-
Notifications
You must be signed in to change notification settings - Fork 115
78 lines (71 loc) · 2.98 KB
/
e2e.create-docker_based-predicate.schedule.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
name: schedule create-docker_based-predicate
# This workflow requires `id-token: write` permissions to determine the
# builder identity.
on:
# Daily run.
schedule:
- cron: "0 4 * * *"
workflow_dispatch:
permissions: read-all
env:
GH_TOKEN: ${{ github.token }}
ISSUE_REPOSITORY: ${{ github.repository }}
jobs:
predicate:
outputs:
repository: ${{ steps.detect.outputs.repository }}
ref: ${{ steps.detect.outputs.ref }}
workflow: ${{ steps.detect.outputs.workflow }}
runs-on: ubuntu-latest
permissions:
id-token: write # Needed to detect the current reusable repository and ref.
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
- name: Detect the builder ref
id: detect
uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@main
- name: Update the build definition
# We use a build definition hard-coded in testadata. To ensure validation against
# workflow context, we must update the source references.
run: |
bdTemplate="internal/builders/docker/testdata/build-definition.json"
jq -r --arg GITHUB_SHA "$GITHUB_SHA" '.externalParameters.source.digest.sha1 = $GITHUB_SHA' "${bdTemplate}" > build-definition.json
- name: Create predicate
id: predicate
uses: ./.github/actions/create-docker_based-predicate
with:
build-definition: "build-definition.json"
binary-sha256: "46b3ce0fbb2998880c5518225b41ddf49fc0850b9b9a25e1ac944bc587c03ea7"
binary-uri: "git+https://github.com/${{ steps.detect.outputs.repository }}@${{ steps.detect.outputs.ref }}"
builder-id: "https://github.com/${{ steps.detect.outputs.repository }}/${{ steps.detect.outputs.workflow }}@${{ steps.detect.outputs.ref }}"
output-file: "predicate.json"
- run: ./.github/workflows/scripts/schedule.actions/verify-docker_based-predicate.sh
env:
PREDICATE: predicate.json
if-succeed:
needs: [predicate]
runs-on: ubuntu-latest
# We use `== 'failure'` instead of ` != 'success'` because we want to ignore skipped jobs, if there are any.
if: github.event_name != 'workflow_dispatch' && needs.predicate.result != 'failure'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
with:
repository: slsa-framework/example-package
ref: main
- run: ./.github/workflows/scripts/e2e-report-success.sh
if-failed:
needs: [predicate]
runs-on: ubuntu-latest
if: always() && github.event_name != 'workflow_dispatch' && needs.predicate.result == 'failure'
permissions:
contents: read
issues: write
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
with:
repository: slsa-framework/example-package
ref: main
- run: ./.github/workflows/scripts/e2e-report-failure.sh