gemini-nano/.github/workflows/provenance.yml at master · Coding-Autopilot-System/gemini-nano · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
name: Provenance

on:
  workflow_dispatch:
  push:
    branches:
      - main
      - master
    paths:
      - ".github/workflows/provenance.yml"
      - ".github/workflows/ci.yml"
      - "README.md"
      - "SETUP.md"
      - "mkdocs.yml"
      - "docs/**"
      - "api-server/**"
      - "chrome-bridge/**"
      - "chrome-demo/**"
      - "python-mediapipe/**"
  pull_request:
    paths:
      - ".github/workflows/provenance.yml"
      - ".github/workflows/ci.yml"
      - "README.md"
      - "SETUP.md"
      - "mkdocs.yml"
      - "docs/**"
      - "api-server/**"
      - "chrome-bridge/**"
      - "chrome-demo/**"
      - "python-mediapipe/**"

permissions:
  contents: read
  attestations: write
  id-token: write
  artifact-metadata: write

jobs:
  attest-demo-bundle:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
      attestations: write
      id-token: write
      artifact-metadata: write
    env:
      GH_TOKEN: ${{ github.token }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.12"
          cache: pip
          cache-dependency-path: api-server/requirements.txt

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: chrome-bridge/package-lock.json

      - name: Validate api-server
        working-directory: api-server
        env:
          SKIP_INTEGRATION: "1"
        run: |
          pip install -r requirements.txt
          pip install pytest ruff
          ruff check .
          python -m pytest test_server.py -q

      - name: Validate chrome-bridge
        working-directory: chrome-bridge
        run: |
          npm ci --ignore-scripts
          npm test

      - name: Build docs site
        run: |
          pip install mkdocs-material
          mkdocs build --strict

      - name: Create Gemini Nano demo bundle
        run: |
          tar -czf "gemini-nano-demo-bundle-${GITHUB_SHA}.tar.gz" \
            README.md \
            SETUP.md \
            mkdocs.yml \
            docs \
            site \
            api-server/server.py \
            api-server/requirements.txt \
            api-server/start.ps1 \
            chrome-bridge/server.js \
            chrome-bridge/package.json \
            chrome-bridge/package-lock.json \
            chrome-bridge/start.ps1 \
            chrome-demo/index.html \
            python-mediapipe/requirements.txt \
            python-mediapipe/run_nano.py
          sha256sum "gemini-nano-demo-bundle-${GITHUB_SHA}.tar.gz" | tee "gemini-nano-demo-bundle-${GITHUB_SHA}.sha256"

      - name: Attest Gemini Nano demo bundle
        id: attest
        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4
        with:
          subject-path: "gemini-nano-demo-bundle-${{ github.sha }}.tar.gz"

      - name: Verify current run attestation
        run: |
          gh attestation verify "gemini-nano-demo-bundle-${GITHUB_SHA}.tar.gz" \
            --repo Coding-Autopilot-System/gemini-nano \
            --signer-workflow Coding-Autopilot-System/gemini-nano/.github/workflows/provenance.yml \
            --source-ref "${GITHUB_REF}"

      - name: Publish Gemini Nano demo bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: gemini-nano-demo-bundle
          path: |
            gemini-nano-demo-bundle-${{ github.sha }}.tar.gz
            gemini-nano-demo-bundle-${{ github.sha }}.sha256

      - name: Publish Gemini Nano attestation bundle
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: gemini-nano-attestation-bundle
          path: ${{ steps.attest.outputs.bundle-path }}

      - name: Write provenance summary
        run: |
          {
            echo "## Gemini Nano Provenance"
            echo
            echo "- Artifact: \`gemini-nano-demo-bundle-${GITHUB_SHA}.tar.gz\`"
            echo "- Attestation: ${{ steps.attest.outputs.attestation-url }}"
            echo "- Bundle artifact: \`gemini-nano-attestation-bundle\`"
          } >> "$GITHUB_STEP_SUMMARY"