56 lines
2.2 KiB
YAML
56 lines
2.2 KiB
YAML
# Copyright VMware, Inc.
|
|
# SPDX-License-Identifier: APACHE-2.0
|
|
|
|
name: '[SRP] Secure Release Pipeline Report'
|
|
on:
|
|
schedule:
|
|
- cron: '0 7 * * *'
|
|
workflow_dispatch:
|
|
# Remove all permissions by default
|
|
permissions: {}
|
|
env:
|
|
BAC_SRP_ENDPOINT: https://apigw.vmware.com/v1/s1/api/helix-beta
|
|
BAC_SRP_CLIENT_ID: ${{ secrets.BAC_SRP_CLIENT_ID }}
|
|
BAC_SRP_CLIENT_SECRET: ${{ secrets.BAC_SRP_CLIENT_SECRET }}
|
|
|
|
jobs:
|
|
report:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
actions: write
|
|
contents: read
|
|
steps:
|
|
- id: install-tool
|
|
name: Install and configure SRP Tool
|
|
run: |
|
|
curl -SsLfo /tmp/srp-cli.tgz https://srp-cli.s3.amazonaws.com/srp-cli-latest.tgz
|
|
sudo tar xf /tmp/srp-cli.tgz -C /usr/local/bin/
|
|
srp config --srp-endpoint ${BAC_SRP_ENDPOINT}
|
|
srp config auth --client-id=${BAC_SRP_CLIENT_ID} --client-secret=${BAC_SRP_CLIENT_SECRET}
|
|
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
|
|
name: Checkout Repository
|
|
with:
|
|
# No full history required
|
|
fetch-depth: 1
|
|
submodules: true
|
|
- id: build-report
|
|
name: Build SRP report
|
|
run: |
|
|
export SRP_UID="uid.obj.build.github(instance='github.com',namespace='${GITHUB_REPOSITORY}',ref='${GITHUB_REF}',action='${GITHUB_ACTION}',build_id='${GITHUB_RUN_ID}_${GITHUB_RUN_ATTEMPT}')"
|
|
srp provenance source --verbose --scm-type git \
|
|
--name "bac-containers" --path . --saveto ./source-provenance.json \
|
|
--comp-uid "${SRP_UID}" --build-number "${GITHUB_RUN_ID}" \
|
|
--version "1.0" --all-ephemeral true --build-type release
|
|
echo "uid=${SRP_UID}" >> $GITHUB_OUTPUT
|
|
- name: Archive SRP report
|
|
uses: actions/upload-artifact@c7d193f32edcb7bfad88892161225aeda64e9392
|
|
with:
|
|
name: source-provenance
|
|
path: source-provenance.json
|
|
- id: submit-report
|
|
name: Submit SRP report
|
|
env:
|
|
SRP_UID: "${{ steps.build-report.outputs.uid }}"
|
|
run: |
|
|
srp metadata submit --verbose --path ./source-provenance.json --uid "uid.mtd.provenance_2_5.fragment(obj_uid=${SRP_UID},revision='')"
|