name: Build CLI
description: |
  Runs cmake and cli make target in build folder. Optionally, Sigstore tools
  are used to sign CLI when inputs are provided. A draft release is published
  when run on v* tag.
inputs:
  targetOS:
    description: "Build CLI for this OS. [linux, darwin]"
    required: true
    default: "linux"
  targetArch:
    description: "Build CLI for this architecture. [amd64, arm64]"
    required: true
    default: "amd64"
  cosignPublicKey:
    description: "Cosign public key"
    required: false
    default: ""
  cosignPrivateKey:
    description: "Cosign private key"
    required: false
    default: ""
  cosignPassword:
    description: "Password for Cosign private key"
    required: false
    default: ""
runs:
  using: "composite"
  steps:
    - name: Install build dependencies
      run: |
        echo "::group::Install build dependencies"
        sudo apt-get update
        sudo apt-get install \
          build-essential cmake \
          -y
        echo "::endgroup::"
      shell: bash

    # https://github.blog/2022-04-12-git-security-vulnerability-announced/
    - name: Mark repository safe
      run: |
        git config --global --add safe.directory /__w/constellation/constellation
      shell: bash

    - name: Install Go
      uses: actions/setup-go@84cbf8094393cdc5fe1fe1671ff2647332956b1a
      with:
        go-version: "1.18"

    - name: Build CLI
      run: |
        echo "::group::Build CLI"
        GIT_TAG=$(git describe --tags --always --dirty --abbrev=0)
        mkdir -p build
        cd build
        cmake -DCLI_BUILD_TAGS:STRING=gcp,enterprise -DCLI_VERSION:STRING=${GIT_TAG} ..
        GOOS=${{ inputs.targetOS }} GOARCH=${{ inputs.targetArch }} make -j`nproc` cli
        cp constellation constellation-${{ inputs.targetOS }}-${{ inputs.targetArch }}
        echo "$(pwd)" >> $GITHUB_PATH
        export PATH="$PATH:$(pwd)"
        echo "::endgroup::"
      shell: bash

    # TODO: Replace with https://github.com/sigstore/sigstore-installer/tree/initial
    # once it has the functionality
    - name: Install Cosign
      uses: sigstore/cosign-installer@48866aa521d8bf870604709cd43ec2f602d03ff2
      if: ${{ inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != '' }}
    - name: Install Rekor
      run: |
        curl -sLO https://github.com/sigstore/rekor/releases/download/v0.9.0/rekor-cli-linux-amd64
        sudo install rekor-cli-linux-amd64 /usr/local/bin/rekor-cli
      shell: bash
      if: ${{ inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != '' }}
    - name: Sign CLI
      run: |
        SIGN_TARGET=constellation-${{ inputs.targetOS }}-${{ inputs.targetArch }}
        echo "$COSIGN_PUBLIC_KEY" > cosign.pub
        # Enabling experimental mode also publishes signature to Rekor
        COSIGN_EXPERIMENTAL=1 cosign sign-blob --key env://COSIGN_PRIVATE_KEY ${SIGN_TARGET} > ${SIGN_TARGET}.sig
        # Verify - As documentation & check
        # Local Signature (input: artifact, key, signature)
        cosign verify-blob --key cosign.pub --signature ${SIGN_TARGET}.sig ${SIGN_TARGET}
        # Transparency Log Signature (input: artifact, key)
        uuid=$(rekor-cli search --artifact ${SIGN_TARGET} | tail -n 1)
        sig=$(rekor-cli get --uuid=$uuid --format=json | jq -r .Body.HashedRekordObj.signature.content)
        cosign verify-blob --key cosign.pub --signature <(echo $sig) ${SIGN_TARGET}
      shell: bash
      working-directory: build
      env:
        COSIGN_PUBLIC_KEY: ${{ inputs.cosignPublicKey }}
        COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
        COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
      if: ${{ inputs.cosignPublicKey != '' && inputs.cosignPrivateKey != '' && inputs.cosignPassword != '' }}