slsa-go-releaser.yml

# This workflow compiles your mediator server and medic using a SLSA3 compliant
# build and then verifies the provenance of the built artifacts.
# It releases the following architectures: amd64, arm64, and armv7 on Linux, 
# Windows, and macOS.
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.

name: SLSA Go releaser
on:
  workflow_dispatch:
  release:
    types: [created]

permissions: read-all

jobs:
  # Generate ldflags dynamically.
  # Optional: only needed for ldflags.
  args:
    runs-on: ubuntu-latest
    outputs:
      commit-date: ${{ steps.ldflags.outputs.commit-date }}
      commit: ${{ steps.ldflags.outputs.commit }}
      version: ${{ steps.ldflags.outputs.version }}
      tree-state: ${{ steps.ldflags.outputs.tree-state }}
    steps:
      - id: checkout
        uses: actions/checkout@v4 # tag=v2.3.4
        with:
          fetch-depth: 0
      - id: ldflags
        run: |
          echo "commit-date=$(git log --date=iso8601-strict -1 --pretty=%ct)" >> "$GITHUB_OUTPUT"
          echo "commit=$GITHUB_SHA" >> "$GITHUB_OUTPUT"
          echo "version=$(git describe --tags --always --dirty | cut -c2-)" >> "$GITHUB_OUTPUT"
          echo "tree-state=$(if git diff --quiet; then echo "clean"; else echo "dirty"; fi)" >> "$GITHUB_OUTPUT"

  # Trusted builder.
  build:
    permissions:
      id-token: write # To sign the provenance.
      contents: write # To upload assets to release.
      actions: read # To read the workflow path.
    needs: args
    strategy:
      matrix:
        os:
          - linux
          - windows
          - darwin
        arch:
          - amd64
          - arm64
    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.9.0

    with:
      go-version: '1.20'
      private-repository: true
      # Optional: only needed if using ldflags.
      evaluated-envs: "COMMIT_DATE:${{needs.args.outputs.commit-date}}, COMMIT:${{needs.args.outputs.commit}}, VERSION:${{needs.args.outputs.version}}, TREE_STATE:${{needs.args.outputs.tree-state}}"
      config-file: .slsa-goreleaser/${{matrix.os}}-${{matrix.arch}}.yml

  verification:
    needs:
      - build
    runs-on: ubuntu-latest
    permissions: read-all
    steps:
      - name: Install the verifier
        uses: slsa-framework/slsa-verifier/actions/installer@v2.4.0

      - name: Download assets
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          ATT_FILE_NAME: "${{ needs.build.outputs.go-binary-name }}.intoto.jsonl"
          ARTIFACT: ${{ needs.build.outputs.go-binary-name }}
        run: |
          set -euo pipefail

          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p $ARTIFACT
          gh -R "$GITHUB_REPOSITORY" release download "$GITHUB_REF_NAME" -p "$ATT_FILE_NAME"

      - name: Verify assets
        env:
          ARTIFACT: ${{ needs.build.outputs.go-binary-name }}
          ATT_FILE_NAME: "${{ needs.build.outputs.go-binary-name }}.intoto.jsonl"
        run: |
          set -euo pipefail
              
          echo "Verifying $ARTIFACT using $ATT_FILE_NAME"
          slsa-verifier verify-artifact --provenance-path "$ATT_FILE_NAME" \
                                        --source-uri "github.com/$GITHUB_REPOSITORY" \
                                        --source-tag "$GITHUB_REF_NAME" \
                                        "$ARTIFACT"