Update to new witness and witness action versions

Signed-off-by: John Kjell <john@testifysec.com>
testifysec · Jun 18, 2024 · c75a6d4 · c75a6d4
1 parent c8620d3
commit c75a6d4
Show file tree

Hide file tree

Showing 4 changed files with 52 additions and 140 deletions.
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
@@ -14,15 +14,15 @@ on:
 
 jobs:
   fmt:
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: fmt
       attestations: "git github environment"
       command: go fmt ./...
 
   vet:
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: vet
@@ -31,10 +31,11 @@ jobs:
 
   # --ignore DL3002    
   lint:
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: lint
+      pre-command-attestations: "git github environment"
       attestations: "git github environment"
       pre-command: |
         curl -sSfL https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 -o /usr/local/bin/hadolint && \
@@ -45,7 +46,7 @@ jobs:
 
   unit-test:
     needs: [ fmt, vet, lint ]
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: unit-test
@@ -56,10 +57,11 @@ jobs:
 
   sast:
     needs: [ fmt, vet, lint ]
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: sast
+      pre-command-attestations: "git github environment"
       attestations: "git github environment"
       pre-command: python3 -m pip install semgrep==1.45.0
       command: semgrep scan --config auto ./ --sarif -o semgrep.sarif
@@ -68,7 +70,7 @@ jobs:
 
   build:
     needs: [ unit-test, sast ]
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: build 
@@ -109,8 +111,9 @@ jobs:
         use: true
 
     - name: Build Image
-      uses: testifysec/witness-run-action@9bb3541332161bc8bf76c36bcdaab56b8da8e171 # v0.2.0-beta
+      uses: testifysec/witness-run-action@85ddab8b46a86b2905a3b547a1806ab264fbb810 # v0.2.0
       with:
+        version: 0.6.0
         step: build-image
         attestations: "git github environment slsa"
         command: |
@@ -120,10 +123,10 @@ jobs:
 
   save-image:
     needs: build-image
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
-      step: save-image 
+      step: save-image
       attestations: "git github environment slsa oci"
       command: |
         docker pull ${{ needs.build-image.outputs.tags }} && docker save ${{ needs.build-image.outputs.tags }} -o image.tar
@@ -132,40 +135,27 @@ jobs:
 
   generate-sbom:
     needs: save-image
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: generate-sbom 
-      attestations: "git github environment"
+      pre-command-attestations: "git github environment"
+      attestations: "git github environment sbom"
       artifact-download: image.tar
       pre-command: |
         curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
       command: |
-        syft packages docker-archive:/tmp/image.tar -o spdx-json --file syft.spdx.json
-      artifact-upload-name: syft.spdx.json
-      artifact-upload-path: syft.spdx.json
-
-  cve-scan:
-    needs: save-image
-    uses: ./.github/workflows/witness.yml
-    with:
-      pull_request: ${{ github.event_name == 'pull_request' }}
-      step: cve-scan 
-      attestations: "git github environment"
-      artifact-download: image.tar
-      pre-command: |
-        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
-      command: |
-        grype docker-archive:/tmp/image.tar -o sarif --file grype.sarif
-      artifact-upload-name: grype.sarif
-      artifact-upload-path: grype.sarif
+        syft packages docker-archive:/tmp/image.tar --source-name=pkg:oci/testifysec/swf -o cyclonedx-json --file sbom.cdx.json
+      artifact-upload-name: sbom.cdx.json
+      artifact-upload-path: sbom.cdx.json
 
   secret-scan:
     needs: save-image
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: secret-scan
+      pre-command-attestations: "git github environment"
       attestations: "git github environment"
       artifact-download: image.tar
       pre-command: |
@@ -176,17 +166,18 @@ jobs:
       artifact-upload-path: trufflehog.json
 
   verify:
-    needs: [ generate-sbom, cve-scan, secret-scan]
+    needs: [ generate-sbom, secret-scan]
 
     if: ${{ github.event_name == 'push' }}
-    uses: ./.github/workflows/witness.yml
+    uses: testifysec/witness-run-action/.github/workflows/witness.yml@c5314efabe9739b4f29996bdcd26aa0cc81e336a
     with:
       pull_request: ${{ github.event_name == 'pull_request' }}
       step: verify 
+      pre-command-attestations: "git github environment"
       attestations: "git github environment"
       artifact-download: image.tar
       pre-command: |
-        curl -sSfL https://github.com/in-toto/witness/releases/download/v0.4.0-beta/witness_0.4.0-beta_linux_amd64.tar.gz -o witness.tar.gz && \
+        curl -sSfL https://github.com/in-toto/witness/releases/download/v0.6.0/witness_0.6.0_linux_amd64.tar.gz -o witness.tar.gz && \
         tar -xzvf witness.tar.gz -C /usr/local/bin/ && rm ./witness.tar.gz
       command: |
         witness verify -p policy-signed.json -k swfpublic.pem -f /tmp/image.tar --enable-archivista -l debug
diff --git a/.github/workflows/witness.yml b/.github/workflows/witness.yml
diff --git a/policy.json b/policy.json
@@ -42,10 +42,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -142,10 +142,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -193,10 +193,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -244,10 +244,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -298,10 +298,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -352,10 +352,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -403,10 +403,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -454,10 +454,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }
@@ -505,10 +505,10 @@
               ],
               "extensions": {
                 "issuer": "https://token.actions.githubusercontent.com",
-                "github_workflow_sha": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "github_workflow_sha": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "source_repository_uri": "https://github.com/testifysec/swf",
-                "build_signer_uri": "https://github.com/testifysec/swf/.github/workflows/witness.yml@refs/heads/slsa",
-                "build_signer_digest": "39f80b4c173e7b023a19d2aeac2686733c67b38e",
+                "build_signer_uri": "https://github.com/testifysec/witness-run-action/.github/workflows/witness.yml@refs/heads/reusable-workflow",
+                "build_signer_digest": "c5314efabe9739b4f29996bdcd26aa0cc81e336a",
                 "runner_environment": "github-hosted"
               }
             }

diff --git a/policy.signed.json b/policy.signed.json