action.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Gradle builder
inputs:
  # BYOB-provided inputs
  slsa-workflow-inputs:
    # Inputs in JSON format.
    description: "All the onputs"
    type: string
    required: true
  slsa-layout-file:
    description: "Location to store the layout content"
    type: string
    required: true
  slsa-workflow-secret1: {}
  slsa-workflow-secret2: {}
  slsa-workflow-secret3: {}
  slsa-workflow-secret4: {}
  slsa-workflow-secret5: {}
  slsa-workflow-secret6: {}
  slsa-workflow-secret7: {}
  slsa-workflow-secret8: {}
  slsa-workflow-secret9: {}
  slsa-workflow-secret10: {}
  slsa-workflow-secret11: {}
  slsa-workflow-secret12: {}
  slsa-workflow-secret13: {}
  slsa-workflow-secret14: {}
  slsa-workflow-secret15: {}
outputs:
  build-download-sha256:
    description: >
      The sha256 digest of the "build" directory.

      Users should verify the download against this digest to prevent tampering.
    value: ${{ steps.upload-build-dir.outputs.sha256 }}

  build-download-name:
    description: "Name of the artifact to download the build directory."
    value: "${{ steps.rng.outputs.random }}-build"

on:
  workflow_call:
runs:
  using: "composite"
  steps:
    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
    - name: Set up JDK
      uses: actions/setup-java@0ab4596768b603586c0de567f2430c30f5b0d2b0 # v3.13.0
      with:
        distribution: temurin
        java-version: ${{ fromJson(inputs.slsa-workflow-inputs).jdk-version }}
    - name: Setup Gradle
      uses: gradle/gradle-build-action@842c587ad8aa4c68eeba24c396e15af4c2e9f30a # v2.9.0
    - name: Run gradle builder
      id: run_gradle_builder
      shell: bash
      env:
        UNTRUSTED_PROJECT_ROOT: ${{ fromJson(inputs.slsa-workflow-inputs).directory }}
      run: |
        # Ensure no directory traversal.
        # NOTE: the actions/download-artifact Action only creates files
        # in the workspace directory, but this may change in the future.
        # TODO(#1893): Consolidate directory traversal checks
        validate_path() {
          untrusted_path=$1
          resolved_dir=$(readlink -m "$untrusted_path")
          wd=$(readlink -m "${GITHUB_WORKSPACE}")
          if [[ "${resolved_dir}" != "${wd}"/* ]] && [[ "${resolved_dir}" != "${wd}" ]]; then
            if [[ "${RUNNER_TEMP}" != "" ]] && [[ "${resolved_dir}" != "${RUNNER_TEMP}"/* ]] && [[ "${resolved_dir}" != "${RUNNER_TEMP}" ]]; then
              if [[ "${resolved_dir}" != /tmp/* ]] && [[ "${resolved_dir}" != "/tmp" ]]; then
                echo "Path is not in the workspace or temp directory: $untrusted_path"
                exit 1
              fi
            fi
          fi
        }
        validate_path "${UNTRUSTED_PROJECT_ROOT}"
        # remove trailing "/"'s with `realpath`
        project_root=$(realpath -e "${UNTRUSTED_PROJECT_ROOT}")

        # output the validated project root for later steps
        echo "validated_project_root=${project_root}" >> "${GITHUB_OUTPUT}"

        cd "${project_root}" \
          && ./gradlew build -x test

    # rng generates a random number to avoid name collision in artifacts
    # when multiple workflows run concurrently.
    - name: Generate random 16-byte value (32-char hex encoded)
      id: rng
      uses: slsa-framework/slsa-github-generator/.github/actions/rng@main

    - name: Put release artifacts in one directory
      shell: bash
      env:
        SLSA_OUTPUTS_ARTIFACTS_FILE: ${{ inputs.slsa-layout-file }}
        UNTRUSTED_ARTIFACT_LIST: ${{ fromJson(inputs.slsa-workflow-inputs).artifact-list }}
        PROJECT_ROOT: ${{ steps.run_gradle_builder.outputs.validated_project_root }}
      run: |
        cd "${PROJECT_ROOT}" && "${GITHUB_WORKSPACE}"/../__TOOL_ACTION_DIR__/collect_release_artifacts.sh
    - name: Make outputs
      id: make-outputs
      shell: bash
      env:
        SLSA_OUTPUTS_ARTIFACTS_FILE: ${{ inputs.slsa-layout-file }}
        PROJECT_ROOT: ${{ steps.run_gradle_builder.outputs.validated_project_root }}
      run: |
        cd "${PROJECT_ROOT}" && "${GITHUB_WORKSPACE}"/../__TOOL_ACTION_DIR__/create_attestation.sh
    - name: Move build dir to avoid making it a sub-dir when uploading
      shell: bash
      env:
        PROJECT_ROOT: ${{ steps.run_gradle_builder.outputs.validated_project_root }}
      run: |
        mv "${PROJECT_ROOT}"/build "${GITHUB_WORKSPACE}"/
    - name: Upload build dir
      id: upload-build-dir
      uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-folder@main
      with:
        name: "${{ steps.rng.outputs.random }}-build"
        path: build