pre-submit.e2e.container-based.default.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: pre-submit e2e container-based default

on:
  pull_request:
    branches: [main]
  merge_group:
  workflow_dispatch:

permissions: read-all

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  build-container-based:
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: ./.github/workflows/builder_container-based_slsa3.yml
    with:
      builder-image: "bash"
      builder-digest: "sha256:9e2ba52487d945504d250de186cb4fe2e3ba023ed2921dd6ac8b97ed43e76af9"
      config-path: "internal/builders/docker/testdata/config.toml"
      compile-builder: true

  verify:
    needs: build-container-based
    runs-on: ubuntu-latest
    env:
      HEAD_SHA: ${{ github.event.pull_request.head.sha }}
      GITHUB_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: ${{ needs.build-container-based.outputs.build-outputs-name }}
          path: outputs
      - name: Get build artifact
        id: build
        run: |
          set -euo pipefail
          name=$(find outputs/ -type f | head -1)
          cp "$name" .
          echo "name=$(basename "$name")" >> "$GITHUB_OUTPUT"
      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: ${{ needs.build-container-based.outputs.attestations-download-name }}
      - env:
          BINARY: ${{ steps.build.outputs.name }}
          PROVENANCE: ${{ steps.build.outputs.name }}.intoto
        run: ./.github/workflows/scripts/pre-submit.e2e.container-based.default.sh