Add setup-sc-tooling + install-attest-tools composites (Step A+B of pin-reduction)#12
Merged
Cre-eD merged 3 commits intoMay 17, 2026
Conversation
… pin-reduction)
Consolidates the two most-paired composite actions into higher-level
ones so consumers reference one composite instead of two-to-three.
## setup-sc-tooling
Wraps install-sc + install-welder with skip flags so consumers that
need only one (e.g. simple-forge.yml uses welder alone) still go through
the same entry point.
jobs:
build:
steps:
- uses: simple-container-com/actions/setup-sc-tooling@<sha>
# was: install-sc + install-welder on two separate `uses:` lines
Both install scripts are invoked directly via `${{ github.action_path
}}/../install-sc/install.sh` instead of `uses:`-ing the sibling
composite — GitHub Actions doesn't support `${{ github.action_ref }}`
in `uses:` ref positions, so the indirection would require hardcoding a
self-referencing SHA. Calling the .sh scripts directly keeps the
composite self-contained at whatever ref the consumer pinned.
## install-attest-tools
Promotes simple-container-com/api's local
.github/actions/install-attest-tools to the shared ruleset for
cross-consumer reuse. Installs cosign (v2.4.1) + syft (v1.16.0) at
SHA-pinned versions and asserts `gh` is on PATH (used by `gh
attestation verify`).
Every consumer publishing signed artifacts needs this same toolchain at
the same versions; sharing it here means a single bump propagates to
all consumers via Dependabot.
## Tests
New `.github/workflows/self-test-composites.yml` exercises:
- setup-sc-tooling default (both tools install, outputs populated,
binaries executable);
- setup-sc-tooling with `install-welder: false` (sc present, welder
absent — guards the skip-flag plumbing);
- setup-sc-tooling with `install-sc: false` (mirror case);
- install-attest-tools (cosign + syft + gh all run `--version`).
actionlint clean.
## Consumer-side impact (followup PR)
After this lands, simple-container-com/api will swap:
- install-sc (×8) + install-welder (×6) → setup-sc-tooling (×4)
- local install-attest-tools (×3) → install-attest-tools (×3, shared ref)
Net pin reduction: 27 → 17 entries (Step A+B of the consolidation
plan). Step C (full sc-release reusable workflow) tracked in
HARDENING.md for a dedicated session — that one needs preview-build
validation cycles that don't fit a single review pass.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
Security Scan ResultsRepository:
Scanned at 2026-05-16 20:50 UTC |
Semgrep Scan ResultsRepository:
Scanned at 2026-05-16 20:50 UTC |
The semgrep-self-test scan fired `gha-checkout-missing-persist-credentials-false`
three times on this same workflow file — the rule's regex expects the
flag on its own line (block form `with:\n persist-credentials: false`)
and doesn't recognize the inline-flow `with: { persist-credentials:
false }` form I used for the three skip-flag jobs.
Eating our own dogfood: convert all four checkout steps to block form.
`bash semgrep-scan/run-tests.sh` now 0 findings full-repo.
Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
The other composites in this repo (install-sc, install-welder, notify-telegram, sbom-generate, sbom-scan, trufflehog-scan, …) all ship without a dedicated per-composite self-test workflow. setup-sc- tooling and install-attest-tools are thin wrappers that delegate to existing install.sh scripts; the real integration surface is consumer CI (api, everworker, payspace) which exercises them on every release. If we ever hit a regression a self-test would have caught, we'll add one back surgically. For now, dropping the workflow keeps this PR aligned with the rest of the repo's testing convention and saves the ~30s CI tax per push. Signed-off-by: Dmitrii Creed <creeed22@gmail.com>
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two new composite actions that absorb the always-paired install steps in consumer release pipelines:
setup-sc-toolinginstall-sc+install-welderinstall-sc: false/install-welder: falseskip flags handles the odd case (simple-forge.yml uses only welder).install-attest-toolsgh)simple-container-com/api/.github/actions/install-attest-toolsfor cross-consumer reuse — every consumer publishing signed artifacts needs the same toolchain at the same pinned versions.Step in context
This is Step A+B of the pin-reduction plan we agreed in the api-PR-#263 review:
sc-release.ymlreusable workflow that uses these composites internally and replaces the per-consumer build pipeline inpush.yaml/branch-preview.yaml/build-staging.yml. Step C needs preview-build validation cycles that don't fit a single review pass.Composite design notes
setup-sc-toolinginvokes the install scripts directly (${{ github.action_path }}/../install-sc/install.sh) instead ofuses:-ing the sibling composite. Why: GitHub Actions doesn't support${{ github.action_ref }}inuses:ref positions, so composite-to-composite delegation would require hardcoding a self-referencing SHA — and that SHA changes on every release of this repo (circular). Calling the .sh script directly keeps the composite self-contained at whatever ref the consumer pinned.install-attest-toolsis a clean lift-and-shift from the api repo; identical inputs / outputs / pinned versions.Tests
.github/workflows/self-test-composites.ymlruns on every PR / push to main:setup-sc-tooling(default)sc-version/welder-version/sc-binary/welder-binaryare non-empty and executable.setup-sc-tooling-skip-weldersetup-sc-tooling-skip-scinstall-attest-tools--version.actionlint locally clean.
After this lands
Followup api PR will swap:
install-sc+install-welderrefs → 4setup-sc-toolingrefs./.github/actions/install-attest-toolsrefs → 3 sharedsimple-container-com/actions/install-attest-toolsrefsNet: 27 → 17 consumer references. Below 9 needs Step C.