bom/.github/workflows/ci.yml at main · codesphere-cloud/bom · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
name: CI

on:
  pull_request:
  push:
    branches:
      - main

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Lint
        run: make lint

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5

      - name: Check Required Tools
        run: make check-tools

      - name: Build
        run: make build

      - name: Unit And Package Tests
        run: make test

      - name: End-to-End Test
        run: make test-e2e

  action-smoke:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Build dist artifacts
        run: ./scripts/build-dist.sh

      - name: Run Generate Mode Via Local Generate Action
        uses: ./generate
        with:
          include-paths: testdata/charts/*
          changed-only: "false"

      - name: Verify Generated BOM
        run: test -f testdata/charts/e2e/bom.json

      - name: Run Registry Login Via Local Registry Login Action
        uses: ./registry-login
        with:
          registry-server: registry.example.com
          registry-username: smoke-test
          registry-password: smoke-test

      - name: Run Check Mode Via Local Check Action
        id: action_check
        continue-on-error: true
        uses: ./check
        with:
          include-paths: testdata/charts/*/bom.json
          changed-only: "false"

      - name: Fail if command unexpectedly succeeded
        if: steps.action_check.outcome == 'success'
        run: |
          echo "Test failed: Command succeeded when it should have failed."
          exit 1

  attestation-smoke:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          fetch-depth: 0

      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
        with:
          go-version-file: go.mod
          cache: true

      - name: Build dist artifacts
        run: ./scripts/build-dist.sh

      - name: Log in to GHCR
        uses: ./registry-login
        with:
          registry-server: ghcr.io
          registry-username: ${{ github.actor }}
          registry-password: ${{ secrets.GITHUB_TOKEN }}

      - id: image
        name: Build and push smoke image
        shell: bash
        run: |
          repository="$(echo "ghcr.io/${GITHUB_REPOSITORY}/attestation-smoke" | tr '[:upper:]' '[:lower:]')"
          reference="${repository}:${GITHUB_SHA}"
          docker build --tag "$reference" testdata/attestation/image
          docker push "$reference"
          echo "repository=$repository" >> "$GITHUB_OUTPUT"
          echo "reference=$reference" >> "$GITHUB_OUTPUT"

      - name: Configure smoke chart image
        shell: bash
        env:
          IMAGE_REPOSITORY: ${{ steps.image.outputs.repository }}
        run: |
          sed -i "s|repository:.*|repository: $IMAGE_REPOSITORY|" testdata/attestation/chart/values.yaml
          sed -i "s|tag:.*|tag: $GITHUB_SHA|" testdata/attestation/chart/values.yaml

      - name: Generate and attest image SBOM
        uses: ./generate
        with:
          include-paths: testdata/attestation/chart
          changed-only: "false"
          sbom: "true"
          cosign: "true"

      - name: Verify generated SBOM and keyless attestation
        shell: bash
        env:
          IMAGE_REF: ${{ steps.image.outputs.reference }}
          IMAGE_REPOSITORY: ${{ steps.image.outputs.repository }}
        run: |
          test "$(find testdata/attestation/chart/sboms -type f -name '*.cdx.json' | wc -l)" -eq 1
          test "$(find testdata/attestation/chart/sboms -type f -name '*.spdx.json' | wc -l)" -eq 1
          cyclonedx="$(jq -r --arg image "$IMAGE_REF" '.containerImages[] | select(.ref == $image) | .sboms.cyclonedx.path' testdata/attestation/chart/bom.json)"
          spdx_json="$(jq -r --arg image "$IMAGE_REF" '.containerImages[] | select(.ref == $image) | .sboms.spdxJson.path' testdata/attestation/chart/bom.json)"
          test -f "testdata/attestation/chart/$cyclonedx"
          test -f "testdata/attestation/chart/$spdx_json"
          jq -e --arg image "$IMAGE_REF" '.containerImages[] | select(.ref == $image) | .sboms.cyclonedx.cosign == true and .sboms.spdxJson.cosign == true' testdata/attestation/chart/bom.json
          digest="$(jq -r --arg image "$IMAGE_REF" '.containerImages[] | select(.ref == $image) | .digest' testdata/attestation/chart/bom.json)"
          attestation_ref="${IMAGE_REPOSITORY}@${digest}"
          cosign verify-attestation \
            --type cyclonedx \
            --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/ci.yml@refs/heads/main" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "$attestation_ref"
          cosign verify-attestation \
            --type spdxjson \
            --certificate-identity "https://github.com/${GITHUB_REPOSITORY}/.github/workflows/ci.yml@refs/heads/main" \
            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
            "$attestation_ref"