-
Notifications
You must be signed in to change notification settings - Fork 115
/
action.yml
93 lines (85 loc) · 4.21 KB
/
action.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: "Generate the builder"
description: "Build or fetch the builder binary"
inputs:
ref:
description: "A fully formed ref (refs/...) or SHA to checkout for the action code."
required: true
builder-ref:
description: "A fully formed ref (refs/...) or SHA to generate the builder. If not provided, defaults to inputs.ref"
required: false
repository:
description: "Repository of the builder."
required: true
binary:
description: "Name of the compiled binary. (Note: just the filename, not the path)"
required: true
compile-builder:
description: "Whether to compile the builder or not."
required: true
directory:
description: "Directory of the source code of the builder. (Note: expect no trailing `/`)"
required: true
go-version:
description: "The Go version to use, as expected by https://github.com/actions/setup-go."
required: true
allow-private-repository:
description: "If set to true, allows the action to complete successfully even if the repo is private."
type: boolean
required: false
default: false
token:
description: "GitHub token"
required: false
default: ${{ github.token }}
outputs:
sha256:
description: "SHA256 of the builder binary."
value: ${{ steps.compute.outputs.sha256 }}
runs:
using: "composite"
steps:
- name: Checkout builder repository
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
with:
repository: ${{ inputs.repository }}
ref: ${{ inputs.ref }}
path: __BUILDER_CHECKOUT_DIR__
- name: Check private repos
uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check
with:
error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override."
override: ${{ inputs.allow-private-repository }}
- name: Set up Go environment
uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
with:
go-version: ${{ inputs.go-version }}
- name: Generate builder
shell: bash
env:
# Builder.
BUILDER_REPOSITORY: slsa-framework/slsa-github-generator # The repository to download the pre-built builder binary from.
BUILDER_RELEASE_BINARY: "${{ inputs.binary }}" # The name of the pre-built binary in the release assets. This is also used as the final binary name when compiling the builder from source.
# Verifier
# NOTE: These VERIFIER_* variables are used in the builder-fetch.sh script for verification of builder
# release binaries when the compile-builder input is false.
VERIFIER_REPOSITORY: slsa-framework/slsa-verifier # The repository to download the pre-built verifier binary from.
VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64 # The name of the verifier binary in the release assets.
VERIFIER_RELEASE_BINARY_SHA256: 538e5346784ddab14189dd66fb995e49c69247985a364558ad3b44e1fbff04cf # The expected hash of the verifier binary.
VERIFIER_RELEASE: v2.1.0 # The version of the verifier to download.
COMPILE_BUILDER: "${{ inputs.compile-builder }}"
# NOTE: If a builder reference is specified, then we will download this version of the builder.
# Otherwise, we use the same tag reference as the detected workflow source reference. This allows
# pinning the builder binary version at the same as the reuseable workflow reference, and avoids
# dynamically fetching a builder binary.
# The builder-ref option can be used to test the scripts at main to download a builder binary at
# a previous tag.
BUILDER_REF: "${{ inputs.builder-ref || inputs.ref }}" # The version of the builder to retrieve.
BUILDER_DIR: "./__BUILDER_CHECKOUT_DIR__/${{ inputs.directory }}"
# Needed for the gh CLI used in builder-fetch.sh.
GH_TOKEN: "${{ inputs.token }}"
run: ./__BUILDER_CHECKOUT_DIR__/.github/actions/generate-builder/generate-builder.sh
- name: Compute sha256 of builder
uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256
id: compute
with:
path: "${{ inputs.binary }}"