69 lines (63 loc) · 2.09 KB
/
e2e.sign-attestations.schedule.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: schedule sign-attestations
on:
# Daily run.
schedule:
- cron: "0 4 * * *"
workflow_dispatch:
permissions: read-all
env:
GH_TOKEN: ${{ github.token }}
ISSUE_REPOSITORY: ${{ github.repository }}
jobs:
sign-attestations:
permissions:
contents: read
id-token: write
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
- id: setup
uses: ./.github/actions/sign-attestations
with:
attestations: .github/actions/sign-attestations/testdata/attestations
output-folder: outputs
- name: Setup node
uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
with:
node-version: 16
- name: install sigstore-js
run: npm i sigstore -g
# TODO: Add subject verification. This only verifies the signature on the DSSE envelope.
- name: run verify
working-directory: outputs
run: |
for file in *; do
sigstore verify $file
done
if-succeed:
needs: [sign-attestations]
runs-on: ubuntu-latest
# We use `== 'failure'` instead of ` != 'success'` because we want to ignore skipped jobs, if there are any.
if: github.event_name != 'workflow_dispatch' && needs.sign-attestations.result != 'failure'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
with:
repository: slsa-framework/example-package
ref: main
- run: ./.github/workflows/scripts/e2e-report-success.sh
if-failed:
needs: [sign-attestations]
runs-on: ubuntu-latest
if: always() && github.event_name != 'workflow_dispatch' && needs.sign-attestations.result == 'failure'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
with:
repository: slsa-framework/example-package
ref: main
- run: ./.github/workflows/scripts/e2e-report-failure.sh