constellation/.github/actions/build_cli/action.yml

106 lines
4.1 KiB
YAML
Raw Normal View History

name: Build CLI
description: |
Builds CLI. Optionally, Sigstore tools
are used to sign CLI when inputs are provided. A draft release is published
when run on v* tag.
inputs:
targetOS:
2022-09-02 06:44:20 -04:00
description: "Build CLI for this OS. [linux, darwin]"
required: true
2022-09-02 06:44:20 -04:00
default: "linux"
targetArch:
2022-09-02 06:44:20 -04:00
description: "Build CLI for this architecture. [amd64, arm64]"
required: true
2022-09-02 06:44:20 -04:00
default: "amd64"
2022-09-13 08:27:38 -04:00
enterpriseCLI:
description: "Build CLI with enterprise flag."
required: false
default: "false"
cosignPublicKey:
2022-09-02 06:44:20 -04:00
description: "Cosign public key"
required: false
2022-09-02 06:44:20 -04:00
default: ""
cosignPrivateKey:
2022-09-02 06:44:20 -04:00
description: "Cosign private key"
required: false
2022-09-02 06:44:20 -04:00
default: ""
cosignPassword:
2022-09-02 06:44:20 -04:00
description: "Password for Cosign private key"
required: false
2022-09-02 06:44:20 -04:00
default: ""
outputPath:
description: "Output path of the binary"
required: false
runs:
using: "composite"
steps:
# https://github.blog/2022-04-12-git-security-vulnerability-announced/
- name: Mark repository safe
shell: bash
run: |
git config --global --add safe.directory /__w/constellation/constellation
- name: Build CLI
shell: bash
env:
GOOS: ${{ inputs.targetOS }}
GOARCH: ${{ inputs.targetArch }}
OUTPUT_PATH: ${{ inputs.outputPath || format('./build/constellation-{0}-{1}', inputs.targetOS, inputs.targetArch) }}
run: |
2022-09-02 10:59:56 -04:00
echo "::group::Build CLI"
mkdir -p "$(dirname "${OUTPUT_PATH}")"
2022-09-13 08:27:38 -04:00
if [ ${{ inputs.enterpriseCLI }} == 'true' ]
then
cli_variant=enterprise
2022-09-13 08:27:38 -04:00
else
cli_variant=oss
2022-09-13 08:27:38 -04:00
fi
label="//cli:cli_${cli_variant}_${GOOS}_${GOARCH}"
bazel build "${label}"
repository_root=$(git rev-parse --show-toplevel)
out_rel=$(bazel cquery --output=files "${label}")
out_loc="$(realpath "${repository_root}/${out_rel}")"
cp "${out_loc}" "${OUTPUT_PATH}"
chmod +w "${OUTPUT_PATH}"
echo "$(dirname "${OUTPUT_PATH}")" >> $GITHUB_PATH
export PATH="$PATH:$(dirname "${OUTPUT_PATH}")"
2022-09-02 10:59:56 -04:00
echo "::endgroup::"
# TODO: Replace with https://github.com/sigstore/sigstore-installer/tree/initial
# once it has the functionality
- name: Install Cosign
if: inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != ''
uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # tag=v2.8.1
- name: Install Rekor
if: inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != ''
shell: bash
working-directory: build
run: |
HOSTOS="$(go env GOOS)"
HOSTARCH="$(go env GOARCH)"
curl -fsSLO https://github.com/sigstore/rekor/releases/download/v0.12.0/rekor-cli-${HOSTOS}-${HOSTARCH}
sudo install rekor-cli-${HOSTOS}-${HOSTARCH} /usr/local/bin/rekor-cli
rm rekor-cli-${HOSTOS}-${HOSTARCH}
- name: Sign CLI
if: inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != ''
shell: bash
working-directory: build
env:
COSIGN_PUBLIC_KEY: ${{ inputs.cosignPublicKey }}
COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
2023-03-31 08:22:22 -04:00
OUTPUT_PATH: ${{ github.workspace }}/${{ inputs.outputPath || format('./build/constellation-{0}-{1}', inputs.targetOS, inputs.targetArch) }}
run: |
echo "$COSIGN_PUBLIC_KEY" > cosign.pub
# Enabling experimental mode also publishes signature to Rekor
COSIGN_EXPERIMENTAL=1 cosign sign-blob --key env://COSIGN_PRIVATE_KEY "${OUTPUT_PATH}" > "${OUTPUT_PATH}.sig"
# Verify - As documentation & check
# Local Signature (input: artifact, key, signature)
cosign verify-blob --key cosign.pub --signature "${OUTPUT_PATH}.sig" "${OUTPUT_PATH}"
# Transparency Log Signature (input: artifact, key)
uuid=$(rekor-cli search --artifact "${OUTPUT_PATH}" | tail -n 1)
sig=$(rekor-cli get --uuid=$uuid --format=json | jq -r .Body.HashedRekordObj.signature.content)
cosign verify-blob --key cosign.pub --signature <(echo $sig) "${OUTPUT_PATH}"