From c176169a6d0f11297a82f2cbb22e03c15c739934 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 13 Oct 2022 11:08:47 +0200 Subject: [PATCH 1/2] chore(deps): update mikepenz/action-junit-report action to v3.5.1 (#100) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- .github/workflows/graalvm.yml | 2 +- .github/workflows/gradle.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/graalvm.yml b/.github/workflows/graalvm.yml index 22b17459..8f3f1c04 100644 --- a/.github/workflows/graalvm.yml +++ b/.github/workflows/graalvm.yml @@ -58,7 +58,7 @@ jobs: PREDICTIVE_TEST_SELECTION: "${{ github.event_name == 'pull_request' && 'true' || 'false' }}" - name: Publish Test Report if: always() - uses: mikepenz/action-junit-report@v3.5.0 + uses: mikepenz/action-junit-report@v3.5.1 with: check_name: GraalVM CE CI / Test Report (Java ${{ matrix.java }}) report_paths: '**/build/test-results/test/TEST-*.xml' diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 9ba193f0..51d91606 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -60,7 +60,7 @@ jobs: PREDICTIVE_TEST_SELECTION: "${{ github.event_name == 'pull_request' && 'true' || 'false' }}" - name: Publish Test Report if: always() - uses: mikepenz/action-junit-report@v3.5.0 + uses: mikepenz/action-junit-report@v3.5.1 with: check_name: Java CI / Test Report (${{ matrix.java }}) report_paths: '**/build/test-results/test/TEST-*.xml' From 39082ce62949a860a480126ef503e9e776326106 Mon Sep 17 00:00:00 2001 From: micronaut-build <65172877+micronaut-build@users.noreply.github.com> Date: Thu, 13 Oct 2022 05:09:26 -0400 Subject: [PATCH 2/2] ci: SLSA provenance (#99) --- .github/workflows/gradle.yml | 2 +- .github/workflows/release.yml | 62 ++++++++++++++++++++++++++++++++++- 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index 51d91606..5bb74c44 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -67,7 +67,7 @@ jobs: check_retries: 'true' - name: "📜 Upload binary compatibility check results" if: always() - uses: actions/upload-artifact@v2 + uses: actions/upload-artifact@v3 with: name: binary-compatibility-reports path: "**/build/reports/binary-compatibility-*.html" diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13dcbbca..d2e48848 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -9,6 +9,8 @@ on: types: [published] jobs: release: + outputs: + hashes: ${{ steps.hash.outputs.hashes }} # Computed hashes for build artifacts. runs-on: ubuntu-latest steps: - name: Checkout repository @@ -31,6 +33,7 @@ jobs: with: token: ${{ secrets.GITHUB_TOKEN }} - name: Publish to Sonatype OSSRH + id: publish env: SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }} SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }} @@ -42,7 +45,30 @@ jobs: GRADLE_ENTERPRISE_CACHE_PASSWORD: ${{ secrets.GRADLE_ENTERPRISE_CACHE_PASSWORD }} run: | echo $GPG_FILE | base64 -d > secring.gpg - ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository + # Publish both locally and to Sonatype. + # The artifacts stored locally will be used to generate the SLSA provenance. + ./gradlew publishAllPublicationsToBuildRepository publishToSonatype closeAndReleaseSonatypeStagingRepository + # Read the current version from gradle.properties. + VERSION=$(./gradlew properties | grep 'version:' | awk '{print $2}') + # Read the project group from gradle.properties. + GROUP_PATH=$(./gradlew properties| grep "projectGroup" | awk '{print $2}' | sed 's/\./\//g') + echo "::set-output name=version::$VERSION" + echo "::set-output name=group::$GROUP_PATH" + - name: Generate subject + id: hash + run: | + # Find the relevant published artifacts in the local repository. + ARTIFACTS=$(find build/repo/${{ steps.publish.outputs.group }}/*/${{ steps.publish.outputs.version }}/* \ + -regextype sed -regex '\(.*\.jar\|.*\.pom\|.*\.module\|.*\.toml\)') + # Compute the hashes for the artifacts. + echo "::set-output name=hashes::$(sha256sum $ARTIFACTS | base64 -w0)" + - name: Upload build artifacts + uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0 + with: + name: gradle-build-outputs + path: build/repo/${{ steps.publish.outputs.group }}/*/${{ steps.publish.outputs.version }}/* + if-no-files-found: error + retention-days: 5 - name: Generate docs env: GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }} @@ -86,3 +112,37 @@ jobs: MICRONAUT_BUILD_EMAIL: ${{ secrets.MICRONAUT_BUILD_EMAIL }} with: token: ${{ secrets.GITHUB_TOKEN }} + + provenance: + needs: [release] + permissions: + actions: read # To read the workflow path. + id-token: write # To sign the provenance. + contents: write # To add assets to a release. + uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.2.0 + with: + base64-subjects: "${{ needs.release.outputs.hashes }}" + upload-assets: true # Upload to a new release. + compile-generator: true # Build the generator from source. + + github_release: + needs: [release, provenance] + runs-on: ubuntu-latest + if: startsWith(github.ref, 'refs/tags/') + steps: + - name: Checkout repository + uses: actions/checkout@2541b1294d2704b0964813337f33b291d3f8596b # v3.0.2 + - name: Download artifacts + uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v3.0.0 + with: + name: gradle-build-outputs + path: build/repo + - name: Upload assets + # Upload the artifacts and SLSA L3 provenance as assets to the existing + # release. Note that the provenance will attest to each artifact file and + # not the aggregated ZIP file. + run: | + find build/repo -regextype sed -regex '\(.*\.jar\|.*\.pom\|.*\.module\|.*\.toml\)' | xargs zip artifacts.zip + gh release upload ${{ github.ref_name }} artifacts.zip + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}