Skip to content

schedule sign-attestations #716

schedule sign-attestations

schedule sign-attestations #716

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: schedule sign-attestations
on:
# Daily run.
schedule:
- cron: "0 4 * * *"
workflow_dispatch:
permissions: read-all
env:
GH_TOKEN: ${{ github.token }}
ISSUE_REPOSITORY: ${{ github.repository }}
jobs:
sign-attestations:
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- id: setup
uses: ./.github/actions/sign-attestations
with:
attestations: .github/actions/sign-attestations/testdata/attestations
output-folder: outputs
- name: Setup node
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
with:
node-version: 20
- name: install sigstore-js
run: npm ci
# TODO: Add subject verification. This only verifies the signature on the DSSE envelope.
- name: run verify
run: |
set -euo pipefail
for file in outputs/*; do
npx sigstore verify "$file"
done
if-succeed:
needs: [sign-attestations]
runs-on: ubuntu-latest
# We use `== 'failure'` instead of ` != 'success'` because we want to ignore skipped jobs, if there are any.
if: github.event_name != 'workflow_dispatch' && needs.sign-attestations.result != 'failure'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: slsa-framework/example-package
ref: main
- run: ./.github/workflows/scripts/e2e-report-success.sh
if-failed:
needs: [sign-attestations]
runs-on: ubuntu-latest
if: always() && github.event_name != 'workflow_dispatch' && needs.sign-attestations.result == 'failure'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
repository: slsa-framework/example-package
ref: main
- run: ./.github/workflows/scripts/e2e-report-failure.sh