generator_generic_slsa3.yml

# Copyright 2022 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: SLSA provenance generator

permissions:
  contents: read

env:
  # Generator
  BUILDER_BINARY: slsa-generator-generic-linux-amd64 # Name of the binary in the release assets.
  BUILDER_DIR: internal/builders/generic # Source directory if we compile the builder.
  SUBJECTS_FILENAME: "subjects.sha256sum.base64.231b023dad77ada71cb6fb328090d00a" # Filename containing the subjects. A random value is appended to avoid name collisions.

defaults:
  run:
    shell: bash

on:
  workflow_call:
    inputs:
      base64-subjects:
        description: "Artifacts for which to generate provenance, formatted the same as the output of sha256sum (SHA256 NAME\\n[...]) and base64 encoded."
        required: false
        type: string
      base64-subjects-as-file:
        description: >
          The file 'handle' representing the filename containing the artifacts for which to generate provenance, formatted the same as the output of sha256sum (SHA256 NAME\\n[...]) and base64 encoded. 'actions/generator/generic/create-base64-subjects-from-file'.
          The handle must be created using Action 'slsa-framework/slsa-github-generator/actions/generator/generic/create-base64-subjects-from-file'.
        required: false
        type: string
      upload-assets:
        description: >
          If true, provenance is uploaded to a GitHub release for new tags.
          When the workflow does not run on a new tag, such as on a workflow_dispatch,
          the `upload-tag-name` argument must be provided as well.
        required: false
        type: boolean
        default: false
      upload-tag-name:
        description: >
          If non-empty and `upload-assets` is set to true, the provenance is uploaded to the GitHub
          release identified by the tag name. If a workflow is run on a new tag and `upload-tag-name`
          is non-empty, the new tag is ignored and the value of `upload-tag-name` is used instead to upload
          the assets.
        type: string
        default: ""
      provenance-name:
        description: The artifact name of the signed provenance. The file must have the intoto.jsonl extension. Defaults to <filename>.intoto.jsonl for single artifact or multiple.intoto.jsonl for multiple artifacts.
        required: false
        type: string
      compile-generator:
        description: "Build the generator from source. This increases build time by ~2m."
        required: false
        type: boolean
        default: false
      private-repository:
        description: "If true, private repositories can post to the public transparency log."
        required: false
        type: boolean
        default: false
      continue-on-error:
        description: "Prevents a workflow run from failing when a job fails. Set to 'true' to allow a workflow run to pass when a job fails."
        required: false
        type: boolean
        default: false
      draft-release:
        description: >
          Boolean identifying the release as a draft.  If 'true' then the
          created release is marked as a draft. If other non-empty value
          then it is not marked as a draft.

          The default is to not modify the draft setting for existing
          releases, and false for new releases.
        required: false
        type: string
        default: ""
    outputs:
      release-id:
        description: >
          The name of the release where provenance was uploaded.

          Note: This value is non-empty only when a release asset is uploaded, according to
          the values of `upload-assets` and `upload-tag-name`.
        value: ${{ jobs.upload-assets.outputs.release-id }}
      provenance-name:
        description: "The artifact name of the signed provenance. (A file with the intoto.jsonl extension)."
        value: ${{ jobs.generator.outputs.provenance-name }}
      # Note: we use this output because there is no buildt-in `outcome` and `result` is always `success`
      # if `continue-on-error` is set to `true`.
      outcome:
        description: >
          The outcome status of the run ('success' or 'failure').

          Note: this is only set when `continue-on-error` is `true`.
        value: ${{ jobs.final.outputs.outcome }}

jobs:
  # detect-env detects the reusable workflow's repository and ref for use later
  # in the workflow.
  detect-env:
    outputs:
      outcome: ${{ steps.final.outputs.outcome }}
      repository: ${{ steps.detect.outputs.repository }}
      ref: ${{ steps.detect.outputs.ref }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Needed to detect the current reusable repository and ref.
    steps:
      - name: Detect the generator ref
        id: detect
        continue-on-error: true
        uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main

      - name: Final outcome
        id: final
        env:
          SUCCESS: ${{ steps.detect.outcome != 'failure' }}
        run: |
          set -euo pipefail
          echo "outcome=$([ "$SUCCESS" == "true" ] && echo "success" || echo "failure")" >> "$GITHUB_OUTPUT"

  # generator builds the generator binary and runs it to generate SLSA
  # provenance.
  #
  # If `compile-generator` is true then the generator is compiled
  # from source at the ref detected by `detect-env`.
  #
  # If `compile-generator` is false, then the generator binary is downloaded
  # with the release at the ref detected by `detect-env`. This must be a tag
  # reference.
  generator:
    outputs:
      outcome: ${{ steps.final.outputs.outcome }}
      provenance-sha256: ${{ steps.sign-prov.outputs.provenance-sha256 }}
      provenance-name: ${{ steps.sign-prov.outputs.provenance-name }}
      subject-artifact-name: ${{ steps.metadata.outputs.artifact_name }}
    runs-on: ubuntu-latest
    needs: [detect-env]
    permissions:
      id-token: write # Needed to create an OIDC token for keyless signing.
      contents: read
      actions: read # Needed to read workflow info.
    steps:
      - name: Generate builder
        id: generate-builder
        continue-on-error: true
        uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          go-version: "1.21"
          binary: "${{ env.BUILDER_BINARY }}"
          compile-builder: "${{ inputs.compile-generator }}"
          directory: "${{ env.BUILDER_DIR }}"
          allow-private-repository: ${{ inputs.private-repository }}

      - name: Extract subjects file metadata
        id: metadata
        continue-on-error: true
        if: inputs.base64-subjects-as-file != ''
        env:
          UNTRUSTED_SUBJECTS_AS_FILE: "${{ inputs.base64-subjects-as-file }}"
        run: |
          set -euo pipefail
          obj=$(echo "${UNTRUSTED_SUBJECTS_AS_FILE}" | base64 -d | jq)
          echo "UNTRUSTED_SUBJECTS_AS_FILE: ${obj}"
          artifact_name=$(echo "${obj}" | jq -r '.artifact_name')
          filename=$(echo "${obj}" | jq -r '.filename')
          sha256=$(echo "${obj}" | jq -r '.sha256')

          # shellcheck disable=SC2129
          echo "artifact_name=${artifact_name}" >> "$GITHUB_OUTPUT"
          echo "filename=${filename}" >> "$GITHUB_OUTPUT"
          echo "sha256=${sha256}" >> "$GITHUB_OUTPUT"

      - name: Download subjects file
        id: download-file
        continue-on-error: true
        if: inputs.base64-subjects-as-file != ''
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-download-artifact@main
        with:
          name: "${{ steps.metadata.outputs.artifact_name }}"
          path: "${{ steps.metadata.outputs.filename }}"
          sha256: "${{ steps.metadata.outputs.sha256 }}"

      - name: Create subject file
        id: create-file
        continue-on-error: true
        env:
          UNTRUSTED_SUBJECTS: "${{ inputs.base64-subjects }}"
          UNTRUSTED_SUBJECTS_FILENAME: "${{ steps.metadata.outputs.filename }}"
        run: |
          set -euo pipefail
          # NOTE: SUBJECTS_FILE is trusted and declared at the top of the file.
          if [[ -n "${UNTRUSTED_SUBJECTS_FILENAME}" ]]; then
            mv "${UNTRUSTED_SUBJECTS_FILENAME}" "${SUBJECTS_FILENAME}"
          else
            echo "${UNTRUSTED_SUBJECTS}" > "${SUBJECTS_FILENAME}"
          fi

      - name: Create and sign provenance
        id: sign-prov
        continue-on-error: true
        # NOTE: Inputs and `github` context are set to environment variables in
        # order to avoid script injection.
        # See: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections
        env:
          GITHUB_CONTEXT: "${{ toJSON(github) }}"
          VARS_CONTEXT: "${{ toJSON(vars) }}"
          UNTRUSTED_PROVENANCE_NAME: "${{ inputs.provenance-name }}"
        run: |
          set -euo pipefail
          untrusted_prov_name=""
          if [ "$UNTRUSTED_PROVENANCE_NAME" != "" ]; then
            untrusted_prov_name="$UNTRUSTED_PROVENANCE_NAME"
          fi
          # Create and sign provenance.
          # NOTE: The builder verifies that the provenance path is located
          # in the current directory.
          # NOTE: $untrusted_provenance_path may be empty. In this case the
          # attest command chooses a file name based on the subject name and
          # number of subjects based on in-toto attestation bundle file naming conventions.
          # See: https://github.com/in-toto/attestation/blob/main/spec/bundle.md#file-naming-convention
          # NOTE: The attest commmand outputs the provenance-name and provenance-sha256
          "$GITHUB_WORKSPACE/$BUILDER_BINARY" attest --subjects-filename "${SUBJECTS_FILENAME}" -g "$untrusted_prov_name"

      - name: Upload the signed provenance
        id: upload-prov
        continue-on-error: true
        uses: actions/upload-artifact@89ef406dd8d7e03cfd12d9e0a4a378f454709029 # v4.3.5
        with:
          name: "${{ steps.sign-prov.outputs.provenance-name }}"
          path: "${{ steps.sign-prov.outputs.provenance-name }}"
          if-no-files-found: error
          retention-days: 5

      - name: Final outcome
        id: final
        env:
          SUCCESS: ${{ steps.generate-builder.outcome != 'failure' && steps.metadata.outcome != 'failure' && steps.download-file.outcome != 'failure' && steps.create-file.outcome != 'failure' && steps.sign-prov.outcome != 'failure' && steps.upload-prov.outcome != 'failure' }}
        run: |
          set -euo pipefail
          echo "outcome=$([ "$SUCCESS" == "true" ] && echo "success" || echo "failure")" >> "$GITHUB_OUTPUT"

  # upload-assets uploads provenance to the release
  # if github.ref is a tag and `upload-assets` is true.
  upload-assets:
    outputs:
      outcome: ${{ steps.final.outputs.outcome }}
      release-id: ${{ steps.release.outputs.id }}
    runs-on: ubuntu-latest
    needs: [detect-env, generator]
    permissions:
      contents: write # Needed to write artifacts to a release.
    if: inputs.upload-assets && (startsWith(github.ref, 'refs/tags/') || inputs.upload-tag-name != '')
    steps:
      - name: Checkout builder repository
        id: checkout-builder
        continue-on-error: true
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          path: __BUILDER_CHECKOUT_DIR__

      - name: Download the provenance
        id: download-prov
        continue-on-error: true
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
        with:
          name: "${{ needs.generator.outputs.provenance-name }}"
          path: "${{ needs.generator.outputs.provenance-name }}"
          sha256: "${{ needs.generator.outputs.provenance-sha256 }}"

      - name: Upload provenance
        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
        id: release
        with:
          draft: ${{ inputs.draft-release }}
          tag_name: ${{ inputs.upload-tag-name }}
          files: |
            ${{ needs.generator.outputs.provenance-name }}

      - name: Final outcome
        id: final
        env:
          SUCCESS: ${{ steps.checkout-builder.outcome != 'failure' && steps.download-prov.outcome != 'failure' && steps.release.outcome != 'failure' }}
        run: |
          set -euo pipefail
          echo "outcome=$([ "$SUCCESS" == "true" ] && echo "success" || echo "failure")" >> "$GITHUB_OUTPUT"

  # final fails or succeeds based on the value of `inputs.continue-on-error`
  # and the outcome of previous jobs.
  final:
    outputs:
      outcome: ${{ steps.final.outputs.outcome }}
    runs-on: ubuntu-latest
    needs: [detect-env, generator, upload-assets]
    # Note: always run even if needed jobs are skipped.
    if: always()
    steps:
      - name: Final outcome
        id: final
        env:
          SUCCESS: ${{ needs.detect-env.outputs.outcome != 'failure' && needs.generator.outputs.outcome != 'failure' && needs.upload-assets.outputs.outcome != 'failure' }}
          CONTINUE: ${{ inputs.continue-on-error }}
        run: |
          set -euo pipefail
          echo "outcome=$([ "$SUCCESS" == "true" ] && echo "success" || echo "failure")" >> "$GITHUB_OUTPUT"
          [ "$CONTINUE" == "true" ] || [ "$SUCCESS" == "true" ] || exit 27

  # cleanup deletes internal artifacts used by the generator workflow
  # TODO(#2382): Delete artifacts ${{ needs.generator.outputs.subject-artifact-name }}