Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore: Make maven publisher an action #2482

Merged
merged 46 commits into from
Aug 1, 2023
Merged

chore: Make maven publisher an action #2482

merged 46 commits into from
Aug 1, 2023

Conversation

AdamKorcz
Copy link
Collaborator

Closes #2369

laurentsimon
laurentsimon reviewed Jul 26, 2023
View reviewed changes
Copy link
Collaborator

@laurentsimon laurentsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks @AdamKorcz Looking pretty good. Just a few nits and we should be ready to merge.

actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
ianlewis
ianlewis reviewed Jul 26, 2023
View reviewed changes
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
@laurentsimon
Copy link
Collaborator

@AdamKorcz please ping when the comments are resolved. I don't always know when I should re-review. Thanks!

@AdamKorcz
Copy link
Collaborator Author

@laurentsimon @ianlewis This one should be ready to review again. Note that this uses a plugin that hashes the artifacts and creates the json. Ideally this should be hosted at a slsa-framework-owned Maven Central repository account.

laurentsimon
laurentsimon reviewed Jul 28, 2023
View reviewed changes
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Show resolved Hide resolved
internal/builders/maven/README.md Show resolved Hide resolved
laurentsimon
laurentsimon reviewed Jul 30, 2023
View reviewed changes
actions/maven/publish/action.yml Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
internal/builders/maven/README.md Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
ianlewis
ianlewis reviewed Jul 31, 2023
View reviewed changes
actions/maven/publish/action.yml Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
internal/builders/maven/README.md Outdated Show resolved Hide resolved
@AdamKorcz AdamKorcz force-pushed the maven-publisher-to-action branch 2 times, most recently from f652d2d to 6e4ee0e Compare July 31, 2023 23:02
@AdamKorcz
Copy link
Collaborator Author

Ready for another round of review except for #2482 (comment).

ianlewis
ianlewis reviewed Aug 1, 2023
View reviewed changes
actions/maven/publish/action.yml Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
actions/maven/publish/action.yml Outdated Show resolved Hide resolved
...aven/publish/slsa-hashing-plugin/src/main/java/io/github/slsa-framework/JarfileHashMojo.java Show resolved Hide resolved
internal/builders/maven/action.yml Outdated Show resolved Hide resolved
internal/builders/maven/action.yml Outdated Show resolved Hide resolved
AdamKorcz and others added 15 commits August 1, 2023 12:06
@AdamKorcz
chore: Make maven publisher an action
614721d 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
fix nits
a7778a8 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
lowercase more variables
eb64e50 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
remove '@'
3e04e30 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
use secure-project-checkout at main
d2cacb8 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Nnnnnnnnn (#1)
2d1b88a 
* Create JarfileHashMojo.java

Signed-off-by: AdamKorcz <[email protected]>

* Create pom.xml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Delete JarfileHashMojo.java

Signed-off-by: AdamKorcz <[email protected]>

* Delete pom.xml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update README.md

Signed-off-by: AdamKorcz <[email protected]>

* Update action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Update README.md

Signed-off-by: AdamKorcz <[email protected]>

* Update README.md

Signed-off-by: AdamKorcz <[email protected]>

---------

Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update README.md
0bf054b 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update README.md
e8023f3 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
remove .intoto
2581ef9 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
remove two more cases of .intoto
9b2cae9 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update README.md
e23e88e 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update README.md
45afa78 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update actions/maven/publish/action.yml
8cb0d99 
Co-authored-by: Ian Lewis <[email protected]>
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update actions/maven/publish/action.yml
aa0ab47 
Co-authored-by: Ian Lewis <[email protected]>
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Install hashing plugin from tool dir (#2)
b12e9f3 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
rename __TOOL_CHECKOUT_DIR__ to __BUILDER_CHECKOUT_DIR__
9bee2f4 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
debug
20fa4a7 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update action.yml
6dae016 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update action.yml
4c021a1 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update action.yml
7081556 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update action.yml
46897c8 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Update action.yml
fcb67a5 
Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz
Copy link
Collaborator Author

@laurentsimon @ianlewis Please check again.

laurentsimon
laurentsimon reviewed Aug 1, 2023
View reviewed changes
actions/maven/publish/action.yml
SLSA_DIR: "${{ inputs.provenance-download-name }}"
PROVENANCE_FILES: "${{ inputs.provenance-download-name }}"
run: |
cd __BUILDER_CHECKOUT_DIR__/actions/maven/publish/slsa-hashing-plugin && mvn clean install && cd -
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

better to mve this to ../ to keep the git tree clean (some tools check for that), but we can do that later.

@laurentsimon
Update action.yml
f7fa441 
Signed-off-by: laurentsimon <[email protected]>
@laurentsimon
Use v1.8.0 as ref
78a5806 
Signed-off-by: laurentsimon <[email protected]>
laurentsimon
laurentsimon reviewed Aug 1, 2023
View reviewed changes
actions/maven/publish/action.yml
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
with:
repository: slsa-framework/slsa-github-generator
ref: v1.8.0
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AdamKorcz fyi I updated this to v1.8.0

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@laurentsimon is this expected to work right now?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

no its not. It will only work after the release. I'll work on #2508 to be sure we don't forget

@laurentsimon laurentsimon enabled auto-merge (squash) August 1, 2023 21:57
@laurentsimon laurentsimon merged commit a594a20 into slsa-framework:main Aug 1, 2023
@AdamKorcz AdamKorcz mentioned this pull request Aug 1, 2023
Merged
laurentsimon pushed a commit that referenced this pull request Aug 1, 2023
@AdamKorcz
chore: ref v1.8.0 instead of main (#2509)
9c94c20 
Similar to
#2482 (comment)

cc @laurentsimon

Signed-off-by: AdamKorcz <[email protected]>
@AdamKorcz AdamKorcz deleted the maven-publisher-to-action branch August 4, 2023 11:25
enteraga6 pushed a commit to enteraga6/slsa-github-generator that referenced this pull request Aug 8, 2023
@AdamKorcz @laurentsimon @enteraga6
chore: Make maven publisher an action (slsa-framework#2482)
b3d9c7f 
Closes
slsa-framework#2369

---------

Signed-off-by: AdamKorcz <[email protected]>
Signed-off-by: AdamKorcz <[email protected]>
Signed-off-by: laurentsimon <[email protected]>
Co-authored-by: Ian Lewis <[email protected]>
Co-authored-by: laurentsimon <[email protected]>
Signed-off-by: Noah Elzner <[email protected]>
enteraga6 pushed a commit to enteraga6/slsa-github-generator that referenced this pull request Aug 8, 2023
@AdamKorcz @enteraga6
chore: ref v1.8.0 instead of main (slsa-framework#2509)
0dd3951 
Similar to
slsa-framework#2482 (comment)

cc @laurentsimon

Signed-off-by: AdamKorcz <[email protected]>
Signed-off-by: Noah Elzner <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@laurentsimon laurentsimon laurentsimon approved these changes

@ianlewis ianlewis ianlewis left review comments

@asraa asraa Awaiting requested review from asraa

@joshuagl joshuagl Awaiting requested review from joshuagl joshuagl is a code owner

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[feature] Maven builder publish Action
3 participants
@AdamKorcz @laurentsimon @ianlewis