pre-submit.e2e.generic.default.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: pre-submit e2e generic default

on:
  pull_request:
    branches: [main]
  merge_group:
  workflow_dispatch:

permissions: read-all

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  build:
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: ./.github/workflows/generator_generic_slsa3.yml
    with:
      # echo "2e0390eb024a52963db7b95e84a9c2b12c004054a7bad9a97ec0c7c89d4681d2    binary-name" | base64 -w0
      base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
      compile-generator: true
      provenance-name: build.intoto.jsonl

  verify:
    # NOTE: this name is used as the status check name and by protected
    # branches for required status checks. It should have a unique name among
    # other pre-submits.
    name: verify generic provenance
    runs-on: ubuntu-latest
    needs: [build]
    if: ${{ always() }}
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: ${{ needs.build.outputs.provenance-name }}
      - env:
          BINARY: "binary-name"
          PROVENANCE: ${{ needs.build.outputs.provenance-name }}
        run: ./.github/workflows/scripts/pre-submit.e2e.generic.default.sh

  build-continue-no-error:
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: ./.github/workflows/generator_generic_slsa3.yml
    with:
      # echo "2e0390eb024a52963db7b95e84a9c2b12c004054a7bad9a97ec0c7c89d4681d2    binary-name" | base64 -w0
      base64-subjects: "MmUwMzkwZWIwMjRhNTI5NjNkYjdiOTVlODRhOWMyYjEyYzAwNDA1NGE3YmFkOWE5N2VjMGM3Yzg5ZDQ2ODFkMiAgICBiaW5hcnktbmFtZQo="
      compile-generator: true
      continue-on-error: true
      provenance-name: build-continue-no-error.intoto.jsonl

  verify-continue-no-error:
    # NOTE: this name is used as the status check name and by protected
    # branches for required status checks. It should have a unique name among
    # other pre-submits.
    name: verify generic provenance (continue-on-error)
    runs-on: ubuntu-latest
    needs: [build-continue-no-error]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: ${{ needs.build-continue-no-error.outputs.provenance-name }}
      - env:
          BINARY: "binary-name"
          PROVENANCE: ${{ needs.build-continue-no-error.outputs.provenance-name }}
          OUTCOME: ${{ needs.build-continue-no-error.outputs.outcome }}
        run: |
          [ "$OUTCOME" == "success" ] && ./.github/workflows/scripts/pre-submit.e2e.generic.default.sh

  build-continue-invalid-subjects:
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: ./.github/workflows/generator_generic_slsa3.yml
    with:
      base64-subjects: "invalid base64 subjects"
      compile-generator: true
      continue-on-error: true
      provenance-name: build-continue-invalid-subjects.intoto.jsonl

  verify-continue-invalid-subjects:
    # NOTE: this name is used as the status check name and by protected
    # branches for required status checks. It should have a unique name among
    # other pre-submits.
    name: verify generic provenance (continue-on-error invalid subjects)
    runs-on: ubuntu-latest
    needs: [build, build-continue-invalid-subjects]
    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
        with:
          name: ${{ needs.build.outputs.provenance-name }}
      - env:
          BINARY: "binary-name"
          PROVENANCE: ${{ needs.build-continue-invalid-subjects.outputs.provenance-name }}
          OUTCOME: ${{ needs.build-continue-invalid-subjects.outputs.outcome }}
        run: |
          [ "$OUTCOME" == "failure" ]

          # Note: we don't call ./.github/workflows/scripts/pre-submit.e2e.generic.default.sh
          # because the provenance generation failed, so there is no provenance generated.