kind-cluster-image-policy-with-attestations.yaml

# Copyright 2022 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Test cosigned with ClusterImagePolicy with attestations

on:
  pull_request:
    branches: [ 'main', 'release-*' ]

defaults:
  run:
    shell: bash

permissions: read-all

jobs:
  cip-test:
    name: ClusterImagePolicy e2e tests
    runs-on: ubuntu-latest

    strategy:
      matrix:
        k8s-version:
        - v1.21.x
        - v1.22.x
        # Try without this one now, might have problems with job restartings
        # may require upstream changes.
        - v1.23.x

    env:
      KNATIVE_VERSION: "1.1.0"
      KO_DOCKER_REPO: "registry.local:5000/cosigned"
      SCAFFOLDING_RELEASE_VERSION: "v0.2.8"
      GO111MODULE: on
      GOFLAGS: -ldflags=-s -ldflags=-w
      KOCACHE: ~/ko
      COSIGN_EXPERIMENTAL: true

    steps:
    - uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748 # v2.4.0
    - uses: actions/setup-go@f6164bd8c8acb4a71fb2791a8b6c4024ff038dab # v2.2.0
      with:
        go-version: '1.17.x'

    # will use the latest release available for ko
    - uses: imjasonh/setup-ko@2c3450ca27f6e6f2b02e72a40f2163c281a1f675 # v0.4

    - uses: imranismail/setup-kustomize@8fa954828ed3cfa7a487a2ba9f7104899bb48b2f # v1.6.1

    - name: Install yq
      uses: mikefarah/yq@1425d0720ec16e51172b88c871ac85f56bcd8ae3 # v4.16.2

    - name: Setup mirror
      uses: chainguard-dev/actions/setup-mirror@main
      with:
        mirror: mirror.gcr.io

    - name: build cosign
      run: |
        make cosign

    - name: Install cluster + cosign
      uses: sigstore/scaffolding/actions/setup@main

    - name: Install cosigned
      env:
        GIT_HASH: ${{ github.sha }}
        GIT_VERSION: ci
        LDFLAGS: ""
        COSIGNED_YAML: cosigned-e2e.yaml
        KO_PREFIX: registry.local:5000/cosigned
        COSIGNED_ARCHS: linux/amd64
      run: |
        make ko-cosigned
        kubectl apply -f cosigned-e2e.yaml

        # Wait for the webhook to come up and become Ready
        kubectl rollout status --timeout 5m --namespace cosign-system deployments/webhook

    - name: Run Cluster Image Policy Tests with attestations
      run: |
        ./test/e2e_test_cluster_image_policy_with_attestations.sh

    - name: Collect diagnostics
      if: ${{ failure() }}
      uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main