builder_go_slsa3.yml

# Copyright The GOSST team.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#    http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: SLSA go builder

permissions:
  contents: read

env:
  # Project.
  GENERATED_BINARY_NAME: go-compiled-binary
  # Builder
  BUILDER_BINARY: go-builder
  BUILDER_RELEASE_BINARY: slsa-builder-go-linux-amd64
  BUILDER_REPOSITORY: slsa-framework/slsa-github-generator
  # Verifier
  VERIFIER_REPOSITORY: slsa-framework/slsa-verifier
  VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64
  VERIFIER_RELEASE_BINARY_SHA256: 14360688de2d294e9cda7b9074ab7dcf02d5c38f2874f6c95d4ad46e300c3e53
  VERIFIER_RELEASE: v1.1.0
  # Builder location
  BUILDER_DIR: internal/builders

###################################################################
#                                                                 #
#            Input and output argument definitions                #
#                                                                 #
###################################################################
on:
  workflow_call:
    inputs:
      go-version:
        description: "The go version to use."
        required: true
        type: string
      upload-assets:
        description: "Whether to upload assets to a GitHub release or not."
        required: false
        type: boolean
        default: true
      config-file:
        description: "The configuration file for the builder. A path within the calling repository."
        required: false
        type: string
        default: ".slsa-goreleaser.yml"
      evaluated-envs:
        description: "Evaluated env variables to pass to the builder."
        required: false
        type: string
      compile-builder:
        description: "Build the builder from source. This increases build time by ~2mn."
        required: false
        type: boolean
        default: false
    outputs:
      go-binary-name:
        description: "The name of the generated binary uploaded to the artifact registry."
        value: ${{ jobs.build-dry.outputs.go-binary-name }}

jobs:
  detect-env:
    outputs:
      repository: ${{ steps.detect.outputs.repository }}
      ref: ${{ steps.detect.outputs.ref }}
    runs-on: ubuntu-latest
    permissions:
      id-token: write # Needed to detect the current reusable repository and ref.
    steps:
      - name: Detect the builder ref
        id: detect
        uses: slsa-framework/slsa-github-generator/.github/actions/detect-workflow@d995948e8d53cc639c0d3ef69db31dbc243519c4

  ###################################################################
  #                                                                 #
  #                       Build the builder                         #
  #                                                                 #
  ###################################################################
  builder:
    outputs:
      go-builder-sha256: ${{ steps.builder-gen.outputs.go-builder-sha256 }}
      go-prov-sha256: ${{ steps.builder-gen.outputs.go-prov-sha256 }}
    runs-on: ubuntu-latest
    needs: [detect-env]
    steps:
      - name: Checkout the repository
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2.3.4
        with:
          fetch-depth: 1
          persist-credentials: false
          repository: "${{ needs.detect-env.outputs.repository }}"
          ref: "${{ needs.detect-env.outputs.ref }}"

      - name: Set up golang environment
        uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v3.2.0
        with:
          go-version: 1.18

      - name: Build builder
        shell: bash
        id: builder-gen
        env:
          COMPILE_BUILDER: "${{ inputs.compile-builder }}"
          BUILDER_REF: "${{ needs.detect-env.outputs.ref }}"
          # Needed for the gh CLI used in builder-fetch.sh.
          GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
        run: |
          set -euo pipefail

          if [[ "$COMPILE_BUILDER" = true ]]; then
            echo "Building the builder"

            cd "$BUILDER_DIR"/go/

            #TODO(reproducible)
            go mod vendor

            # https://go.dev/ref/mod#build-commands.
            go build -mod=vendor -o "$BUILDER_BINARY"

            cd -

            mv "${BUILDER_DIR}/go/${BUILDER_BINARY}" .
          else
            echo "Fetching the builder with ref: $BUILDER_REF"

            .github/workflows/scripts/builder-fetch.sh

            mv "$BUILDER_RELEASE_BINARY" "$BUILDER_BINARY"
          fi

          BUILDER_DIGEST=$(sha256sum "$BUILDER_BINARY" | awk '{print $1}')
          echo "::set-output name=go-builder-sha256::$BUILDER_DIGEST"
          echo "hash of $BUILDER_BINARY is $BUILDER_DIGEST"

      - name: Upload the builder
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
        with:
          name: "${{ env.BUILDER_BINARY }}"
          path: "${{ env.BUILDER_BINARY }}"
          if-no-files-found: error
          retention-days: 5

  ###################################################################
  #                                                                 #
  #                 Build dry to resolve variables                  #
  #                                                                 #
  ###################################################################
  build-dry:
    outputs:
      go-binary-name: ${{ steps.build-dry.outputs.go-binary-name }}
      go-command: ${{ steps.build-dry.outputs.go-command }}
      go-env: ${{ steps.build-dry.outputs.go-env }}
      go-working-dir: ${{ steps.build-dry.outputs.go-working-dir }}
    runs-on: ubuntu-latest
    needs: builder
    steps:
      - name: Checkout the repository
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2.3.4
        with:
          fetch-depth: 1
          persist-credentials: false

      # Code needed (not tested) if go-vesion is made optional.
      # See https://stackoverflow.com/questions/67368005/check-whether-environment-variable-is-empty.
      - name: Set up golang environment
        uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v3.2.0
        with:
          go-version: ${{ inputs.go-version }}

      - name: Download builder
        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
        with:
          name: "${{ env.BUILDER_BINARY }}"

      - name: Verify builder
        env:
          BUILDER_HASH: "${{ needs.builder.outputs.go-builder-sha256 }}"
        run: |
          set -euo pipefail

          echo "hash of builder should be $BUILDER_HASH"
          COMPUTED_HASH=$(sha256sum "$BUILDER_BINARY" | awk '{print $1}')
          echo "builder hash computed is $COMPUTED_HASH"

          # Compare hashes. Explicit exit to be safe.
          # TODO: remove the builder as well.
          echo "$BUILDER_HASH $BUILDER_BINARY" | sha256sum --strict --check --status || exit -2

          # Make the builder executable.
          chmod a+x "$BUILDER_BINARY"

      - name: Build dry project
        id: build-dry
        shell: bash
        env:
          CONFIG_FILE: "${{ inputs.config-file }}"
          UNTRUSTED_ENVS: "${{ inputs.evaluated-envs }}"
        run: |
          set -euo pipefail

          # Note: this outputs information about resolved arguments, etc.
          # the values are trusted because the compiler is not invoked.
          echo ./"$BUILDER_BINARY" build --dry "$CONFIG_FILE" "$UNTRUSTED_ENVS"
          ./"$BUILDER_BINARY" build --dry "$CONFIG_FILE" "$UNTRUSTED_ENVS"

  ###################################################################
  #                                                                 #
  #                       Build the project                         #
  #                                                                 #
  ###################################################################
  build:
    outputs:
      go-binary-sha256: ${{ steps.build-sha256.outputs.go-binary-sha256 }}
    runs-on: ubuntu-latest
    needs: [builder, build-dry]
    steps:
      - name: Checkout the repository
        uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v2.3.4
        with:
          fetch-depth: 1
          persist-credentials: false

      # Code needed (not tested) if go-vesion is made optional.
      # See https://stackoverflow.com/questions/67368005/check-whether-environment-variable-is-empty.
      - name: Set up golang environment
        uses: actions/setup-go@b22fbbc2921299758641fab08929b4ac52b32923 # v3.2.0
        with:
          go-version: ${{ inputs.go-version }}

      - name: Download builder
        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
        with:
          name: "${{ env.BUILDER_BINARY }}"

      - name: Verify builder
        env:
          BUILDER_HASH: "${{ needs.builder.outputs.go-builder-sha256 }}"
        run: |
          set -euo pipefail

          echo "hash of builder should be $BUILDER_HASH"
          COMPUTED_HASH=$(sha256sum "$BUILDER_BINARY" | awk '{print $1}')
          echo "builder hash computed is $COMPUTED_HASH"

          # Compare hashes. Explicit exit to be safe.
          # TODO: remove the builder as well.
          echo "$BUILDER_HASH $BUILDER_BINARY" | sha256sum --strict --check --status || exit -2

          # Make the builder executable.
          chmod a+x "$BUILDER_BINARY"

      - name: Download dependencies
        env:
          UNTRUSTED_WORKING_DIR: "${{ needs.build-dry.outputs.go-working-dir }}"
        shell: bash
        run: |
          set -euo pipefail

          # Note: maybe simpler to make this step part of the builder in the future.
          cd "$UNTRUSTED_WORKING_DIR"
          go mod vendor

      # TODO(hermeticity) OS-level.
      # - name: Disable hermeticity
      # uses: slsa/hermeticity@xxx
      #   with:
      #     to-state: enabled

      - name: Build project
        id: build-gen
        shell: bash
        env:
          CONFIG_FILE: "${{ inputs.config-file }}"
          UNTRUSTED_ENVS: "${{ inputs.evaluated-envs }}"
        run: |
          set -euo pipefail

          # Disable set-output command.
          echo "::stop-commands::`echo -n ${{ github.token }} | sha256sum | head -c 64`"

          echo "./$BUILDER_BINARY" build "$PWD/$CONFIG_FILE" "$UNTRUSTED_ENVS"
          # Note: We need to provide the asbolute path to the output binary.
          export OUTPUT_BINARY="$PWD/${{ env.GENERATED_BINARY_NAME }}"
          ./"$BUILDER_BINARY" build "$CONFIG_FILE" "$UNTRUSTED_ENVS"

      - name: Compute binary hash
        id: build-sha256
        shell: bash
        run: |
          set -euo pipefail

          # Re-enable set-output command.
          echo "::`echo -n ${{ github.token }} | sha256sum | head -c 64`::"

          DIGEST=$(sha256sum "${{ env.GENERATED_BINARY_NAME }}" | awk '{print $1}')
          echo "digest of ${{ env.GENERATED_BINARY_NAME }} is $DIGEST"

          echo "::set-output name=go-binary-sha256::$DIGEST"

      - name: Upload the artifact
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
        with:
          name: "${{ env.GENERATED_BINARY_NAME }}"
          path: "${{ env.GENERATED_BINARY_NAME }}"
          if-no-files-found: error
          retention-days: 5

  ###################################################################
  #                                                                 #
  #                 Upload the resulting binary                     #
  #                                                                 #
  ###################################################################
  binary-upload:
    runs-on: ubuntu-latest
    needs: [build, build-dry]
    steps:
      - name: Download generated binary
        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
        with:
          name: "${{ env.GENERATED_BINARY_NAME }}"

      - name: Verify binary hash
        env:
          UNTRUSTED_BINARY_HASH: "${{ needs.build.outputs.go-binary-sha256 }}"
          UNTRUSTED_BINARY_NAME: "${{ needs.build-dry.outputs.go-binary-name }}"
        run: |
          set -euo pipefail

          echo "hash of binary ${{ env.GENERATED_BINARY_NAME }} should be $UNTRUSTED_BINARY_HASH"

          COMPUTED_HASH=$(sha256sum "${{ env.GENERATED_BINARY_NAME }}" | awk '{print $1}')
          echo "binary hash computed is $COMPUTED_HASH"

          # Compare hashes. Explicit exit to be safe.
          echo "$UNTRUSTED_BINARY_HASH ${{ env.GENERATED_BINARY_NAME }}" | sha256sum --strict --check --status || exit -2

          mv "${{ env.GENERATED_BINARY_NAME }}" "$UNTRUSTED_BINARY_NAME"

      - name: Upload the generated binary
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
        with:
          name: "${{ needs.build-dry.outputs.go-binary-name }}"
          path: "${{ needs.build-dry.outputs.go-binary-name }}"
          if-no-files-found: error
          retention-days: 5

  ###################################################################
  #                                                                 #
  #                 Generate the SLSA provenance                    #
  #                                                                 #
  ###################################################################
  provenance:
    runs-on: ubuntu-latest
    needs: [builder, build, build-dry]
    permissions:
      id-token: write # Needed for keyless.
      contents: read
    outputs:
      go-provenance-name: ${{ steps.sign-prov.outputs.signed-provenance-name }}
      go-provenance-sha256: ${{ steps.sign-prov.outputs.signed-provenance-sha256 }}
    steps:
      - name: Download builder
        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2.1.0
        with:
          name: "${{ env.BUILDER_BINARY }}"

      - name: Verify builder
        env:
          BUILDER_HASH: "${{ needs.builder.outputs.go-builder-sha256 }}"
        run: |
          set -euo pipefail

          echo "hash of builder should be $BUILDER_HASH"
          COMPUTED_HASH=$(sha256sum "$BUILDER_BINARY" | awk '{print $1}')
          echo "builder hash computed is $COMPUTED_HASH"

          # Compare hashes. Explicit exit to be safe.
          # TODO: remove the builder as well.
          echo "$BUILDER_HASH $BUILDER_BINARY" | sha256sum --strict --check --status || exit -2

          # Make the builder executable.
          chmod a+x "$BUILDER_BINARY"

      - name: Create and sign provenance
        id: sign-prov
        shell: bash
        env:
          UNTRUSTED_BINARY_NAME: "${{ needs.build-dry.outputs.go-binary-name }}"
          UNTRUSTED_BINARY_HASH: "${{ needs.build.outputs.go-binary-sha256 }}"
          UNTRUSTED_COMMAND: "${{ needs.build-dry.outputs.go-command }}"
          UNTRUSTED_ENV: "${{ needs.build-dry.outputs.go-env }}"
          UNTRUSTED_WORKING_DIR: "${{ needs.build-dry.outputs.go-working-dir }}"
          GITHUB_CONTEXT: "${{ toJSON(github) }}"
        run: |
          set -euo pipefail

          echo "provenance generator is $BUILDER_BINARY"

          # Create and sign provenance
          # This sets signed-provenance-name to the name of the signed DSSE envelope.
          ./"$BUILDER_BINARY" provenance \
            --binary-name "$UNTRUSTED_BINARY_NAME" \
            --digest "$UNTRUSTED_BINARY_HASH" \
            --command "$UNTRUSTED_COMMAND" \
            --env "$UNTRUSTED_ENV" \
            --workingDir "$UNTRUSTED_WORKING_DIR"

      - name: Upload the signed provenance
        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
        with:
          name: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
          path: "${{ steps.sign-prov.outputs.signed-provenance-name }}"
          if-no-files-found: error
          retention-days: 5

  ###################################################################
  #                                                                 #
  #           Upload binaries and provenances as assets             #
  #                                                                 #
  ###################################################################
  upload-assets:
    permissions:
      contents: write
    runs-on: ubuntu-latest
    needs: [build, build-dry, binary-upload, provenance]
    if: startsWith(github.ref, 'refs/tags/') && inputs.upload-assets == true
    steps:
      # Verify binary hash.
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: ${{ needs.build-dry.outputs.go-binary-name }}
      - name: Verify binary hash
        env:
          UNTRUSTED_BINARY_HASH: "${{ needs.build.outputs.go-binary-sha256 }}"
          UNTRUSTED_BINARY_NAME: "${{ needs.build-dry.outputs.go-binary-name }}"
        run: |
          set -euo pipefail

          echo "hash of binary $UNTRUSTED_BINARY_NAME should be $UNTRUSTED_BINARY_HASH"

          COMPUTED_HASH=$(sha256sum "$UNTRUSTED_BINARY_NAME" | awk '{print $1}')
          echo "binary hash computed is $COMPUTED_HASH"

          # Compare hashes. Explicit exit to be safe.
          echo "$UNTRUSTED_BINARY_HASH $UNTRUSTED_BINARY_NAME" | sha256sum --strict --check --status || exit -2

      # Verify provenance hash.
      - uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741
        with:
          name: ${{ needs.provenance.outputs.go-provenance-name }}
      - name: Verify provenance hash
        env:
          UNTRUSTED_PROVENANCE_HASH: "${{ needs.provenance.outputs.go-provenance-sha256 }}"
          UNTRUSTED_PROVENANCE_NAME: "${{ needs.provenance.outputs.go-provenance-name }}"
        run: |
          set -euo pipefail

          echo "hash of provenance $UNTRUSTED_PROVENANCE_NAME should be $UNTRUSTED_PROVENANCE_HASH"

          COMPUTED_HASH=$(sha256sum "$UNTRUSTED_PROVENANCE_NAME" | awk '{print $1}')
          echo "provenance hash computed is $COMPUTED_HASH"

          # Compare hashes. Explicit exit to be safe.
          echo "$UNTRUSTED_PROVENANCE_HASH $UNTRUSTED_PROVENANCE_NAME" | sha256sum --strict --check --status || exit -2

      - name: Release
        uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5 # v0.1.14
        with:
          files: |
            ${{ needs.build-dry.outputs.go-binary-name }}
            ${{ needs.provenance.outputs.go-provenance-name }}