Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix prov-only e2e tests and permissions #27

Merged
merged 15 commits into from
Jun 6, 2022
Merged

Fix prov-only e2e tests and permissions #27

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
ddc60e5
Fix permissions
ianlewis Jun 6, 2022
0b17a4f
Use test slsa-verifier
ianlewis Jun 6, 2022
0723f6b
Add +x perms
ianlewis Jun 6, 2022
eadb4f2
Remove CONFIG_FILE check
ianlewis Jun 6, 2022
f5770ca
Get THIS_FILE
ianlewis Jun 6, 2022
4e59a4b
Update script
ianlewis Jun 6, 2022
00b1c57
Update workflow repo
ianlewis Jun 6, 2022
08a00d2
Update builder.id
ianlewis Jun 6, 2022
2878a13
Fix builder.id
ianlewis Jun 6, 2022
0ae68b6
Fix builderType
ianlewis Jun 6, 2022
bfc4216
Fix buildtype
ianlewis Jun 6, 2022
34e57e2
Update configSource check
ianlewis Jun 6, 2022
2fbeb64
Fix checks
ianlewis Jun 6, 2022
cc17188
Reset time
ianlewis Jun 6, 2022
8f33556
Remove THIS_FILE
ianlewis Jun 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/e2e.generic.push.main.default.slsa2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ on:
env:
GH_TOKEN: ${{ secrets.E2E_GO_TOKEN }}
ISSUE_REPOSITORY: slsa-framework/slsa-github-generator
THIS_FILE: e2e.generic.push.main.default.slsa2.yml

jobs:
push:
Expand Down Expand Up @@ -68,6 +67,7 @@ jobs:
permissions:
id-token: write
contents: read
actions: read
uses: slsa-framework/slsa-github-generator/.github/workflows/slsa2_provenance.yml@main
with:
subjects: "${{ needs.build.outputs.digest }}"
Expand Down
8 changes: 6 additions & 2 deletions .github/workflows/e2e.generic.schedule.main.default.slsa2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@ on:
- cron: "0 3 * * *"
workflow_dispatch:

env:
GH_TOKEN: ${{ secrets.E2E_GO_TOKEN }}
ISSUE_REPOSITORY: slsa-framework/slsa-github-generator

jobs:
build:
outputs:
Expand Down Expand Up @@ -82,15 +86,15 @@ jobs:
if-succeeded:
runs-on: ubuntu-latest
needs: [build, provenance, verify]
if: github.event_name == 'push' && github.event.head_commit.message == github.workflow && needs.build.result == 'success' && needs.provenance.result == 'success' && needs.verify.result == 'success'
if: needs.build.result == 'success' && needs.verify.result == 'success'
steps:
- uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 #v2.4.0
- run: ./.github/workflows/scripts/e2e-report-success.sh

if-failed:
runs-on: ubuntu-latest
needs: [build, provenance, verify]
if: always() && github.event_name == 'push' && github.event.head_commit.message == github.workflow && (needs.build.result == 'failure' || needs.provenance.result == 'failure' || needs.verify.result == 'failure')
if: always() && (needs.build.result == 'failure' || needs.verify.result == 'failure')
steps:
- uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 #v2.4.0
- run: ./.github/workflows/scripts/e2e-report-failure.sh
13 changes: 4 additions & 9 deletions .github/workflows/scripts/e2e-utils.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,6 @@ source "./.github/workflows/scripts/e2e-assert.sh"
# Converter from yaml to JSON.
#sudo apt-get install jc

if [[ -z "$CONFIG_FILE" ]]; then
echo "env variable CONFIG_FILE not set"
exit 2
fi

# File is BODY in current directory.
_create_issue_body() {
RUN_DATE=$(date --utc)
Expand Down Expand Up @@ -75,19 +70,19 @@ e2e_verify_predicate_buildConfig_step_command() {
e2e_verify_predicate_buildConfig_step_env() {
local attestation="$2"
local expected="$(echo -n "$3" | jq -c '.| sort')"

if [[ "${expected}" == "[]" ]]; then
_e2e_verify_query "${attestation}" "null" ".predicate.buildConfig.steps[$1].env"
_e2e_verify_query "${attestation}" "null" ".predicate.buildConfig.steps[$1].env"
else
_e2e_verify_query "${attestation}" "${expected}" ".predicate.buildConfig.steps[$1].env | sort"
_e2e_verify_query "${attestation}" "${expected}" ".predicate.buildConfig.steps[$1].env | sort"
fi
}

# $1: step number
# $2: the attestation content
# $3: expected value.
e2e_verify_predicate_buildConfig_step_workingDir() {
_e2e_verify_query "$2" "$3" ".predicate.buildConfig.steps[$1].workingDir"
_e2e_verify_query "$2" "$3" ".predicate.buildConfig.steps[$1].workingDir"
}

e2e_verify_predicate_metadata() {
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/scripts/e2e.generic.default.verify.sh
100644 → 100755
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ go env -w GOFLAGS=-mod=mod
# Install from HEAD
go install github.com/slsa-framework/slsa-verifier@latest

THIS_FILE=$(gh api -H "Accept: application/vnd.github.v3+json" "/repos/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" | jq -r '.path' | cut -d '/' -f3)

BRANCH=$(echo "$THIS_FILE" | cut -d '.' -f4)

echo "branch is $BRANCH"
Expand Down Expand Up @@ -122,10 +124,10 @@ ATTESTATION=$(jq -r '.payload' <"$PROVENANCE" | base64 -d)
ASSETS=$(echo "$THIS_FILE" | cut -d '.' -f5 | grep -v noassets)
DIR="$PWD"
e2e_verify_predicate_subject_name "$ATTESTATION" "$BINARY"
e2e_verify_predicate_builder_id "$ATTESTATION" "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@refs/heads/main"
e2e_verify_predicate_builderType "$ATTESTATION" "https://github.com/slsa-framework/slsa-github-generator-go@v1"
e2e_verify_predicate_builder_id "$ATTESTATION" "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/slsa2_provenance.yml@refs/heads/main"
e2e_verify_predicate_builderType "$ATTESTATION" "https://github.com/slsa-framework/slsa-github-generator@v1"

e2e_verify_predicate_invocation_configSource "$ATTESTATION" "{\"uri\":\"git+https://github.com/$GITHUB_REPOSITORY@$GITHUB_REF\",\"digest\":{\"sha1\":\"$GITHUB_SHA\"},\"entryPoint\":\"$GITHUB_WORKFLOW\"}"
e2e_verify_predicate_invocation_configSource "$ATTESTATION" "{\"uri\":\"git+https://github.com/$GITHUB_REPOSITORY@$GITHUB_REF\",\"digest\":{\"sha1\":\"$GITHUB_SHA\"},\"entryPoint\":\".github/workflows/$THIS_FILE\"}"

e2e_verify_predicate_invocation_environment "$ATTESTATION" "github_actor" "$GITHUB_ACTOR"
e2e_verify_predicate_invocation_environment "$ATTESTATION" "github_sha1" "$GITHUB_SHA"
Expand Down