action.yml

name: "Generate the builder"
description: "Build or fetch the builder binary"
inputs:
  ref:
    description: "A fully formed ref (refs/...) or SHA to checkout."
    required: true
  repository:
    description: "Repository of the builder."
    required: true
  binary:
    description: "Name of the compiled binary. (Note: just the filename, not the path)"
    required: true
  compile-builder:
    description: "Whether to compile the builder or not."
    required: true
  directory:
    description: "Directory of the source code of the builder. (Note: expect no trailing `/`)"
    required: true
  go-version:
    description: "The Go version to use, as expected by https://github.com/actions/setup-go."
    required: true
  allow-private-repository:
    description: "If set to true, allows the action to complete successfully even if the repo is private."
    type: boolean
    required: false
    default: false

  token:
    description: "GitHub token"
    required: false
    default: ${{ github.token }}

outputs:
  sha256:
    description: "SHA256 of the builder binary."
    value: ${{ steps.compute.outputs.sha256 }}

runs:
  using: "composite"
  steps:
    - name: Checkout builder repository
      uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
      with:
        repository: ${{ inputs.repository }}
        ref: ${{ inputs.ref }}
        path: __BUILDER_CHECKOUT_DIR__

    - name: Check private repos
      uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check
      with:
        error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override."
        override: ${{ inputs.allow-private-repository }}

    - name: Set up Go environment
      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
      with:
        go-version: ${{ inputs.go-version }}

    - name: Generate builder
      shell: bash
      env:
        # Builder.
        BUILDER_REPOSITORY: slsa-framework/slsa-github-generator # The repository to download the pre-built builder binary from.
        BUILDER_RELEASE_BINARY: "${{ inputs.binary }}" # The name of the pre-built binary in the release assets. This is also used as the final binary name when compiling the builder from source.
        # Verifier
        # NOTE: These VERIFIER_* variables are used in the builder-fetch.sh script for verification of builder
        # release binaries when the compile-builder input is false.
        VERIFIER_REPOSITORY: slsa-framework/slsa-verifier # The repository to download the pre-built verifier binary from.
        VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64 # The name of the verifier binary in the release assets.
        VERIFIER_RELEASE_BINARY_SHA256: b1d6c9bbce6274e253f0be33158cacd7fb894c5ebd643f14a911bfe55574f4c0 # The expected hash of the verifier binary.
        VERIFIER_RELEASE: v1.3.2 # The version of the verifier to download.

        COMPILE_BUILDER: "${{ inputs.compile-builder }}"
        BUILDER_REF: "${{ inputs.ref }}"
        BUILDER_DIR: "./__BUILDER_CHECKOUT_DIR__/${{ inputs.directory }}"
        # Needed for the gh CLI used in builder-fetch.sh.
        GH_TOKEN: "${{ inputs.token }}"
      run: ./__BUILDER_CHECKOUT_DIR__/.github/actions/generate-builder/generate-builder.sh

    - name: Compute sha256 of builder
      uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256
      id: compute
      with:
        path: "${{ inputs.binary }}"