plumbline/.github/workflows/release.yml at main · ghzhost/plumbline · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
# Release: SBOM verification and a keyless-signed release artifact.
#
# Closes two "Not met" cells the README's Standards Conformance table names
# against itself: "no SBOM, ..., no signed release" (Security & Supply-Chain)
# and "no release workflow, no signed tag, no published artifact" (Release &
# Versioning). This repository already has the best possible starting
# position for it — zero third-party runtime dependencies — so this is
# wiring, not redesign.
#
# OpenSSF Scorecard used to be a job in this file and is not anymore: pushing
# the first real v0.2.0 tag exercised it for the first time and it failed —
# `ossf/scorecard-action` refuses to analyze anything but the repository's
# default branch, and a `push: tags:` trigger is never that. See
# `scorecard.yml`, which triggers the way the action's own upstream template
# does (push to `main`, plus a weekly schedule) — never on a tag.
#
# The sbom/sign/release chain below **has now been exercised**: v0.2.0 is
# the first tag it ran against, on GitHub's own infrastructure, producing a
# real signed SBOM and a real published Release — see the Standards
# Conformance table for what that does and does not close. It first failed
# on that same tag with a different, mechanical defect: `actions/upload-
# artifact`'s pin was a 39-character string, one hex digit short of a real
# SHA-1, so it could not resolve. Fixed and re-verified against the GitHub
# API before the tag was moved and re-pushed. Every remaining action pin
# below was cross-checked the same way.
#
# Keyless signing (Sigstore/cosign, via GitHub's own OIDC token) rather than
# a stored private key: consistent with never committing a secret to this
# repository, and it is what `id-token: write` on the `sign` job is for.

name: release

on:
  push:
    tags: ["v*"]
  workflow_dispatch: # exercise the pipeline without waiting for a real tag

permissions:
  contents: read

jobs:
  sbom:
    name: verify and publish the SBOM
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"

      # Fails if the committed SBOM is not what pyproject.toml produces —
      # the same "committed artifact must be current" discipline as the
      # published evidence page. A release built from a stale SBOM would be
      # a supply-chain claim this repository could not back.
      - name: sbom.cdx.json must be what pyproject.toml produces
        run: python3 tools/build_sbom.py --check

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sbom
          path: sbom.cdx.json
          if-no-files-found: error

  sign:
    name: keyless-sign the SBOM
    needs: sbom
    runs-on: ubuntu-latest
    permissions:
      contents: read
      # Sigstore's keyless flow: GitHub mints a short-lived OIDC token this
      # job exchanges for a Fulcio certificate. No private key is generated,
      # stored, or rotated by this repository.
      id-token: write
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom

      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2

      - name: Sign the SBOM (keyless)
        run: cosign sign-blob --yes --bundle sbom.cdx.json.sigstore.json sbom.cdx.json

      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
        with:
          name: sbom-signature
          path: |
            sbom.cdx.json
            sbom.cdx.json.sigstore.json
          if-no-files-found: error

  release:
    name: publish the GitHub Release
    needs: sign
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    permissions:
      contents: write # to create the release and attach files
    steps:
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: sbom-signature

      # The built-in `gh` CLI, not a third-party action: one fewer pin to
      # maintain for something the runner already ships, and this project
      # avoids adding a dependency where an existing tool already does the
      # job — the same instinct that keeps the runtime standard-library-only.
      - name: Create the release and attach the signed SBOM
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          gh release create "${GITHUB_REF_NAME}" \
            --repo "${GITHUB_REPOSITORY}" \
            --title "${GITHUB_REF_NAME}" \
            --generate-notes \
            sbom.cdx.json sbom.cdx.json.sigstore.json