witness.yml

# Copyright 2023 The Witness Contributors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

on:
    workflow_call:
        inputs:
            pull_request:
                required: true
                type: boolean
            artifact-download:
                required: false
                type: string
            artifact-upload-name:
                required: false
                type: string
            artifact-upload-path:
                required: false
                type: string
            pre-command:
                required: false
                type: string
            command:
                required: true
                type: string
            step:
                required: true
                type: string
            attestations:
                required: true
                type: string

permissions:
  contents: read

jobs:
    witness:
        runs-on: ubuntu-latest
        permissions:
          contents: read
          id-token: write
        steps:
          - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
          - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
            with:
              go-version: 1.23.x

          - if: ${{ inputs.artifact-download != '' }}
            uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
            with:
              name: ${{ inputs.artifact-download }}
              path: /tmp

          - if: ${{ inputs.pre-command != '' && inputs.pull_request == false }}
            uses: testifysec/witness-run-action@79320a907f611f2fb40ced8e13c66af988b2d9db
            with:
              step: pre-${{ inputs.step }}
              attestations: ${{ inputs.attestations }}
              command: /bin/sh -c "${{ inputs.pre-command }}"
          - if: ${{ inputs.pre-command != '' && inputs.pull_request == true }}
            run: ${{ inputs.pre-command }}

          - if: ${{ inputs.pull_request == false }}
            uses: testifysec/witness-run-action@79320a907f611f2fb40ced8e13c66af988b2d9db
            with:
              step: ${{ inputs.step }}
              attestations: ${{ inputs.attestations }}
              command: /bin/sh -c "${{ inputs.command }}"
          - if: ${{ inputs.pull_request == true }}
            run: ${{ inputs.command }}

          - if: ${{ inputs.artifact-upload-path != '' && inputs.artifact-upload-name != ''}}
            uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
            with:
              name: ${{ inputs.artifact-upload-name }}
              path: ${{ inputs.artifact-upload-path }}