e2e.generic.schedule.main.adversarial-invalidsubjects.slsa3.yml

on:
  schedule:
    - cron: "0 4 * * *"
  workflow_dispatch:

permissions: read-all

env:
  PAT_TOKEN: ${{ secrets.E2E_GENERIC_TOKEN }}
  GH_TOKEN: ${{ github.token }}
  ISSUE_REPOSITORY: slsa-framework/slsa-github-generator

jobs:
  build:
    outputs:
      digests: ${{ steps.hash.outputs.hashes }}
    runs-on: ubuntu-latest
    steps:
      - name: Build artifacts
        run: |
          # These are some amazing artifacts.
          echo "artifact1" > artifact1
          echo "artifact2" > artifact2

      - name: Upload artifacts
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # tag=v3.1.0
        with:
          name: artifacts
          if-no-files-found: error
          retention-days: 5
          path: |
            artifact1
            artifact2

      - name: Generate hashes
        shell: bash
        id: hash
        run: |
          # sha256sum generates sha256 hash for all artifacts.
          # base64 -w0 encodes to base64 and outputs on a single line.
          # sha256sum artifact1 artifact2 ... | base64 -w0
          echo "::set-output name=hashes::something invalid | base64 -w0)"


  provenance:
    needs: [build]
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For the entrypoint.
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@main
    with:
      base64-subjects: "${{ needs.build.outputs.digests }}"
      compile-generator: true

  if-failed-build:
    runs-on: ubuntu-latest
    needs: [build]
    if: always() && needs.build.result == 'failure'
    steps:
      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
      - run: ./.github/workflows/scripts/e2e-report-failure.sh

  if-failed-provenance:
    runs-on: ubuntu-latest
    needs: [build, provenance]
    if: always() && needs.build.result == 'success' && needs.provenance.result == 'failure'
    steps:
      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
      - run: ./.github/workflows/scripts/e2e-report-success.sh

  if-succeeded-provenance:
    runs-on: ubuntu-latest
    needs: [build, provenance]
    if: always() && needs.build.result == 'success' && needs.provenance.result == 'success'
    steps:
      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
      - run: ./.github/workflows/scripts/e2e-report-failure.sh