-
Notifications
You must be signed in to change notification settings - Fork 115
51 lines (46 loc) · 1.69 KB
/
pre-submit.e2e.docker-based.default.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
name: pre-submit e2e docker-based default
on:
pull_request:
branches: [main]
merge_group:
workflow_dispatch:
permissions: read-all
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
jobs:
build-docker-based:
permissions:
id-token: write # For signing.
contents: write # For asset uploads.
actions: read # For reading workflow info.
uses: ./.github/workflows/builder_docker-based_slsa3.yml
with:
builder-image: "bash"
builder-digest: "sha256:9e2ba52487d945504d250de186cb4fe2e3ba023ed2921dd6ac8b97ed43e76af9"
config-path: "internal/builders/docker/testdata/config.toml"
compile-builder: true
verify:
needs: build-docker-based
runs-on: ubuntu-latest
env:
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
GITHUB_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
steps:
- uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
- uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b
with:
name: ${{ needs.build-docker-based.outputs.build-outputs-name }}
path: outputs
- name: Get build artifact
id: build
run: |
name=$(find outputs/ -type f | head -1)
cp $name .
echo "name=$(basename $name)" >> $GITHUB_OUTPUT
- uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b
with:
name: ${{ needs.build-docker-based.outputs.attestations-download-name }}
- env:
BINARY: ${{ steps.build.outputs.name }}
PROVENANCE: ${{ steps.build.outputs.name }}.intoto
run: ./.github/workflows/scripts/pre-submit.e2e.docker-based.default.sh