extern/hishtory
1
0
Fork 0
mirror of https://github.com/ddworken/hishtory.git synced 2024-11-27 02:34:06 +01:00
Code Issues Packages Projects Releases Wiki Activity
9834c6f492
hishtory/.github/workflows/slsa-releaser.yml

225 lines
8.3 KiB
YAML
Raw Normal View History

Rename actions for consistent naming scheme
2023-02-24 18:56:49 +01:00
name: SLSA Client Releaser
Added SLSA builder
2022-04-09 05:59:24 +02:00
on:
workflow_dispatch:
turns out github releases require a tag, now it runs automatically for all tagged commits
2022-04-09 06:52:22 +02:00
push:
Add initial version of slsa releaser that validates the generated SLSA signatures
2023-11-04 06:09:54 +01:00
branches: [ master ]
turns out github releases require a tag, now it runs automatically for all tagged commits
2022-04-09 06:52:22 +02:00
tags:
- "*"
Added SLSA builder
2022-04-09 05:59:24 +02:00
permissions: read-all
jobs:
# ldflags to embed the commit hash in the binary
args:
runs-on: ubuntu-latest
outputs:
ldflags: ${{ steps.ldflags.outputs.value }}
steps:
- id: checkout
uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.3.4
with:
fetch-depth: 0
- id: ldflags
run: |
trying again with ldflags + fixed update url
2022-04-09 07:56:44 +02:00
echo "::set-output name=value::$(./scripts/client-ldflags)"
it ran, but still no ldflag. trying again for that + getting rid of the if for release + back to only running on manual trigger
2022-04-09 06:42:19 +02:00
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
# Trusted builders
build-linux-amd64:
Added SLSA builder
2022-04-09 05:59:24 +02:00
permissions:
id-token: write
Update permissions
2022-05-28 08:30:49 +02:00
contents: write
Add permissions that 1.2.1 apparently requires
2022-10-31 07:27:56 +01:00
actions: read
Added SLSA builder
2022-04-09 05:59:24 +02:00
needs: args
Add missing @
2022-10-31 22:19:26 +01:00
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
Added SLSA builder
2022-04-09 05:59:24 +02:00
with:
Reorganize slsa config files + attempt to build for freebsd + windows
2022-11-05 04:57:28 +01:00
config-file: .github/slsa/.slsa-goreleaser-linux-amd64.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
Reorganize slsa config files + attempt to build for freebsd + windows
2022-11-05 04:57:28 +01:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
Add support for linux arm64 for #48
2022-12-12 05:39:45 +01:00
build-linux-arm64:
permissions:
id-token: write
contents: write
actions: read
needs: args
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
with:
config-file: .github/slsa/.slsa-goreleaser-linux-arm64.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
Add support for linux arm64 for #48
2022-12-12 05:39:45 +01:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
Add support for arm7 for #63 to support raspberry pis
2023-02-19 07:00:39 +01:00
build-linux-arm7:
permissions:
id-token: write
contents: write
actions: read
needs: args
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
with:
config-file: .github/slsa/.slsa-goreleaser-linux-arm7.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
Add support for arm7 for #63 to support raspberry pis
2023-02-19 07:00:39 +01:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
Reorganize slsa config files + attempt to build for freebsd + windows
2022-11-05 04:57:28 +01:00
build-freebsd-amd64:
permissions:
id-token: write
contents: write
actions: read
needs: args
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
with:
config-file: .github/slsa/.slsa-goreleaser-freebsd-amd64.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
Reorganize slsa config files + attempt to build for freebsd + windows
2022-11-05 04:57:28 +01:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
Add netbsd binary for #87
2023-09-20 03:54:04 +02:00
build-netbsd-amd64:
permissions:
id-token: write
contents: write
actions: read
needs: args
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
with:
config-file: .github/slsa/.slsa-goreleaser-netbsd-amd64.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
Add netbsd binary for #87
2023-09-20 03:54:04 +02:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
CHeck if it is the config-file directive that is messing up the hash
2022-05-28 18:29:56 +02:00
build-darwin-amd64:
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
permissions:
id-token: write
contents: write
Add permissions that 1.2.1 apparently requires
2022-10-31 07:27:56 +01:00
actions: read
Try executing in sequence
2022-05-28 18:34:53 +02:00
needs:
- args
Swap back to 1.2.1
2022-10-31 22:04:01 +01:00
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
with:
Reorganize slsa config files + attempt to build for freebsd + windows
2022-11-05 04:57:28 +01:00
config-file: .github/slsa/.slsa-goreleaser-darwin-amd64.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
Add workaround for slsa breakage
2022-10-02 00:14:51 +02:00
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
build-darwin-arm64:
permissions:
id-token: write
contents: write
Add permissions that 1.2.1 apparently requires
2022-10-31 07:27:56 +01:00
actions: read
Try executing in sequence
2022-05-28 18:34:53 +02:00
needs:
- args
Swap back to 1.2.1
2022-10-31 22:04:01 +01:00
uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.2.1
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
with:
Reorganize slsa config files + attempt to build for freebsd + windows
2022-11-05 04:57:28 +01:00
config-file: .github/slsa/.slsa-goreleaser-darwin-arm64.yml
Upgrade to go 1.21 which offers fully reproducible builds (on top of SLSA's attestations)
2023-10-02 03:00:58 +02:00
go-version: 1.21
envs --> evaluated-envs to match updated slsa builder
2022-05-28 08:28:01 +02:00
evaluated-envs: "VERSION_LDFLAGS:${{needs.args.outputs.ldflags}}"
Add workaround for slsa breakage
2022-10-02 00:14:51 +02:00
compile-builder: true # See github.com/slsa-framework/slsa-github-generator/issues/942
Delete separate signer and start the work of merging it into the SLSA releaser action
2022-05-24 03:22:03 +02:00
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
# Sign the binaries and upload the signed binaries
Delete separate signer and start the work of merging it into the SLSA releaser action
2022-05-24 03:22:03 +02:00
macos_signer:
runs-on: macos-11.0
Tweak the workflow order so signing runs after upload
2022-05-24 17:46:24 +02:00
needs:
Add integration to validate macos signers too
2023-11-04 06:16:11 +01:00
- build-darwin-amd64
- build-darwin-arm64
Add explicit permissions to allow writes
2022-05-27 06:42:09 +02:00
permissions:
contents: write
Added SLSA builder
2022-04-09 05:59:24 +02:00
steps:
Delete separate signer and start the work of merging it into the SLSA releaser action
2022-05-24 03:22:03 +02:00
- uses: actions/checkout@v2
- name: Download and sign the latest executables
env:
Manually download github artifact rather than using the action since the action seems to be flaky
2023-11-05 20:37:14 +01:00
GH_TOKEN: ${{ github.token }}
Delete separate signer and start the work of merging it into the SLSA releaser action
2022-05-24 03:22:03 +02:00
MACOS_CERTIFICATE: ${{ secrets.MACOS_CERTIFICATE }}
MACOS_CERTIFICATE_PWD: ${{ secrets.MACOS_CERTIFICATE_PWD }}
run: |
MIgrate to a python script for signign
2022-05-24 08:25:12 +02:00
export GITHUB_TOKEN="${{ secrets.GITHUB_TOKEN }}"
Manually download github artifact rather than using the action since the action seems to be flaky
2023-11-05 20:37:14 +01:00
gh run download -n hishtory-darwin-amd64
gh run download -n hishtory-darwin-arm64
Add more debugging information to signing workflow
2022-05-27 06:57:16 +02:00
brew install md5sha1sum
MIgrate to a python script for signign
2022-05-24 08:25:12 +02:00
python3 scripts/actions-sign.py
Upload artifacts from macos signer even if this isn't a release, since they're needed for validation
2023-11-04 06:31:43 +01:00
- name: Upload Artifacts
uses: actions/upload-artifact@v3
with:
name: hishtory-darwin-arm64
Fix SLSA releaser to specify required parameter path
2023-11-04 06:42:52 +01:00
path: hishtory-darwin-arm64
Upload artifacts from macos signer even if this isn't a release, since they're needed for validation
2023-11-04 06:31:43 +01:00
- name: Upload Artifacts
uses: actions/upload-artifact@v3
with:
name: hishtory-darwin-amd64
Fix SLSA releaser to specify required parameter path
2023-11-04 06:42:52 +01:00
path: hishtory-darwin-amd64
Upload artifacts from macos signer even if this isn't a release, since they're needed for validation
2023-11-04 06:31:43 +01:00
- name: Upload Artifacts
uses: actions/upload-artifact@v3
with:
name: hishtory-darwin-arm64-unsigned
Fix SLSA releaser to specify required parameter path
2023-11-04 06:42:52 +01:00
path: hishtory-darwin-arm64-unsigned
Upload artifacts from macos signer even if this isn't a release, since they're needed for validation
2023-11-04 06:31:43 +01:00
- name: Upload Artifacts
uses: actions/upload-artifact@v3
with:
name: hishtory-darwin-amd64-unsigned
Fix SLSA releaser to specify required parameter path
2023-11-04 06:42:52 +01:00
path: hishtory-darwin-amd64-unsigned
Added SLSA builder
2022-04-09 05:59:24 +02:00
- name: Release
Delete separate signer and start the work of merging it into the SLSA releaser action
2022-05-24 03:22:03 +02:00
uses: softprops/action-gh-release@v1
if: startsWith(github.ref, 'refs/tags/')
Added SLSA builder
2022-04-09 05:59:24 +02:00
with:
files: |
Fix release filenames
2022-05-25 07:26:24 +02:00
hishtory-darwin-arm64
More debugging info for the releaser action
2022-05-27 07:24:56 +02:00
hishtory-darwin-arm64-unsigned
Fix release filenames
2022-05-25 07:26:24 +02:00
hishtory-darwin-amd64
Export the unsigned files for a new theory on how SLSA verification can be done
2022-05-27 08:09:00 +02:00
hishtory-darwin-amd64-unsigned
Trigger cron from github actions
2022-05-28 07:48:13 +02:00
- name: Trigger the backend API service so it knows a release is finished
run: |
curl https://api.hishtory.dev/api/v1/trigger-cron
Delete separate signer and start the work of merging it into the SLSA releaser action
2022-05-24 03:22:03 +02:00
Add initial version of slsa releaser that validates the generated SLSA signatures
2023-11-04 06:09:54 +01:00
# Validate the signed binaries
validate:
MIgrate to a python script for signign
2022-05-24 08:25:12 +02:00
permissions:
Add initial version of slsa releaser that validates the generated SLSA signatures
2023-11-04 06:09:54 +01:00
contents: read
Swap to running SLSA validation on macos since we need codesign_allocate to validate signatures on macos
2023-11-05 21:37:49 +01:00
runs-on: macos-latest
MIgrate to a python script for signign
2022-05-24 08:25:12 +02:00
needs:
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
- build-linux-amd64
CHeck if it is the config-file directive that is messing up the hash
2022-05-28 18:29:56 +02:00
- build-darwin-amd64
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
- build-darwin-arm64
Add integration to validate macos signers too
2023-11-04 06:16:11 +01:00
- macos_signer
MIgrate to a python script for signign
2022-05-24 08:25:12 +02:00
steps:
Clone repo and setup go for validation
2023-11-04 17:51:58 +01:00
- uses: actions/checkout@v4
- name: Set up Go
uses: actions/setup-go@v3
with:
go-version: 1.21
MIgrate to a python script for signign
2022-05-24 08:25:12 +02:00
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
A new way of releasing, taking advantage of config-file to avoid having to create a new commit per platform
2022-05-28 09:01:38 +02:00
name: hishtory-linux-amd64
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-linux-amd64.intoto.jsonl
Add SLSA self-validation for hishtory-linux-arm64
2023-11-05 21:27:44 +01:00
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-linux-arm64
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-linux-arm64.intoto.jsonl
Add SLSA self-validation for hishtory-darwin-amd64
2023-11-05 21:24:47 +01:00
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-darwin-amd64
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-darwin-amd64.intoto.jsonl
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-darwin-amd64-unsigned
Add SLSA self-validation for hishtory-darwin-arm64
2023-11-05 21:25:58 +01:00
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-darwin-arm64
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-darwin-arm64.intoto.jsonl
- uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
with:
name: hishtory-darwin-arm64-unsigned
Add initial version of slsa releaser that validates the generated SLSA signatures
2023-11-04 06:09:54 +01:00
- name: Validate Release
run: |
Swap slsa validation to use hishtory built at head
2023-11-05 08:55:01 +01:00
go build; ./hishtory install
Add validation of macos signatures
2023-11-05 21:42:00 +01:00
# Validate SLSA attestations
Update slsa validation to not validate version when running in github actions, since the one in actions isn't associated with a released version
2023-11-05 09:15:54 +01:00
./hishtory validate-binary hishtory-linux-amd64 hishtory-linux-amd64.intoto.jsonl
Add SLSA self-validation for hishtory-linux-arm64
2023-11-05 21:27:44 +01:00
./hishtory validate-binary hishtory-linux-arm64 hishtory-linux-arm64.intoto.jsonl
Add SLSA self-validation for hishtory-darwin-amd64
2023-11-05 21:24:47 +01:00
./hishtory validate-binary hishtory-darwin-amd64 hishtory-darwin-amd64.intoto.jsonl --is_macos=True --macos_unsigned_binary=hishtory-darwin-amd64-unsigned
Add SLSA self-validation for hishtory-darwin-arm64
2023-11-05 21:25:58 +01:00
./hishtory validate-binary hishtory-darwin-arm64 hishtory-darwin-arm64.intoto.jsonl --is_macos=True --macos_unsigned_binary=hishtory-darwin-arm64-unsigned
Add validation of macos signatures
2023-11-05 21:42:00 +01:00
# Validate MacOS signatures
python3 scripts/actions-validate-macos-signature.py hishtory-darwin-amd64
python3 scripts/actions-validate-macos-signature.py hishtory-darwin-arm64
# TODO: Run validation using hishtory built at HEAD too
Reference in New Issue Copy Permalink