-
Notifications
You must be signed in to change notification settings - Fork 115
94 lines (81 loc) · 2.94 KB
/
pre-submit.units.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: unit tests
on:
push:
branches: [main, "*"]
pull_request:
# The branches below must be a subset of the branches above
branches: [main]
merge_group:
workflow_dispatch:
permissions: read-all
jobs:
pre-submit:
# NOTE: this name is used as the status check name and by protected
# branches for required status checks. It should have a unique name among
# other pre-submits.
name: unit tests
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
- name: setup-go
uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
with:
go-version: 1.19
- name: Set Node.js 16
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3.6.0
with:
node-version: 16
- name: unit tests
run: |
set -euo pipefail
make unit-test
check-verifier:
name: verify slsa-verifier is latest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
with:
path: generator
- name: Checkout
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
with:
path: verifier
repository: slsa-framework/slsa-verifier
- name: Check verifier references
shell: bash
run: |
set -euo pipefail
# The first sha in SHA256SUM.md is the latest verifier release sha
expected_sha=$(cat verifier/SHA256SUM.md | grep -m 1 -w -o -e '[0-9a-f]\{64\}')
echo "$expected_sha"
# The first vX.Y.Z in SHA256SUM.md is the latest verifier release version
expected_version=$(cat verifier/SHA256SUM.md | grep -e 'v[0-9].[0-9].[0-9]' -o -m 1 -w | head -1)
echo "$expected_version"
# Check for expected verifier releases in the builders
cd generator
error=0
grep -r -e 'VERIFIER_RELEASE_BINARY_SHA256: [0-9a-f]\{64\}' --include=*.yml |
while read -r line ; do
sha=$(echo $line | grep -o -e '[0-9a-f]\{64\}')
file=$(echo $line | awk '{print $1;}')
if [ "$sha" != "$expected_sha" ]; then
echo "SHA out of date in file $file expected $expected_sha"
error=1
fi
done
grep -r -e 'VERIFIER_RELEASE: v[0-9].[0-9].[0-9]' --include=*.yml |
while read -r line ; do
version=$(echo $line | grep -o -e 'v[0-9].[0-9].[0-9]')
file=$(echo $line | awk '{print $1;}')
if [ "$version" != "$expected_version" ]; then
echo "Verifier version out of date in file $file expected $expected_version"
error=1
fi
done
if [ $error -ne 0 ]; then
exit 1
fi