mirror of
https://github.com/edgelesssys/constellation.git
synced 2024-12-14 10:24:24 -05:00
8e4feb7e2a
* add Azure Terraform module * add maa-patching command to cli * refactor release process * factor out image fetching to own action * add CI * generate * fix some unnecessary changes Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * use `constellation maa-patch` in ci * insecure flag when using debug image Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * only update maa url if existing Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * make node group zone optional on aws and gcp Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * [remove] register updated workflow Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * Revert "[remove] register updated workflow" This reverts commit e70b9515b7eabbcbe0d41fa1296c48750cd02ace. * create MAA Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * make maa-patching only run on azure Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * add comment Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * require node group zone for GCP and AWS * remove unnecessary bazel action * stamp version to correct file * refer to `maa-patch` command in docs * run Azure test in weekly e2e * comment / naming improvements * remove sa_account resource * disable spellcheck ot use "URL" * `create_maa` variable * don't write maa url to config Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * default to nightly image * use input ref and stream * fix command check * don't set region in weekly e2e call * patch maa if url is not empty Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * remove `create_maa` variable * remove binaries Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * remove undefined input * replace invalid attestation URL error message Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * fix punctuation Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com> * skip hidden commands in clidocgen Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * enable spellcheck before code block * move spellcheck trigger out of info block Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> * fix workflow dependencies * let image default to CLI version --------- Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com> Co-authored-by: Thomas Tendyck <51411342+thomasten@users.noreply.github.com>
442 lines
16 KiB
YAML
442 lines
16 KiB
YAML
name: Build CLI and prepare release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
versionName:
|
|
type: string
|
|
description: "Version to use for the release (e.g. v1.2.3)"
|
|
required: true
|
|
ref:
|
|
type: string
|
|
description: "Git ref to checkout"
|
|
required: false
|
|
pushContainers:
|
|
type: boolean
|
|
description: "Push containers pinned in the cli to container registry"
|
|
required: false
|
|
default: false
|
|
registry:
|
|
description: "Container registry to use"
|
|
type: string
|
|
default: ghcr.io
|
|
key:
|
|
description: "Key to use for signing. Set to 'release' to use release key, set to 'dev' to use the dev key."
|
|
type: string
|
|
required: true
|
|
workflow_call:
|
|
inputs:
|
|
versionName:
|
|
type: string
|
|
description: "Version to use for the release (e.g. v1.2.3)"
|
|
required: true
|
|
ref:
|
|
type: string
|
|
description: "Git ref to checkout"
|
|
required: true
|
|
pushContainers:
|
|
type: boolean
|
|
description: "Push containers pinned in the cli to container registry"
|
|
required: false
|
|
default: false
|
|
registry:
|
|
description: "Container registry to use"
|
|
type: string
|
|
default: ghcr.io
|
|
key:
|
|
description: "Key to use for signing. Set to 'release' to use release key, set to 'dev' to use the dev key."
|
|
type: string
|
|
required: true
|
|
|
|
jobs:
|
|
build-cli:
|
|
runs-on: ubuntu-22.04
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- arch: amd64
|
|
os: linux
|
|
|
|
- arch: amd64
|
|
os: darwin
|
|
|
|
- arch: amd64
|
|
os: windows
|
|
|
|
- arch: arm64
|
|
os: linux
|
|
|
|
- arch: arm64
|
|
os: darwin
|
|
steps:
|
|
- name: Checkout
|
|
id: checkout
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
with:
|
|
ref: ${{ inputs.ref || github.head_ref }}
|
|
|
|
- name: Setup bazel
|
|
uses: ./.github/actions/setup_bazel_nix
|
|
with:
|
|
useCache: "false"
|
|
|
|
- name: Build CLI
|
|
uses: ./.github/actions/build_cli
|
|
with:
|
|
targetOS: ${{ matrix.os }}
|
|
targetArch: ${{ matrix.arch }}
|
|
enterpriseCLI: true
|
|
cosignPublicKey: ${{ inputs.key == 'release' && secrets.COSIGN_PUBLIC_KEY || secrets.COSIGN_DEV_PUBLIC_KEY }}
|
|
cosignPrivateKey: ${{ inputs.key == 'release' && secrets.COSIGN_PRIVATE_KEY || secrets.COSIGN_DEV_PRIVATE_KEY }}
|
|
cosignPassword: ${{ inputs.key == 'release' && secrets.COSIGN_PASSWORD || secrets.COSIGN_DEV_PASSWORD }}
|
|
|
|
- name: Upload CLI as artifact (unix)
|
|
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
|
if : ${{ matrix.os != 'windows' }}
|
|
with:
|
|
name: constellation-${{ matrix.os }}-${{ matrix.arch }}
|
|
path: |
|
|
build/constellation-${{ matrix.os }}-${{ matrix.arch }}
|
|
build/constellation-${{ matrix.os }}-${{ matrix.arch }}.sig
|
|
|
|
- name: Upload CLI as artifact (windows)
|
|
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
|
if : ${{ matrix.os == 'windows' }}
|
|
with:
|
|
name: constellation-${{ matrix.os }}-${{ matrix.arch }}
|
|
path: |
|
|
build/constellation-${{ matrix.os }}-${{ matrix.arch }}.exe
|
|
build/constellation-${{ matrix.os }}-${{ matrix.arch }}.exe.sig
|
|
|
|
upload-terraform-module:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout
|
|
id: checkout
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
with:
|
|
ref: ${{ inputs.ref || github.head_ref }}
|
|
|
|
- name: Upload Terraform module
|
|
uses: ./.github/actions/upload_terraform_module
|
|
with:
|
|
version: ${{ inputs.versionName }}
|
|
|
|
push-containers:
|
|
runs-on: ubuntu-22.04
|
|
if: inputs.pushContainers
|
|
permissions:
|
|
actions: read
|
|
contents: write
|
|
id-token: write
|
|
packages: write
|
|
steps:
|
|
- name: Checkout
|
|
id: checkout
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
with:
|
|
ref: ${{ inputs.ref || github.head_ref }}
|
|
|
|
- name: Setup bazel
|
|
uses: ./.github/actions/setup_bazel_nix
|
|
with:
|
|
useCache: "false"
|
|
|
|
- name: Log in to the Container registry
|
|
uses: ./.github/actions/container_registry_login
|
|
with:
|
|
registry: ${{ inputs.registry }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Upload referenced container images
|
|
shell: bash
|
|
run: bazel run //bazel/release:push
|
|
|
|
provenance-subjects:
|
|
runs-on: ubuntu-22.04
|
|
needs:
|
|
- build-cli
|
|
- signed-sbom
|
|
- upload-terraform-module
|
|
outputs:
|
|
provenance-subjects: ${{ steps.provenance-subjects.outputs.provenance-subjects }}
|
|
steps:
|
|
- name: Download CLI binaries darwin-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-darwin-amd64
|
|
|
|
- name: Download CLI binaries darwin-arm64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-darwin-arm64
|
|
|
|
- name: Download CLI binaries linux-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-linux-amd64
|
|
|
|
- name: Download CLI binaries linux-arm64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-linux-arm64
|
|
|
|
- name: Download CLI binaries windows-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-windows-amd64
|
|
|
|
- name: Download CLI SBOM
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation.spdx.sbom
|
|
|
|
- name: Download Terraform module
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: terraform-module
|
|
|
|
- name: Generate provenance subjects
|
|
id: provenance-subjects
|
|
run: |
|
|
HASHES=$(sha256sum \
|
|
constellation-darwin-amd64 \
|
|
constellation-darwin-arm64 \
|
|
constellation-linux-amd64 \
|
|
constellation-linux-arm64 \
|
|
constellation-windows-amd64.exe \
|
|
constellation.spdx.sbom \
|
|
terraform-module.zip)
|
|
HASHESB64=$(echo "${HASHES}" | base64 -w0)
|
|
echo "${HASHES}"
|
|
echo "${HASHESB64}"
|
|
echo provenance-subjects="${HASHESB64}" >> "$GITHUB_OUTPUT"
|
|
|
|
signed-sbom:
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout
|
|
id: checkout
|
|
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
|
|
with:
|
|
ref: ${{ inputs.ref || github.head_ref }}
|
|
|
|
- name: Install Cosign
|
|
uses: sigstore/cosign-installer@c85d0e205a72a294fe064f618a87dbac13084086 # v2.8.1
|
|
|
|
- name: Download Syft & Grype
|
|
uses: ./.github/actions/install_syft_grype
|
|
|
|
- name: Setup bazel
|
|
uses: ./.github/actions/setup_bazel_nix
|
|
with:
|
|
useCache: "false"
|
|
|
|
# Build one CLI since Syft's go-module catalog will default to binary parsing.
|
|
# Binary parsing has the advantage that it will not include other dependencies from our repo not included in the CLI.
|
|
# This seems to work fine for one OS & one arch as long as we don't have OS specific imports.
|
|
# Luckily, so far this does not seem to be the case.
|
|
# As of v2.4.0, all SBOMs seem to have the same packages for [linux|darwin] & [amd64|arm64].
|
|
# If this changes, this should be split up into multiple builds & multiple SBOMs.
|
|
- name: Build CLI (amd64, linux)
|
|
uses: ./.github/actions/build_cli
|
|
with:
|
|
targetOS: "linux"
|
|
targetArch: "amd64"
|
|
enterpriseCLI: true
|
|
|
|
- name: Build signed SBOM
|
|
run: |
|
|
syft build/constellation-linux-amd64 --catalogers go-module --file constellation.spdx.sbom -o spdx-json
|
|
cosign sign-blob --key env://COSIGN_PRIVATE_KEY constellation.spdx.sbom > constellation.spdx.sbom.sig
|
|
grype constellation.spdx.sbom --fail-on high --only-fixed --add-cpes-if-none
|
|
env:
|
|
COSIGN_EXPERIMENTAL: 1
|
|
COSIGN_PUBLIC_KEY: ${{ inputs.key == 'release' && secrets.COSIGN_PUBLIC_KEY || secrets.COSIGN_DEV_PUBLIC_KEY }}
|
|
COSIGN_PRIVATE_KEY: ${{ inputs.key == 'release' && secrets.COSIGN_PRIVATE_KEY || secrets.COSIGN_DEV_PRIVATE_KEY }}
|
|
COSIGN_PASSWORD: ${{ inputs.key == 'release' && secrets.COSIGN_PASSWORD || secrets.COSIGN_DEV_PASSWORD }}
|
|
|
|
- name: Upload Constellation CLI SBOM
|
|
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
|
with:
|
|
name: constellation.spdx.sbom
|
|
path: constellation.spdx.sbom
|
|
|
|
- name: Upload Constellation CLI SBOM's signature
|
|
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
|
|
with:
|
|
name: constellation.spdx.sbom.sig
|
|
path: constellation.spdx.sbom.sig
|
|
|
|
provenance:
|
|
permissions:
|
|
actions: read
|
|
contents: write
|
|
id-token: write
|
|
needs:
|
|
- provenance-subjects
|
|
# This must not be pinned to digest. See:
|
|
# https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.9.0
|
|
with:
|
|
base64-subjects: "${{ needs.provenance-subjects.outputs.provenance-subjects }}"
|
|
|
|
provenance-verify:
|
|
runs-on: ubuntu-22.04
|
|
env:
|
|
SLSA_VERIFIER_VERSION: "2.0.1"
|
|
needs:
|
|
- build-cli
|
|
- provenance
|
|
- upload-terraform-module
|
|
steps:
|
|
- name: Download CLI binaries darwin-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-darwin-amd64
|
|
|
|
- name: Download CLI binaries darwin-arm64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-darwin-arm64
|
|
|
|
- name: Download CLI binaries linux-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-linux-amd64
|
|
|
|
- name: Download CLI binaries linux-arm64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-linux-arm64
|
|
|
|
- name: Download CLI binaries windows-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-windows-amd64
|
|
|
|
- name: Download CLI SBOM
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation.spdx.sbom
|
|
|
|
- name: Download Terraform module
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: terraform-module
|
|
|
|
- name: Download provenance
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: ${{ needs.provenance.outputs.provenance-name }}
|
|
|
|
- name: Install slsa-verifier
|
|
run: |
|
|
curl -fsSLO https://github.com/slsa-framework/slsa-verifier/releases/download/v${{ env.SLSA_VERIFIER_VERSION }}/slsa-verifier-linux-amd64
|
|
install slsa-verifier-linux-amd64 /usr/local/bin/slsa-verifier
|
|
|
|
- name: Verify provenance
|
|
run: |
|
|
slsa-verifier verify-artifact constellation-darwin-amd64 \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
slsa-verifier verify-artifact constellation-darwin-arm64 \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
slsa-verifier verify-artifact constellation-linux-amd64 \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
slsa-verifier verify-artifact constellation-linux-arm64 \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
slsa-verifier verify-artifact constellation-windows-amd64.exe \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
slsa-verifier verify-artifact constellation.spdx.sbom \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
slsa-verifier verify-artifact terraform-module.zip \
|
|
--provenance-path ${{ needs.provenance.outputs.provenance-name }} \
|
|
--source-uri github.com/edgelesssys/constellation
|
|
|
|
release:
|
|
permissions:
|
|
contents: write
|
|
runs-on: ubuntu-22.04
|
|
needs:
|
|
- build-cli
|
|
- provenance
|
|
- signed-sbom
|
|
- upload-terraform-module
|
|
steps:
|
|
- name: Write cosign public key
|
|
run: echo "$COSIGN_PUBLIC_KEY" > cosign.pub
|
|
env:
|
|
COSIGN_PUBLIC_KEY: ${{ inputs.key == 'release' && secrets.COSIGN_PUBLIC_KEY || secrets.COSIGN_DEV_PUBLIC_KEY }}
|
|
|
|
- name: Download CLI binaries darwin-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-darwin-amd64
|
|
|
|
- name: Download CLI binaries darwin-arm64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-darwin-arm64
|
|
|
|
- name: Download CLI binaries linux-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-linux-amd64
|
|
|
|
- name: Download CLI binaries linux-arm64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-linux-arm64
|
|
|
|
- name: Download CLI binaries windows-amd64
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation-windows-amd64
|
|
|
|
- name: Download Constellation CLI SBOM
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation.spdx.sbom
|
|
|
|
- name: Download Constellation CLI SBOM's signature
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: constellation.spdx.sbom.sig
|
|
|
|
- name: Download Constellation provenance
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: ${{ needs.provenance.outputs.provenance-name }}
|
|
|
|
- name: Download Terraform module
|
|
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
|
|
with:
|
|
name: terraform-module
|
|
|
|
- name: Rename provenance file
|
|
run: |
|
|
mv ${{ needs.provenance.outputs.provenance-name }} constellation.intoto.jsonl
|
|
|
|
- name: Create release with artifacts
|
|
# GitHub endorsed release project. See: https://github.com/actions/create-release
|
|
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
|
|
with:
|
|
draft: true
|
|
generate_release_notes: true
|
|
tag_name: ${{ inputs.versionName || inputs.ref || github.head_ref }}
|
|
files: |
|
|
constellation-*
|
|
cosign.pub
|
|
constellation.spdx.sbom
|
|
constellation.spdx.sbom.sig
|
|
constellation.intoto.jsonl
|
|
terraform-module.zip
|