Skip to content

Commit 012ebd8

Browse files
vdemeestervdemeester
committed
Bootstrap a CI using GitHub workflows
- Add a Build job to build the git-init image - Add a dependabot configuration (to keep go packages and github actions up-to-date) - Add a unfinished Release job and gorelease configuration
1 parent b33cc3e commit 012ebd8

File tree

5 files changed

+269
-0
lines changed

5 files changed

+269
-0
lines changed

‎.github/dependabot.yml

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "gomod" # See documentation for possible values
4+
directory: "/git" # Location of package manifests
5+
schedule:
6+
interval: "daily"
7+
- package-ecosystem: "github-actions"
8+
directory: "/"
9+
schedule:
10+
interval: "daily"

‎.github/workflows/build.yaml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Build
2+
3+
on:
4+
pull_request:
5+
branches: ['main']
6+
push:
7+
branches: [ main ]
8+
schedule:
9+
- cron: '0 0 * * *'
10+
11+
jobs:
12+
13+
build:
14+
defaults:
15+
run:
16+
working-directory: image/git-init
17+
strategy:
18+
fail-fast: false
19+
matrix:
20+
go-version: ['1.19', '1.20']
21+
name: Build ${{ matrix.go-version }}
22+
runs-on: ubuntu-latest
23+
24+
steps:
25+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
26+
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
27+
with:
28+
go-version: ${{ matrix.go-version }}
29+
check-latest: true
30+
31+
- uses: golang/govulncheck-action@dd3ead030e4f2cf713062f7a3395191802364e13 # v1
32+
33+
- run: |
34+
go build ./...
35+
go test -run=^$ ./...

‎.github/workflows/release.yaml

+151
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
name: release
2+
3+
#on:
4+
# push:
5+
# tags:
6+
# - '*'
7+
# FIXME(vdemeester) Add commit + tag
8+
9+
jobs:
10+
goreleaser:
11+
outputs:
12+
hashes: ${{ steps.hash.outputs.hashes }}
13+
tag_name: ${{ steps.tag.outputs.tag_name }}
14+
15+
defaults:
16+
run:
17+
working-directory: image/git-init
18+
19+
permissions:
20+
packages: write
21+
id-token: write
22+
contents: write
23+
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
27+
28+
- run: git fetch --prune --unshallow
29+
30+
- uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
31+
with:
32+
go-version: '1.20'
33+
check-latest: true
34+
35+
# This installs the current latest release.
36+
- uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6
37+
with:
38+
version: v0.13.0
39+
40+
- uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
41+
42+
- uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v3.1.1
43+
44+
- name: Set tag output
45+
id: tag
46+
run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT"
47+
48+
- uses: goreleaser/goreleaser-action@3fa32b8bb5620a2c1afe798654bbad59f9da4906 # v4.4.0
49+
id: run-goreleaser
50+
with:
51+
version: latest
52+
args: release --clean
53+
env:
54+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55+
56+
- name: sign ko-image
57+
run: |
58+
digest=$(crane digest "${REGISTRY}":"${GIT_TAG}")
59+
cosign sign --yes \
60+
-a GIT_HASH="${GIT_HASH}" \
61+
-a GIT_TAG="${GIT_TAG}" \
62+
-a RUN_ID="${RUN_ID}" \
63+
-a RUN_ATTEMPT="${RUN_ATTEMPT}" \
64+
"${REGISTRY}@${digest}"
65+
env:
66+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67+
GIT_HASH: ${{ github.sha }}
68+
GIT_TAG: ${{ steps.tag.outputs.tag_name }}
69+
RUN_ATTEMPT: ${{ github.run_attempt }}
70+
RUN_ID: ${{ github.run_id }}
71+
REGISTRY: "ghcr.io/${{ github.repository }}"
72+
73+
- name: Generate subject
74+
id: hash
75+
env:
76+
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
77+
run: |
78+
set -euo pipefail
79+
80+
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
81+
echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
82+
83+
provenance:
84+
needs:
85+
- goreleaser
86+
87+
permissions:
88+
actions: read # To read the workflow path.
89+
id-token: write # To sign the provenance.
90+
contents: write # To add assets to a release.
91+
92+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
93+
with:
94+
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
95+
upload-assets: true
96+
upload-tag-name: "${{ needs.release.outputs.tag_name }}"
97+
98+
verification:
99+
needs:
100+
- goreleaser
101+
- provenance
102+
103+
runs-on: ubuntu-latest
104+
permissions: read-all
105+
106+
steps:
107+
# Note: this will be replaced with the GHA in the future.
108+
- name: Install the verifier
109+
env:
110+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
111+
run: |
112+
set -euo pipefail
113+
114+
gh -R slsa-framework/slsa-verifier release download v1.3.2 -p "slsa-verifier-linux-amd64"
115+
chmod ug+x slsa-verifier-linux-amd64
116+
# Note: see https://github.com/slsa-framework/slsa-verifier/blob/main/SHA256SUM.md
117+
COMPUTED_HASH=$(sha256sum slsa-verifier-linux-amd64 | cut -d ' ' -f1)
118+
EXPECTED_HASH="b1d6c9bbce6274e253f0be33158cacd7fb894c5ebd643f14a911bfe55574f4c0"
119+
if [[ "$EXPECTED_HASH" != "$COMPUTED_HASH" ]];then
120+
echo "error: expected $EXPECTED_HASH, computed $COMPUTED_HASH"
121+
exit 1
122+
fi
123+
124+
- name: Download assets
125+
env:
126+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
127+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
128+
run: |
129+
set -euo pipefail
130+
131+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "*.tar.gz"
132+
gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$PROVENANCE"
133+
134+
- name: Verify assets
135+
env:
136+
CHECKSUMS: ${{ needs.goreleaser.outputs.hashes }}
137+
PROVENANCE: "${{ needs.provenance.outputs.provenance-name }}"
138+
run: |
139+
set -euo pipefail
140+
141+
checksums=$(echo "$CHECKSUMS" | base64 -d)
142+
while read -r line; do
143+
fn=$(echo $line | cut -d ' ' -f2)
144+
145+
echo "Verifying $fn"
146+
./slsa-verifier-linux-amd64 -artifact-path "$fn" \
147+
-provenance "$PROVENANCE" \
148+
-source "github.com/$GITHUB_REPOSITORY" \
149+
-tag "$GITHUB_REF_NAME"
150+
151+
done <<<"$checksums"

‎README.md

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# git-clone

‎image/git-init/.goreleaser.yml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Make sure to check the documentation at http://goreleaser.com
2+
before:
3+
hooks:
4+
- go mod tidy
5+
- /bin/bash -c 'if [ -n "$(git --no-pager diff --exit-code go.mod go.sum)" ]; then exit 1; fi'
6+
7+
builds:
8+
- id: binary
9+
main: ./main.go
10+
env:
11+
- CGO_ENABLED=0
12+
flags:
13+
- -trimpath
14+
goos:
15+
- windows
16+
- linux
17+
- darwin
18+
goarch:
19+
- amd64
20+
- arm64
21+
- s390x
22+
- 386
23+
- mips64le
24+
- ppc64le
25+
- riscv64
26+
27+
kos:
28+
- id: git-init-image
29+
build: binary
30+
main: .
31+
base_image: golang:1.20
32+
platforms:
33+
- all
34+
tags:
35+
- '{{ .Tag }}'
36+
- '{{ .FullCommit }}'
37+
- latest
38+
sbom: spdx
39+
bare: true
40+
preserve_import_paths: false
41+
base_import_paths: false
42+
43+
archives:
44+
- id: with-version
45+
name_template: >-
46+
{{ .ProjectName }}_
47+
{{- .Version }}_
48+
{{- title .Os }}_
49+
{{- if eq .Arch "amd64" }}x86_64
50+
{{- else if eq .Arch "386" }}i386
51+
{{- else }}{{ .Arch }}{{ end }}
52+
- id: without-version
53+
name_template: >-
54+
{{ .ProjectName }}_
55+
{{- title .Os }}_
56+
{{- if eq .Arch "amd64" }}x86_64
57+
{{- else if eq .Arch "386" }}i386
58+
{{- else }}{{ .Arch }}{{ end }}
59+
60+
checksum:
61+
name_template: 'checksums.txt'
62+
63+
snapshot:
64+
name_template: "{{ .Tag }}-next"
65+
66+
changelog:
67+
sort: asc
68+
use: github
69+
filters:
70+
exclude:
71+
- '^docs:'
72+
- '^test:'

0 commit comments

Comments
 (0)