idp-scim-sync/.github/workflows/release.yml at main · slashdevops/idp-scim-sync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
name: "Release"

# https://help.github.com/es/actions/reference/workflow-syntax-for-github-actions#filter-pattern-cheat-sheet
on:
  push:
    tags:
      - v[0-9].[0-9]+.[0-9]*

env:
  MAKE_STOP_ON_ERRORS: true

permissions:
  contents: read

jobs:
  test:
    name: Test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Go 1.x
        id: go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: ./go.mod

      - name: Go version
        run: |
          go version

      - name: Test
        run: make test

  build:
    name: Build Distribution
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}
    steps:
      - name: Check out code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0

      - name: Set up Go 1.x
        id: go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version-file: ./go.mod

      - name: Go version
        run: |
          go version

      - name: Build Distribution Cross-Platform
        run: |
          GIT_VERSION=${{ github.ref_name }} make build-dist

      - name: Build Distribution zip Assets
        run: |
          GIT_VERSION=${{ github.ref_name }} make build-dist-zip

      - name: Generate subject hashes for SLSA provenance
        id: hash
        run: |
          cd dist/assets
          # base64-encode the sha256sum output across all release zip artifacts;
          # consumed by slsa-github-generator to bind provenance to these subjects.
          HASHES=$(sha256sum *.zip | base64 -w0)
          echo "hashes=${HASHES}" >> "$GITHUB_OUTPUT"

      - name: Upload Distribution files
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
        with:
          name: dist
          path: ./dist/
          retention-days: 1

  container_image:
    name: Publish Container Images
    needs: build
    permissions:
      contents: read
      packages: write
      id-token: write
    uses: ./.github/workflows/container-image.yml

  create-github-release:
    name: Create Github Release
    needs: build
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - name: Download Distribution files
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
        with:
          name: dist
          path: ./dist/

      - name: Create Release
        id: create-github-release
        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
        with:
          tag_name: ${{ github.ref_name }}
          name: ${{ github.ref_name }}
          draft: false
          prerelease: false
          generate_release_notes: true
          make_latest: true
          token: ${{ secrets.GITHUB_TOKEN }}
          files: |
            dist/assets/**

  provenance:
    name: Generate SLSA provenance for release assets
    needs: [build, create-github-release]
    permissions:
      actions: read       # read workflow info for provenance subject
      id-token: write     # keyless signing via Sigstore Fulcio
      contents: write     # upload multiple.intoto.jsonl to the release
    # slsa-github-generator MUST be pinned by tag, not SHA. The SLSA verifier
    # checks the workflow ref against its own allow-list of signed releases.
    # See https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md#referencing-the-slsa-generator
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
    with:
      base64-subjects: ${{ needs.build.outputs.hashes }}
      upload-assets: true

  aws_sam:
    name: Create and Publish AWS SAM Serverless Application
    needs: create-github-release
    permissions:
      contents: read
      id-token: write
      actions: read
    uses: ./.github/workflows/aws-sam.yml
    secrets:
      AWS_OIDC_ROLE_TO_ASSUME: ${{ secrets.AWS_OIDC_ROLE_TO_ASSUME }}
      SAM_APP_BUCKET: ${{ secrets.SAM_APP_BUCKET }}