builder_go_slsa3.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Copyright The GOSST team.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: SLSA go builder

permissions:
  contents: read

env:
  # Project.
  GENERATED_BINARY_NAME: go-compiled-binary
  # Builder.
  BUILDER_BINARY: slsa-builder-go-linux-amd64 # Name of the binary in the release assets.
  BUILDER_DIR: internal/builders/go # Source directory if we compile the builder.
defaults:
  run:
    shell: bash

###################################################################
#                                                                 #
#            Input and output argument definitions                #
#                                                                 #
###################################################################
on:
  workflow_call:
    inputs:
      go-version:
        description: "The go version to use."
        required: false
        type: string
      go-version-file:
        description: "Path to the go.mod or go.work file."
        required: false
        type: string
      upload-assets:
        description: >
          If true, provenance is uploaded to a GitHub release for new tags.
          When the workflow does not run on a new tag, such as on a workflow_dispatch,
          the `upload-tag-name` argument must be provided as well.
        required: false
        type: boolean
        default: true
      upload-tag-name:
        description: >
          If non-empty and `upload-assets` is set to true, the provenance is uploaded to the GitHub
          release identified by the tag name. If a workflow is run on a new tag and `upload-tag-name`
          is non-empty, the new tag is ignored and the value of `upload-tag-name` is used instead to upload
          the assets.
        type: string
        default: ""
      config-file:
        description: "The configuration file for the builder. A path within the calling repository."
        required: false
        type: string
        default: ".slsa-goreleaser.yml"
      evaluated-envs:
        description: "Evaluated env variables to pass to the builder."
        required: false
        type: string
      compile-builder:
        description: "Build the builder from source. This increases build time by ~2m."
        required: false
        type: boolean
        default: false
      private-repository:
        description: "If true, private repositories can post to the public transparency log."
        required: false
        type: boolean
        default: false
      prerelease:
        description: >
          Boolean identifying the release as a prerelease.  If 'true' then the
          created release is marked as a prerelease. If other non-empty value
          then it is not marked as a prerelease.

          The default is to not modify the prerelease setting for existing
          releases, and false for new releases.
        required: false
        type: string
        default: ""
      draft-release:
        description: >
          Boolean identifying the release as a draft.  If 'true' then the
          created release is marked as a draft. If other non-empty value
          then it is not marked as a draft.

          The default is to not modify the draft setting for existing
          releases, and false for new releases.
        required: false
        type: string
        default: ""
    outputs:
      go-binary-name:
        description: "The name of the generated binary uploaded to the artifact registry."
        value: ${{ jobs.build-dry.outputs.go-binary-name }}
      go-provenance-name:
        description: "The artifact name of the signed provenance. (A file with the intoto.jsonl extension)."
        value: ${{ jobs.provenance.outputs.go-provenance-name }}

jobs:
  rng:
    outputs:
      value: ${{ steps.rng.outputs.random }}
    runs-on: ubuntu-latest
    steps:
      - name: Generate random 16-byte value (32-char hex encoded)
        id: rng
        uses: slsa-framework/slsa-github-generator/.github/actions/rng@main

  detect-env:
    outputs:
      repository: ${{ steps.detect.outputs.repository }}
      ref: ${{ steps.detect.outputs.ref }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Needed to detect the current reusable repository and ref.
    steps:
      - name: Detect the builder ref
        id: detect
        uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow-js@main

  ###################################################################
  #                                                                 #
  #                       Build the builder                         #
  #                                                                 #
  ###################################################################
  builder:
    outputs:
      go-builder-sha256: ${{ steps.generate.outputs.sha256 }}
    runs-on: ubuntu-latest
    needs: [detect-env, rng]
    steps:
      - name: Generate builder binary
        id: generate
        uses: slsa-framework/slsa-github-generator/.github/actions/generate-builder@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          go-version: "1.21"
          # Note: This must be the non-randomized binary name, so that it can be downloaded from the release assets.
          binary: "${{ env.BUILDER_BINARY }}"
          compile-builder: "${{ inputs.compile-builder }}"
          directory: "${{ env.BUILDER_DIR }}"
          allow-private-repository: ${{ inputs.private-repository }}

      - name: Upload builder
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
          path: "${{ env.BUILDER_BINARY }}"
          if-no-files-found: error
          retention-days: 5

  ###################################################################
  #                                                                 #
  #                 Build dry to resolve variables                  #
  #                                                                 #
  ###################################################################
  build-dry:
    outputs:
      go-binary-name: ${{ steps.build-dry.outputs.go-binary-name }}
      go-command: ${{ steps.build-dry.outputs.go-command }}
      go-env: ${{ steps.build-dry.outputs.go-env }}
      go-working-dir: ${{ steps.build-dry.outputs.go-working-dir }}
    runs-on: ubuntu-latest
    needs: [builder, rng, detect-env]
    steps:
      - name: Checkout builder repository
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          path: __BUILDER_CHECKOUT_DIR__

      - name: Checkout the Go repository
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-project-checkout-go
        with:
          path: __PROJECT_CHECKOUT_DIR__
          go-version: ${{ inputs.go-version }}
          go-version-file: ${{ inputs.go-version-file }}

      - name: Download builder
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
        with:
          name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
          path: "${{ env.BUILDER_BINARY }}"
          sha256: "${{ needs.builder.outputs.go-builder-sha256 }}"
          set-executable: true

      - name: Build dry project
        id: build-dry
        working-directory: __PROJECT_CHECKOUT_DIR__
        env:
          CONFIG_FILE: "${{ inputs.config-file }}"
          UNTRUSTED_ENVS: "${{ inputs.evaluated-envs }}"
        run: |
          set -euo pipefail

          # Note: this outputs information about resolved arguments, etc.
          # the values are trusted because the compiler is not invoked.
          echo "$GITHUB_WORKSPACE/$BUILDER_BINARY" build --dry "$CONFIG_FILE" "$UNTRUSTED_ENVS"
          "$GITHUB_WORKSPACE/$BUILDER_BINARY" build --dry "$CONFIG_FILE" "$UNTRUSTED_ENVS"

  ###################################################################
  #                                                                 #
  #                       Build the project                         #
  #                                                                 #
  ###################################################################
  build:
    outputs:
      go-binary-sha256: ${{ steps.upload.outputs.sha256 }}
    runs-on: ubuntu-latest
    needs: [builder, build-dry, rng, detect-env]
    steps:
      - name: Checkout builder repository
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          path: __BUILDER_CHECKOUT_DIR__

      - name: Checkout the Go repository
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-project-checkout-go
        with:
          path: __PROJECT_CHECKOUT_DIR__
          go-version: ${{ inputs.go-version }}
          go-version-file: ${{ inputs.go-version-file }}

      - name: Download builder
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
        with:
          name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
          path: "${{ env.BUILDER_BINARY }}"
          sha256: "${{ needs.builder.outputs.go-builder-sha256 }}"
          set-executable: true

      - name: Download dependencies
        working-directory: __PROJECT_CHECKOUT_DIR__
        env:
          UNTRUSTED_WORKING_DIR: "${{ needs.build-dry.outputs.go-working-dir }}"
        run: |
          set -euo pipefail

          # Note: maybe simpler to make this step part of the builder in the future.
          cd "$UNTRUSTED_WORKING_DIR"
          go mod vendor

      # TODO(hermeticity) OS-level.
      # - name: Disable hermeticity
      # uses: slsa/hermeticity@xxx
      #   with:
      #     to-state: enabled

      - name: Build project
        id: build-gen
        working-directory: __PROJECT_CHECKOUT_DIR__
        env:
          GITHUB_TOKEN: "${{ github.token }}"
          CONFIG_FILE: "${{ inputs.config-file }}"
          UNTRUSTED_ENVS: "${{ inputs.evaluated-envs }}"
          UNTRUSTED_BINARY_NAME: "${{ needs.build-dry.outputs.go-binary-name }}"
        run: |
          set -euo pipefail

          echo "::stop-commands::$(echo -n "${GITHUB_TOKEN}" | sha256sum | head -c 64)"

          echo "$GITHUB_WORKSPACE/$BUILDER_BINARY" build "$CONFIG_FILE" "$UNTRUSTED_ENVS"
          # Note: We need to provide the asbolute path to the output binary.
          export OUTPUT_BINARY="$PWD/${{ env.GENERATED_BINARY_NAME }}"
          "$GITHUB_WORKSPACE/$BUILDER_BINARY" build "$CONFIG_FILE" "$UNTRUSTED_ENVS"

          mv "${{ env.GENERATED_BINARY_NAME }}" "$GITHUB_WORKSPACE/$UNTRUSTED_BINARY_NAME"

      - name: Upload generated binary
        id: upload
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-upload-artifact
        with:
          name: "${{ needs.build-dry.outputs.go-binary-name }}"
          path: "${{ needs.build-dry.outputs.go-binary-name }}"

  ###################################################################
  #                                                                 #
  #                 Generate the SLSA provenance                    #
  #                                                                 #
  ###################################################################
  provenance:
    runs-on: ubuntu-latest
    needs: [builder, build, build-dry, rng, detect-env]
    permissions:
      id-token: write # Needed to create an OIDC token for keyless signing.
      contents: read
      actions: read # Needed to read workflow info.
    outputs:
      go-provenance-name: ${{ steps.sign-prov.outputs.signed-provenance-name }}
      go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }}
    steps:
      - name: Checkout builder repository
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          path: __BUILDER_CHECKOUT_DIR__

      - name: Download builder
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
        with:
          name: "${{ env.BUILDER_BINARY }}-${{ needs.rng.outputs.value }}"
          path: "${{ env.BUILDER_BINARY }}"
          sha256: "${{ needs.builder.outputs.go-builder-sha256 }}"
          set-executable: true

      - name: Create and sign provenance
        id: sign-prov
        env:
          UNTRUSTED_BINARY_NAME: "${{ needs.build-dry.outputs.go-binary-name }}"
          UNTRUSTED_BINARY_HASH: "${{ needs.build.outputs.go-binary-sha256 }}"
          UNTRUSTED_COMMAND: "${{ needs.build-dry.outputs.go-command }}"
          UNTRUSTED_ENV: "${{ needs.build-dry.outputs.go-env }}"
          UNTRUSTED_WORKING_DIR: "${{ needs.build-dry.outputs.go-working-dir }}"
          GITHUB_CONTEXT: "${{ toJSON(github) }}"
        run: |
          set -euo pipefail

          echo "provenance generator is $BUILDER_BINARY"

          # Create and sign provenance
          # This sets signed-provenance-name to the name of the signed DSSE envelope.
          "$GITHUB_WORKSPACE/$BUILDER_BINARY" provenance \
            --binary-name "$UNTRUSTED_BINARY_NAME" \
            --digest "$UNTRUSTED_BINARY_HASH" \
            --command "$UNTRUSTED_COMMAND" \
            --env "$UNTRUSTED_ENV" \
            --workingDir "$UNTRUSTED_WORKING_DIR"

      - name: Upload the signed provenance
        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
        with:
          name: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
          path: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
          if-no-files-found: error
          retention-days: 5

  ###################################################################
  #                                                                 #
  #           Upload binaries and provenances as assets             #
  #                                                                 #
  ###################################################################
  upload-assets:
    permissions:
      contents: write # Needed to write artifacts to a release.
    runs-on: ubuntu-latest
    needs: [build-dry, build, provenance, detect-env]
    if: inputs.upload-assets && (startsWith(github.ref, 'refs/tags/') || inputs.upload-tag-name != '')
    steps:
      - name: Checkout builder repository
        uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
        with:
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"
          path: __BUILDER_CHECKOUT_DIR__

      - name: Download binary
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
        with:
          name: "${{ needs.build-dry.outputs.go-binary-name }}"
          path: "${{ needs.build-dry.outputs.go-binary-name }}"
          sha256: "${{ needs.build.outputs.go-binary-sha256 }}"

      - name: Download provenance
        uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/secure-download-artifact
        with:
          name: "${{ needs.provenance.outputs.go-provenance-name }}"
          path: "${{ needs.provenance.outputs.go-provenance-name }}"
          sha256: "${{ needs.provenance.outputs.go-provenance-sha256 }}"

      - name: Upload provenance
        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
        with:
          tag_name: ${{ inputs.upload-tag-name }}
          prerelease: ${{ inputs.prerelease }}
          files: |
            ${{ needs.build-dry.outputs.go-binary-name }}
            ${{ needs.provenance.outputs.go-provenance-name }}
          draft: ${{ inputs.draft-release }}