STH Prober #107058
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CTLog STH Prober | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| triggerPagerDutyTest: | |
| description: 'Trigger PagerDuty test message' | |
| required: false | |
| type: boolean | |
| schedule: | |
| # run every 15 minutes, as often as Github Actions allows | |
| - cron: '*/15 * * * *' | |
| permissions: | |
| contents: read | |
| jobs: | |
| ctlog-sth: | |
| name: CTLog STH probe | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 2 | |
| outputs: | |
| summary: ${{ steps.ctlog_sth_probe.outputs.summary }} | |
| probe_status: ${{ steps.ctlog_sth_probe.outputs.probe_status }} | |
| env: ${{ steps.ctlog_sth_probe.outputs.env }} | |
| shard: ${{ steps.ctlog_sth_probe.outputs.shard }} | |
| strategy: | |
| fail-fast: false # Keep running if one leg fails. | |
| matrix: | |
| env: | |
| - production | |
| - staging | |
| shard: | |
| - test | |
| - 2022 | |
| - 2022-2 | |
| - log2026-1 | |
| - log2026-1-us-east4 | |
| exclude: | |
| - env: production | |
| shard: 2022-2 | |
| - env: production | |
| shard: log2026-1 | |
| - env: production | |
| shard: log2026-1-us-east4 | |
| steps: | |
| - name: Extract relevant binaries | |
| run: | | |
| docker pull ghcr.io/sigstore/sigstore-probers/tools:latest | |
| # the last argument in the next command is not used, it is required because the container doesn't have a default command | |
| docker create --name binaries ghcr.io/sigstore/sigstore-probers/tools /usr/local/bin/ctlog-sth | |
| docker cp binaries:/usr/local/bin/ctlog-sth /usr/local/bin/ | |
| - name: Probe CT log STH - ${{ matrix.env }} - ${{ matrix.shard }} | |
| id: ctlog_sth_probe | |
| run: | | |
| echo "env=${{ matrix.env }}" >> $GITHUB_OUTPUT | |
| echo "shard=${{ matrix.shard }}" >> $GITHUB_OUTPUT | |
| if [ "${{ inputs.triggerPagerDutyTest }}" == "true" ]; then | |
| echo "summary=Test Notification" >> $GITHUB_OUTPUT; | |
| else | |
| echo "summary=CTLog STH Prober Failed" >> $GITHUB_OUTPUT; | |
| fi | |
| if ! ctlog-sth --env ${{ matrix.env }} --shard ${{ matrix.shard }} ; then | |
| echo "probe_status=failed" >> $GITHUB_OUTPUT | |
| exit 1 | |
| fi | |
| pager: | |
| if: github.event.inputs.triggerPagerDutyTest=='true' || (failure() && needs.ctlog-sth.outputs.probe_status == 'failed') | |
| needs: [ctlog-sth] | |
| uses: ./.github/workflows/reusable-pager.yml | |
| secrets: | |
| PAGERDUTY_INTEGRATION_KEY: ${{ secrets.PAGERDUTY_INTEGRATION_KEY }} | |
| with: | |
| summary: ${{ needs.ctlog-sth.outputs.summary }} | |
| component: "ctfe" | |
| group: ${{ needs.ctlog-sth.outputs.env }} | |
| details: > | |
| { | |
| "Environment": "${{ needs.ctlog-sth.outputs.env }}", | |
| "Failure URL": "https://github.com/sigstore/sigstore-probers/actions/runs/${{ github.run_id }}", | |
| "Commit": "${{ github.sha }}", | |
| "CT log ${{ needs.ctlog-sth.outputs.env }} - ${{ needs.ctlog-sth.outputs.shard }} shard": "${{ needs.ctlog-sth.outputs.probe_status }}" | |
| } | |
| links: > | |
| [ | |
| { | |
| "href": "https://github.com/sigstore/public-good-instance/blob/main/playbooks/alerting/alerts/ct-log-uptime-failure.md", | |
| "text": "CTFE Prober Failure Playbook" | |
| } | |
| ] |