Skip to content

Commit 28b33c6

Browse files
saisatishkarrasaisatishkarra
authored
feat(e2e): provenance registry option for container generator (#294)
* feat(e2e): provenance registry option for container generator * Fix golangci and yaml linting issues
1 parent fbe9fc3 commit 28b33c6

File tree

2 files changed

+193
-0
lines changed

2 files changed

+193
-0
lines changed

‎.github/workflows/e2e.container.schedule.main.provenance-registry.slsa3.yml‎

Lines changed: 186 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
# This e2e test performs the following via a GitHub Actions schedule event.
2+
# - Build the Go application into a Docker image
3+
# - Push the image to ghcr.io
4+
# - Generate SLSA provenance for the image
5+
# - Upload the provenance to ghcr.io
6+
# - Verify the created provenance attestation.
7+
8+
on:
9+
schedule:
10+
- cron: "0 3 * * *"
11+
workflow_dispatch:
12+
13+
permissions: {}
14+
15+
concurrency: "e2e.container.schedule.main.provenance-registry.slsa3"
16+
17+
env:
18+
GH_TOKEN: ${{ secrets.E2E_CONTAINER_TOKEN }}
19+
ISSUE_REPOSITORY: slsa-framework/slsa-github-generator
20+
21+
IMAGE_REGISTRY: docker.io
22+
IMAGE_USERNAME: laurentsimon
23+
24+
PROVENACE_REGISTRY: ghcr.io
25+
# NOTE: This pushes a container image to a "namespace" under the
26+
# slsa-framework Dockerhub org.
27+
# The image name should be of the form: slsa-framework/example-package.<test name>
28+
IMAGE_NAME: slsa-framework/example-package.e2e.container.schedule.main.provenance-registry.slsa3
29+
30+
jobs:
31+
# Build the Go application into a Docker image
32+
# Push the image to docker.io
33+
build:
34+
permissions:
35+
contents: read # For reading repository contents.
36+
packages: write # For writing container images.
37+
outputs:
38+
image: ${{ steps.image.outputs.image }}
39+
digest: ${{ steps.build.outputs.digest }}
40+
username: ${{ env.IMAGE_USERNAME}}
41+
runs-on: ubuntu-latest
42+
steps:
43+
- name: Checkout the repository
44+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
45+
46+
- name: Set up Docker Buildx
47+
uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
48+
49+
- name: Authenticate Docker
50+
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
51+
with:
52+
registry: ${{ env.IMAGE_REGISTRY }}
53+
username: ${{ env.IMAGE_USERNAME }}
54+
password: ${{ secrets.E2E_DOCKER_HUB_TOKEN }}
55+
56+
- name: Extract metadata (tags, labels) for Docker
57+
id: meta
58+
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
59+
with:
60+
images: ${{ env.IMAGE_REGISTRY }}/${{ env.IMAGE_NAME }}
61+
62+
- name: Build and push Docker image
63+
uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
64+
id: build
65+
with:
66+
push: true
67+
tags: ${{ steps.meta.outputs.tags }}
68+
labels: ${{ steps.meta.outputs.labels }}
69+
70+
- name: Output image
71+
id: image
72+
run: |
73+
# NOTE: We need to use the image and digest in order to make sure
74+
# that the image we attest has not been modified.
75+
# NOTE: The digest output from docker/build-push-action is of the
76+
# form "sha256:<digest>"
77+
full_image_name="${IMAGE_REGISTRY}/${IMAGE_NAME}"
78+
echo "image=$full_image_name" >> "${GITHUB_OUTPUT}"
79+
80+
provenance-metadata:
81+
needs: [build]
82+
outputs:
83+
registry: ${{steps.image.outputs.image}}
84+
runs-on: ubuntu-latest
85+
steps:
86+
- name: Output Provenance Image
87+
id: image
88+
run: |
89+
# NOTE: We need to use the image and digest in order to make sure
90+
# that the image we attest has not been modified.
91+
# NOTE: The digest output from docker/build-push-action is of the
92+
# form "sha256:<digest>"
93+
full_image_name="${PROVENACE_REGISTRY}/${IMAGE_NAME}"
94+
echo "image=$full_image_name" >> "${GITHUB_OUTPUT}"
95+
96+
97+
# Generate SLSA provenance for the image
98+
# Downloads the image from docker.io
99+
# Upload the provenance to ghcr.io
100+
provenance:
101+
needs: [build, provenance-metadata]
102+
permissions:
103+
id-token: write # For signing.
104+
actions: read # For reading workflow info.
105+
packages: write # For uploading attestations.
106+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@main
107+
with:
108+
image: ${{ needs.build.outputs.image }}
109+
digest: ${{ needs.build.outputs.digest }}
110+
registry-username: ${{ needs.build.outputs.username }}
111+
provenance-registry-username: ${{ github.actor }}
112+
provenance-registry: ${{ needs.provenance-metadata.outputs.registry }}
113+
compile-generator: true
114+
secrets:
115+
registry-password: ${{ secrets.E2E_DOCKER_HUB_TOKEN }} # Dockerhub token for contaner image
116+
provenance-registry-password: ${{ secrets.E2E_CONTAINER_TOKEN }} # GH Token for provenance
117+
118+
# Verify the created provenance attestation.
119+
verify:
120+
# NOTE: this name is used as the status check name and by protected
121+
# branches for required status checks. It should have a unique name among
122+
# other pre-submits.
123+
name: verify container provenance
124+
needs: [build, provenance-metadata, provenance]
125+
permissions:
126+
packages: read # For reading attestations.
127+
runs-on: ubuntu-latest
128+
if: ${{ always() }}
129+
steps:
130+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
131+
- uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1
132+
- env:
133+
PROVENANCE_REGISTRY_USERNAME: ${{ github.actor }}
134+
PROVENANCE_REGISTRY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
135+
REGISTRY_USERNAME: ${{ env.IMAGE_USERNAME }}
136+
REGISTRY_PASSWORD: ${{ secrets.E2E_DOCKER_HUB_TOKEN }}
137+
IMAGE_NAME: ${{ needs.build.outputs.image }}
138+
PROVENANCE_REGISTRY: ${{ needs.provenance-metadata.outputs.registry }}
139+
IMAGE_DIGEST: ${{ needs.build.outputs.digest }}
140+
141+
run: |
142+
cosign login "${IMAGE_REGISTRY}" -u "${REGISTRY_USERNAME}" -p "${REGISTRY_PASSWORD}"
143+
144+
cosign login "${PROVENANCE_REGISTRY}" -u "${PROVENANCE_REGISTRY_USERNAME}" -p "${PROVENANCE_REGISTRY_PASSWORD}"
145+
146+
147+
# TODO: use --enforce-sct
148+
# TODO: add cue policy for further validation.
149+
# NOTE: COSIGN_EXPERIMENTAL is needed to check the transparency log.
150+
COSIGN_EXPERIMENTAL=1 \
151+
COSIGN_REPOSITORY="${PROVENANCE_REGISTRY}" \
152+
cosign verify-attestation \
153+
--type slsaprovenance \
154+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
155+
--certificate-identity https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/heads/main \
156+
"${IMAGE_NAME}@${IMAGE_DIGEST}" > "${GITHUB_WORKSPACE}/provenance.json"
157+
158+
echo "provenance_file=${GITHUB_WORKSPACE}/provenance.json" >> "$GITHUB_ENV"
159+
echo "container=${IMAGE_NAME}@${IMAGE_DIGEST}" >> "$GITHUB_ENV"
160+
- uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
161+
with:
162+
go-version: "1.20"
163+
- env:
164+
CONTAINER: "${{ env.container }}"
165+
PROVENANCE: "${{ env.provenance_file }}"
166+
run: ./.github/workflows/scripts/e2e.container.default.verify.sh
167+
168+
if-succeeded:
169+
runs-on: ubuntu-latest
170+
needs: [build, provenance, verify]
171+
# NOTE: The workflow is allowed to run for other event types but don't post
172+
# to issues unless it's a schedule event.
173+
if: github.event_name == 'schedule' && needs.build.result == 'success' && needs.provenance.result == 'success' && needs.verify.result == 'success'
174+
steps:
175+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
176+
- run: ./.github/workflows/scripts/e2e-report-success.sh
177+
178+
if-failed:
179+
runs-on: ubuntu-latest
180+
needs: [build, provenance, verify]
181+
# NOTE: The workflow is allowed to run for other event types but don't post
182+
# to issues unless it's a schedule event.
183+
if: always() && github.event_name == 'schedule' && (needs.build.result == 'failure' || needs.provenance.result == 'failure' || needs.verify.result == 'failure')
184+
steps:
185+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
186+
- run: ./.github/workflows/scripts/e2e-report-failure.sh

‎.golangci.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,13 @@ linters:
6868
- whitespace
6969
- wrapcheck
7070
linters-settings:
71+
depguard:
72+
rules:
73+
prevent_unmaintained_packages:
74+
list-mode: lax # allow unless explicitely denied
75+
allow:
76+
- $gostd
77+
- github.com/pborman/uuid
7178
errcheck:
7279
check-type-assertions: true
7380
check-blank: true

0 commit comments

Comments
 (0)