Add go program to auth and perform the collection

.github/workflows/main.yml

@@ -1,5 +1,9 @@
 on: [push]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   test_job:
     runs-on: ubuntu-latest
@@ -12,6 +16,8 @@ jobs:
         id: guacone
         with:
           files: './spdx.json'
-          gql-addr: 'http://localhost:1234/query'
+          gql-addr: ${{ secrets.GQLADDR }}
+          token-url: ${{ secrets.TOKENURL }}
+          client-id: ${{ secrets.CLIENTID }}
       - name: Output
-        run: echo "${{steps.guacone.outputs}}"
+        run: echo "${{steps.guacone.outputs}}"

Dockerfile

@@ -1,5 +1,7 @@
-FROM ghcr.io/guacsec/guac:v0.1.1
+FROM cgr.dev/chainguard/go AS builder
+COPY . /app
+RUN cd /app && go build -o guac-github-action .
 
-COPY entrypoint.sh /entrypoint.sh
-
-ENTRYPOINT ["/entrypoint.sh"]
+FROM cgr.dev/chainguard/glibc-dynamic
+COPY --from=builder /app/guac-github-action /usr/bin/
+ENTRYPOINT ["/usr/bin/guac-github-action"]

README.md

@@ -1,27 +1,43 @@
 # Overview
-Github Action for ingesting SBOMs and Attestations into [GUAC](https://github.com/guacsec/guac) as part of your github workflow.
-This will enable quick and easy integration to your GUAC instance with very minimal input.
 
-Currently this wraps the `guacone collect files` command.
+Github Action for ingesting SBOMs and Attestations into
+[GUAC](https://github.com/guacsec/guac) as part of your github
+workflow. Authentication is provided by GitHub's OIDC provider and a specified
+auth token provider. This will enable quick and easy integration to your GUAC
+instance with very minimal input.
 
 ## Inputs
-### `files` 
+
+### `files`
+
 **Required** Path to directory or specific file to ingest
 
-### `gql-addr`  
-**Required** GUAC GraphQL API Endpoint - example:  http://localhost:8080/query
+### `gql-addr`
+
+**Required** GUAC GraphQL API Endpoint - example:  https://guac.instance/query
+
+### `token-url`
+
+**Required** URL of auth token provider - example:  https://token.provider/oauth2/token
+
+### `gql-addr`
+
+**Required** Client ID for auth token provider - example:  abcd-efgh-1234...
 
 ## Outputs
 
 ### `console_out`
+
 Raw output of the guacone command
 
 ## Example Usage
 
-```- name: GUAC ingestion
-    uses: actions/guacone@v1
-    id: guacone
-    with:
+```yaml
+    - name: GUAC ingestion
+      uses: kusaridev/guac-github-action@v1
+      with:
         files: './spdx.json'
-        gql-addr: 'http://localhost:1234/query'
-```
+        gql-addr: 'https://guac.kusari.dev/query'
+        token-url: ${{ secrets.TOKENURL }}
+        client-id: ${{ secrets.CLIENTID }}
+```

action.yaml

@@ -1,13 +1,19 @@
----  
+---
 name: 'GUAC Ingest'
 description: 'Ingest files into GUAC'
-inputs: 
-  files:  
+inputs:
+  files:
     description: 'path to directory or specific file to ingest'
     required: true
-  gql-addr: 
+  gql-addr:
     description: 'endpoint for graphql api for GUAC'
     requited: true
+  token-url:
+    description: 'url for auth token provider'
+    requited: true
+  client-id:
+    description: 'client id for auth token provider'
+    requited: true
 outputs:
   console_out:
     description: 'raw console output from guacone command'
@@ -17,3 +23,5 @@ runs:
   args:
     - ${{ inputs.files }}
     - ${{ inputs.gql-addr }}
+    - ${{ inputs.token-url }}
+    - ${{ inputs.client-id }}

go.mod

@@ -0,0 +1,135 @@
+module github.com/kusaridev/guac-github-action
+
+go 1.20
+
+require (
+	github.com/Khan/genqlient v0.6.0
+	github.com/guacsec/guac v0.1.2
+	github.com/sigstore/cosign/v2 v2.1.1
+	golang.org/x/oauth2 v0.11.0
+)
+
+require (
+	cloud.google.com/go v0.110.7 // indirect
+	cloud.google.com/go/compute v1.23.0 // indirect
+	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/iam v1.1.1 // indirect
+	cloud.google.com/go/storage v1.31.0 // indirect
+	dario.cat/mergo v1.0.0 // indirect
+	github.com/BurntSushi/toml v1.3.2 // indirect
+	github.com/CycloneDX/cyclonedx-go v0.7.1 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/ProtonMail/go-crypto v0.0.0-20230717121422-5aa5874ade95 // indirect
+	github.com/acomagu/bufpipe v1.0.4 // indirect
+	github.com/anchore/go-struct-converter v0.0.0-20221221214134-65614c61201e // indirect
+	github.com/bombsimon/logrusr/v2 v2.0.1 // indirect
+	github.com/bradleyfalzon/ghinstallation/v2 v2.6.0 // indirect
+	github.com/caarlos0/env/v6 v6.10.1 // indirect
+	github.com/cloudflare/circl v1.3.3 // indirect
+	github.com/common-nighthawk/go-figure v0.0.0-20210622060536-734e95fb86be // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.14.3 // indirect
+	github.com/containerd/typeurl/v2 v2.1.1 // indirect
+	github.com/docker/cli v24.0.4+incompatible // indirect
+	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/docker/docker v24.0.4+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.7.0 // indirect
+	github.com/emirpasic/gods v1.18.1 // indirect
+	github.com/fatih/color v1.15.0 // indirect
+	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
+	github.com/go-git/go-billy/v5 v5.4.1 // indirect
+	github.com/go-git/go-git/v5 v5.8.1 // indirect
+	github.com/go-logr/logr v1.2.4 // indirect
+	github.com/goark/errs v1.3.2 // indirect
+	github.com/goark/go-cvss v1.6.6 // indirect
+	github.com/gofrs/uuid v4.4.0+incompatible // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/go-containerregistry v0.16.1 // indirect
+	github.com/google/go-github/v53 v53.2.0 // indirect
+	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/osv-scanner v1.3.6 // indirect
+	github.com/google/s2a-go v0.1.4 // indirect
+	github.com/google/uuid v1.3.0 // indirect
+	github.com/google/wire v0.5.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.2.5 // indirect
+	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/h2non/filetype v1.1.3 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.4 // indirect
+	github.com/in-toto/in-toto-golang v0.9.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
+	github.com/jedib0t/go-pretty/v6 v6.4.6 // indirect
+	github.com/jeremywohl/flatten v1.0.1 // indirect
+	github.com/kevinburke/ssh_config v1.2.0 // indirect
+	github.com/klauspost/compress v1.16.7 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/mattn/go-runewidth v0.0.14 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/moby/buildkit v0.12.1 // indirect
+	github.com/nats-io/nats.go v1.28.0 // indirect
+	github.com/nats-io/nkeys v0.4.4 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
+	github.com/olekukonko/tablewriter v0.0.5 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc3 // indirect
+	github.com/openvex/go-vex v0.2.0 // indirect
+	github.com/ossf/scorecard/v4 v4.12.0 // indirect
+	github.com/package-url/packageurl-go v0.1.1 // indirect
+	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/rhysd/actionlint v1.6.24 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/robfig/cron v1.2.0 // indirect
+	github.com/secure-systems-lab/go-securesystemslib v0.7.0 // indirect
+	github.com/sergi/go-diff v1.3.1 // indirect
+	github.com/shibumi/go-pathspec v1.3.0 // indirect
+	github.com/shurcooL/githubv4 v0.0.0-20201206200315-234843c633fa // indirect
+	github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/skeema/knownhosts v1.2.0 // indirect
+	github.com/spdx/gordf v0.0.0-20221230105357-b735bd5aac89 // indirect
+	github.com/spdx/tools-golang v0.5.3 // indirect
+	github.com/spf13/cobra v1.7.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/vbatts/tar-split v0.11.3 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.8 // indirect
+	github.com/xanzy/go-gitlab v0.89.0 // indirect
+	github.com/xanzy/ssh-agent v0.3.3 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.24.0 // indirect
+	gocloud.dev v0.33.0 // indirect
+	golang.org/x/crypto v0.12.0 // indirect
+	golang.org/x/exp v0.0.0-20230713183714-613f0c0eb8a1 // indirect
+	golang.org/x/mod v0.12.0 // indirect
+	golang.org/x/net v0.14.0 // indirect
+	golang.org/x/sync v0.3.0 // indirect
+	golang.org/x/sys v0.11.0 // indirect
+	golang.org/x/term v0.11.0 // indirect
+	golang.org/x/text v0.12.0 // indirect
+	golang.org/x/time v0.3.0 // indirect
+	golang.org/x/tools v0.11.0 // indirect
+	golang.org/x/vuln v1.0.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
+	google.golang.org/api v0.136.0 // indirect
+	google.golang.org/appengine v1.6.7 // indirect
+	google.golang.org/genproto v0.0.0-20230803162519-f966b187b2e5 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20230803162519-f966b187b2e5 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230807174057-1744710a1577 // indirect
+	google.golang.org/grpc v1.57.0 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
+	gopkg.in/warnings.v0 v0.1.2 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	mvdan.cc/sh/v3 v3.7.0 // indirect
+	sigs.k8s.io/release-utils v0.7.4 // indirect
+)
+
+replace github.com/openvex/go-vex => github.com/openvex/go-vex v0.2.1-0.20230519031452-e31eaf94ec95