debug.generic-generator.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# a test workflow for debugging the generic generator

name: debug-generic-generator

on:
    push:

permissions: read-all

env:
  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

jobs:
  build:
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    runs-on: ubuntu-latest
    steps:
      - name: Build artifacts
        run: |
          # These are some amazing artifacts.
          echo "foo" > artifact1
          echo "bar" > artifact2

      - name: Generate hashes
        shell: bash
        id: hash
        run: |
          # sha256sum generates sha256 hash for all artifacts.
          # base64 -w0 encodes to base64 and outputs on a single line.
          # sha256sum artifact1 artifact2 ... | base64 -w0
          echo "hashes=$(sha256sum artifact1 artifact2 | base64 -w0)" >> "$GITHUB_OUTPUT"

      - name: Upload artifact1
        uses: actions/upload-artifact@v4
        with:
          name: artifact1
          path: artifact1
          if-no-files-found: error
          retention-days: 5

      - name: Upload artifact2
        uses: actions/upload-artifact@v4
        with:
          name: artifact2
          path: artifact2
          if-no-files-found: error
          retention-days: 5

  provenance:
    needs: build
    permissions:
      id-token: write # For signing.
      contents: write # For asset uploads.
      actions: read # For reading workflow info.
    uses: ./.github/workflows/generator_generic_slsa3.yml
    with:
      base64-subjects: "${{ needs.build.outputs.hashes }}"
      compile-generator: true
      provenance-name: build.intoto.jsonl
      upload-assets: true

  verify:
    needs: provenance
    runs-on: ubuntu-latest
    steps:
      - name: Download artifact1
        uses: actions/download-artifact@v4
        with:
          name: artifact1
      - name: Download artifact2
        uses: actions/download-artifact@v4
        with:
          name: artifact2
      - name: Download provenance
        uses: actions/download-artifact@v4
        with:
          name: build.intoto.jsonl
      - uses: actions/setup-go@v5
        with:
          go-version: 1.22
      - name: Setup slsa-verifier
        run: go install github.com/slsa-framework/slsa-verifier/v2/cli/slsa-verifier@verify-sigstore-go-Bundlev2
      - name: Verify
        run: |
          SLSA_VERIFIER_TESTING=1 slsa-verifier verify-artifact \
            artifact1 artifact2 \
            --provenance-path build.intoto.jsonl \
            --source-uri github.com/slsa-framework/slsa-github-generator \
            --source-branch ramonpetgrave64-internal-builder-sigstore-bundle \
            --print-provenance