Update pipeline to use reusable witness workflow (#78)

* Update pipeline to use reusable witness workflow --------- Signed-off-by: John Kjell <[email protected]>
in-toto · Oct 27, 2023 · b44f4ea · b44f4ea
1 parent 28a3699
commit b44f4ea
Show file tree

Hide file tree

Showing 3 changed files with 141 additions and 127 deletions.
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
@@ -0,0 +1,94 @@
+# Copyright 2023 The Archivista Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+permissions:
+    id-token: write # This is required for requesting the JWT
+    contents: read  # This is required for actions/checkout
+name: pipeline
+on:
+    push:
+        tags:
+            - v*
+        branches:
+            - main
+    pull_request:
+jobs:
+    fmt:
+        uses: ./.github/workflows/witness.yml
+        with:
+          pull_request: ${{ github.event_name == 'pull_request' }}
+          step: static-analysis
+          attestations: "github"
+          command: go fmt ./...
+
+    static_analysis:
+        uses: ./.github/workflows/witness.yml
+        with:
+          pull_request: ${{ github.event_name == 'pull_request' }}
+          step: static-analysis
+          attestations: "github"
+          command: go vet ./...
+
+    test:
+        needs: [fmt, static_analysis]
+        uses: ./.github/workflows/witness.yml
+        with: 
+            pull_request: ${{ github.event_name == 'pull_request' }}
+            step: "test"
+            attestations: "github"
+            command: go test -v -coverprofile=profile.cov -covermode=atomic ./...
+
+    e2e-tests:
+        needs: test
+        uses: ./.github/workflows/witness.yml
+        with:
+            pull_request: ${{ github.event_name == 'pull_request' }}
+            step: "e2e"
+            attestations: "github"
+            command: ./test/test.sh
+
+    release:
+        needs: e2e-tests
+        permissions:
+            id-token: write
+            contents: write
+            packages: write
+        runs-on: ubuntu-latest
+        if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
+
+        steps:
+            - uses: actions/[email protected]
+            - uses: actions/[email protected]
+              with:
+                go-version: 1.21.x
+
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@v2
+              with:
+                registry: ghcr.io
+                username: ${{ github.actor }}
+                password: ${{ secrets.GITHUB_TOKEN }}
+
+            - name: Download GoReleaser
+              run: go install github.com/goreleaser/goreleaser@latest
+
+            - name: Run GoReleaser
+              uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
+              env:
+                GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
+              with:
+                step: "build"
+                attestations: "github"
+                command: goreleaser release --clean
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
diff --git a/.github/workflows/witness.yml b/.github/workflows/witness.yml
@@ -0,0 +1,47 @@
+# Copyright 2023 The Archivista Contributors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+on:
+    workflow_call:
+        inputs:
+            pull_request: 
+                required: true
+                type: boolean
+            command:
+                required: true
+                type: string
+            step:
+                required: true
+                type: string
+            attestations:
+                required: true
+                type: string
+
+jobs:
+    witness:
+        runs-on: ubuntu-latest
+        steps:
+          - uses: actions/[email protected]
+          - uses: actions/[email protected]
+            with:
+              go-version: 1.21.x
+
+          - if: ${{ inputs.pull_request == false }}
+            uses: testifysec/witness-run-action@40aa4ef36fc431a37de7c3faebcb66513c03b934
+            with:
+              step: ${{ inputs.step }}
+              attestations: $${ inputs.attestations }}
+              command: /bin/sh -c "$${ inputs.command }}"
+          - if: ${{ inputs.pull_request == true }}
+            run: ${{ inputs.command }}