Skip to content

Update delegator_lowperms-generic_slsa3.yml #410

Update delegator_lowperms-generic_slsa3.yml

Update delegator_lowperms-generic_slsa3.yml #410

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: unit tests
on:
push:
branches: [main, "*"]
pull_request:
# The branches below must be a subset of the branches above
branches: [main]
merge_group:
workflow_dispatch:
permissions: read-all
jobs:
pre-submit:
# NOTE: this name is used as the status check name and by protected
# branches for required status checks. It should have a unique name among
# other pre-submits.
name: unit tests
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- name: setup-go
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
with:
go-version-file: "go.mod"
- name: Set Node.js 16
uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
with:
node-version: 16
- name: unit tests
run: |
sha256sum .github/actions/tscommon/tscommon-0.0.0.tgz
make unit-test
check-verifier:
name: verify slsa-verifier is latest
runs-on: ubuntu-latest
if: ${{ always() }}
steps:
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
path: generator
- name: Checkout
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
path: verifier
repository: slsa-framework/slsa-verifier
- name: Check verifier references
shell: bash
run: |
set -euo pipefail
# The first sha in SHA256SUM.md for slsa-verifier-linux-amd64 is the latest verifier release sha
expected_sha=$(grep -m 1 -w -o -e '[0-9a-f]\{64\} *slsa-verifier-linux-amd64' verifier/SHA256SUM.md | awk '{ print $1 }')
echo "$expected_sha"
# The first vX.Y.Z in SHA256SUM.md is the latest verifier release version
expected_version=$(grep -e 'v[0-9].[0-9].[0-9]' -o -m 1 -w verifier/SHA256SUM.md | head -1)
echo "$expected_version"
# Check for expected verifier releases in the builders
cd generator
error=0
verifier_release_binary_sha256="$(grep -r -e 'VERIFIER_RELEASE_BINARY_SHA256: [0-9a-f]\{64\}' --include=*.yml)"
while read -r line ; do
sha=$(echo "$line" | grep -o -e '[0-9a-f]\{64\}')
file=$(echo "$line" | awk '{print $1;}')
if [ "$sha" != "$expected_sha" ]; then
echo "SHA out of date in file $file expected $expected_sha"
error=1
fi
done <<<"${verifier_release_binary_sha256}"
verifier_release="$(grep -r -e 'VERIFIER_RELEASE: v[0-9].[0-9].[0-9]' --include=*.yml)"
while read -r line ; do
version=$(echo "$line" | grep -o -e 'v[0-9].[0-9].[0-9]')
file=$(echo "$line" | awk '{print $1;}')
if [ "$version" != "$expected_version" ]; then
echo "Verifier version out of date in file $file expected $expected_version"
error=1
fi
done <<<"${verifier_release}"
if [ $error -ne 0 ]; then
exit 1
fi