Skip to content

Commit

Permalink
Example CI job for GitHub Actions OIDC authenticated notary
Browse files Browse the repository at this point in the history
Signed-off-by: John Andersen <[email protected]>
  • Loading branch information
pdxjohnny committed Sep 12, 2023
1 parent f18a283 commit 4f2903a
Showing 1 changed file with 77 additions and 0 deletions.
77 changes: 77 additions & 0 deletions .github/workflows/notarize_reusable.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,77 @@
name: "SCITT Notary"

on:
push:
branches:
- main
paths-ignore:
- '**.md'
pull_request:
paths-ignore:
- '**.md'
workflow_dispatch:
inputs:
scitt-url:
description: 'URL of SCITT instance'
default: "http://localhost:8080"
type: string
payload:
description: 'Payload for claim'
default: '${{ toJSON(github.event) }}'
type: string
workflow_call:
inputs:
scitt-url:
description: 'URL of SCITT instance'
default: "http://localhost:8080"
type: string
payload:
description: 'Payload for claim'
type: string

jobs:
notarize:
runs-on: ubuntu-latest
env:
SCITT_URL: '${{ inputs.scitt-url || github.event.inputs.scitt-url }}'
PAYLOAD: '${{ inputs.payload || github.event.inputs.payload }}'
steps:
- uses: actions/checkout@v4
- name: Set up Python 3.8
uses: actions/setup-python@v4
with:
python-version: 3.8
- name: Install SCITT API Emulator
run: |
pip install -U pip setuptools wheel
pip install .[oidc]
- name: Get OIDC token to use as bearer token for auth to SCITT
uses: actions/github-script@v6
id: github-oidc
with:
script: |
const {SCITT_URL} = process.env;
const coredemo = require('@actions/core');
coredemo.setOutput('token', await coredemo.getIDToken(SCITT_URL));
- name: Create claim
run: |
scitt-emulator client create-claim --issuer did:web:example.org --content-type application/json --payload "${PAYLOAD}" --out claim.cose
- name: Submit claim
env:
OIDC_TOKEN: '${{ steps.github-oidc.outputs.token }}'
run: |
# Create the middleware config file
cat > oidc-middleware-config.json <<EOF
{
"issuer": "https://token.actions.githubusercontent.com",
"audience": "${SCITT_URL}"
}
EOF
# Start SCITT using the `OIDCAuthMiddleware` and associated config.
if [[ "x${SCITT_URL}" != "http://localhost:8080" ]]; then
scitt-emulator server --port 8080 --workspace workspace/ --tree-alg CCF \
--middleware scitt_emulator.oidc:OIDCAuthMiddleware \
--middleware-config-path oidc-middleware-config.json &
fi
# Submit the claim using OIDC token as auth
scitt-emulator client submit-claim --token "${OIDC_TOKEN}" --url "${SCITT_URL}" --claim claim.cose --out claim.receipt.cbor

0 comments on commit 4f2903a

Please sign in to comment.