pre-submit.units.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: unit tests

on:
  push:
    branches: [main, "*"]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [main]
  merge_group:
  workflow_dispatch:

permissions: read-all

jobs:
  pre-submit:
    # NOTE: this name is used as the status check name and by protected
    # branches for required status checks. It should have a unique name among
    # other pre-submits.
    name: unit tests
    runs-on: ubuntu-latest
    if: ${{ always() }}
    steps:
      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
      - name: setup-go
        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
        with:
          go-version-file: "go.mod"

      - name: Set Node.js 16
        uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0
        with:
          node-version: 16

      - name: unit tests
        run: |
          set -euo pipefail
          make unit-test

  check-verifier:
    name: verify slsa-verifier is latest
    runs-on: ubuntu-latest
    if: ${{ always() }}
    steps:
      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          path: generator

      - name: Checkout
        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
        with:
          path: verifier
          repository: slsa-framework/slsa-verifier

      - name: Check verifier references
        shell: bash
        run: |
          set -euo pipefail

          # The first sha in SHA256SUM.md for slsa-verifier-linux-amd64 is the latest verifier release sha
          expected_sha=$(grep -m 1  -w -o -e '[0-9a-f]\{64\} *slsa-verifier-linux-amd64' verifier/SHA256SUM.md | awk '{ print $1 }')
          echo "$expected_sha"

          # The first vX.Y.Z in SHA256SUM.md is the latest verifier release version
          expected_version=$(grep -e 'v[0-9].[0-9].[0-9]' -o -m 1 -w verifier/SHA256SUM.md | head -1)
          echo "$expected_version"

          # Check for expected verifier releases in the builders
          cd generator
          error=0
          verifier_release_binary_sha256="$(grep -r -e 'VERIFIER_RELEASE_BINARY_SHA256: [0-9a-f]\{64\}' --include=*.yml)"
          while read -r line ; do
            sha=$(echo "$line" | grep -o -e '[0-9a-f]\{64\}')
            file=$(echo "$line" | awk '{print $1;}')
            if [ "$sha" != "$expected_sha" ]; then
              echo "SHA out of date in file $file expected $expected_sha"
              error=1
            fi
          done <<<"${verifier_release_binary_sha256}"

          verifier_release="$(grep -r -e 'VERIFIER_RELEASE: v[0-9].[0-9].[0-9]' --include=*.yml)"
          while read -r line ; do
            version=$(echo "$line" | grep -o -e 'v[0-9].[0-9].[0-9]')
            file=$(echo "$line" | awk '{print $1;}')
            if [ "$version" != "$expected_version" ]; then
              echo "Verifier version out of date in file $file expected $expected_version"
              error=1
            fi
          done <<<"${verifier_release}"

          if [ $error -ne 0 ]; then
            exit 1
          fi