[WIP] Test Witness for build attestations #135
Conversation
colek42
changed the title
|
Working test run is viewable here: https://github.com/testifysec/galadriel/actions/runs/4636814805 |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
.github/workflows/release.yml
Outdated
|
|
||
| - name: Run GoReleaser | ||
| id: run-goreleaser | ||
| uses: goreleaser/goreleaser-action@8f67e590f2d095516493f017008adc464e63adb1 # v4.1.0 | ||
| uses: testifysec/witness-run-action@main |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| distribution: goreleaser | ||
| version: latest | ||
| args: release --rm-dist | ||
| uses: testifysec/witness-run-action@main |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| distribution: goreleaser | ||
| version: latest | ||
| args: release --rm-dist | ||
| uses: testifysec/witness-run-action@main |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/trivy.yml
Outdated
| sudo apt-get install trivy -y | ||
|
|
||
| - name: Run Trivy vulnerability scanner with Witness | ||
| uses: testifysec/witness-run-action@main |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin | ||
|
|
||
| - name: Build Server | ||
| uses: testifysec/witness-run-action@main |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| command: ko build --tarball server.tar --tags=ghcr.io/${{ github.repository }}:${{ github.sha }} --platform=all --sbom-dir . ./cmd/server | ||
|
|
||
| - name: Build Harvestor | ||
| uses: testifysec/witness-run-action@main |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
|
|
||
| - name: Install KO | ||
| run: go install github.com/google/ko/cmd/ko@latest | ||
|
|
Check warning
Code scanning / Scorecard
Pinned-Dependencies
| # command: goreleaser release --clean --snapshot | ||
|
|
||
| - name: Setup KO | ||
| uses: imjasonh/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| uses: imjasonh/[email protected] | ||
|
|
||
| - name: Build Server | ||
| uses: testifysec/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| - name: Generate subject | ||
| id: hash | ||
| - name: Build Harvestor | ||
| uses: testifysec/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
| # command: goreleaser release --clean --snapshot | ||
|
|
||
| - name: Setup KO | ||
| uses: imjasonh/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
| # command: goreleaser release --clean --snapshot | ||
|
|
||
| - name: Setup KO | ||
| uses: imjasonh/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| - name: Generate subject | ||
| id: hash | ||
| - name: Build Harvestor | ||
| uses: testifysec/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
| command: goreleaser release --clean --snapshot | ||
|
|
||
| - name: Setup KO | ||
| uses: imjasonh/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/trivy.yml
Outdated
| sudo apt-get install trivy -y | ||
|
|
||
| - name: Run Trivy vulnerability scanner with Witness | ||
| uses: testifysec/[email protected] |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.github/workflows/release.yml
Outdated
| echo "${AUTH_TOKEN}" | ko login ghcr.io --username dummy --password-stdin | ||
|
|
||
| - name: Build Server | ||
| uses: testifysec/witness-run-action@fix-output |
Check warning
Code scanning / Scorecard
Pinned-Dependencies
.witness/policy.key
Outdated
| @@ -0,0 +1,28 @@ | |||
| -----BEGIN PRIVATE KEY----- | |||
Check failure
Code scanning / Trivy
Asymmetric Private Key
.witness/policy.key
Outdated
| @@ -0,0 +1,28 @@ | |||
| -----BEGIN PRIVATE KEY----- | |||
Check failure
Code scanning / Trivy
Asymmetric Private Key
.witness/policy.key
Outdated
| @@ -0,0 +1,28 @@ | |||
| -----BEGIN PRIVATE KEY----- | |||
Check failure
Code scanning / Trivy
Asymmetric Private Key
.witness/policy.key
Outdated
| @@ -0,0 +1,28 @@ | |||
| -----BEGIN PRIVATE KEY----- | |||
Check failure
Code scanning / Trivy
Asymmetric Private Key
.witness/policy.key
Outdated
| @@ -0,0 +1,28 @@ | |||
| -----BEGIN PRIVATE KEY----- | |||
Check failure
Code scanning / Trivy
Asymmetric Private Key
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.2.0 to 3.3.1. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@537aa19...0ad9a09) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
provenance artifact with signature and sboms Signed-off-by: Victor Vieira Barros Leal da Silveira <[email protected]>
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.3.1 to 3.4.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@0ad9a09...08e2f20) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
colek42
force-pushed
the
cole/witness
branch
2 times, most recently
from
1b04d08
to
69d694c
Compare
Signed-off-by: Cole Kennedy <[email protected]>
|
Kudos, SonarCloud Quality Gate passed!
|
Signed-off-by: Cole Kennedy <[email protected]>
Signed-off-by: Cole Kennedy <[email protected]>
|
Kudos, SonarCloud Quality Gate passed!
|
Pull request check list
Affected functionality
Description of change
Which issue this pull requests fixes