outcome-receipts/action.yml at main · ghzhost/outcome-receipts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
# SPDX-License-Identifier: Apache-2.0
#
# Reusable composite action: gate CI on receipt drift.
#
# It installs the published `outcome-receipts` CLI and runs `receipts verify`,
# which re-derives every figure in a receipts manifest from the spec and data
# and exits non-zero if any receipt no longer matches. The CLI fails closed
# (see src/outcome_receipts/cli.py::_cmd_verify), so a drifted or tampered
# manifest fails the job with no extra logic here.
#
# Downstream usage lives in docs/ci-action.md.
name: "Outcome Receipts Verify"
description: "Re-derive a receipts manifest from its spec and data, and fail the job on drift."
branding:
  icon: "check-circle"
  color: "green"

inputs:
  config:
    description: "Path to the report spec TOML (mirrors the CLI's --config)."
    required: true
  receipts:
    description: "Path to the receipts.json manifest to verify (mirrors the CLI's --receipts)."
    required: true
  version:
    description: >-
      Package version to install: a git ref (branch, tag, or commit SHA) of
      ChelseaKR/outcome-receipts. Pin to a released tag or a commit SHA for
      reproducible, supply-chain-hardened runs.
    required: false
    default: "v0.2.0"

runs:
  using: composite
  steps:
    # Third-party actions are pinned to a commit SHA with a version comment,
    # matching the supply-chain convention in .github/workflows/ci.yml.
    - uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
    # Install into a dedicated venv rather than the runner's system Python,
    # which is externally managed (PEP 668) on current ubuntu images. The env
    # indirection keeps the ref out of shell-template interpolation.
    - name: Install outcome-receipts
      shell: bash
      env:
        OUTCOME_RECEIPTS_REF: ${{ inputs.version }}
      run: |
        uv venv "${RUNNER_TEMP}/outcome-receipts-venv"
        uv pip install \
          --python "${RUNNER_TEMP}/outcome-receipts-venv/bin/python" \
          "outcome-receipts @ git+https://github.com/ChelseaKR/outcome-receipts@${OUTCOME_RECEIPTS_REF}"
        echo "${RUNNER_TEMP}/outcome-receipts-venv/bin" >> "$GITHUB_PATH"
    - name: Verify receipts
      shell: bash
      env:
        RECEIPTS_CONFIG: ${{ inputs.config }}
        RECEIPTS_MANIFEST: ${{ inputs.receipts }}
      run: |
        receipts verify \
          --config "$RECEIPTS_CONFIG" \
          --receipts "$RECEIPTS_MANIFEST"