e2e.yaml

name: E2E

on:
  push:
  pull_request_target:
    branches: ['main']
  workflow_dispatch:

jobs:
  e2e:
    runs-on: ubuntu-latest
    permissions:
      id-token: write  # Enable OIDC

      # The rest of these are sanity-check settings, since I'm not sure if the
      # org default is permissive or restricted.
      # See https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
      # for more details.
      actions: none
      checks: none
      contents: read
      deployments: none
      issues: none
      packages: none
      pages: none
      pull-requests: none
      repository-projects: none
      security-events: none
      statuses: none

    env:
      # Output logs to file in case we need to inspect errors.
      GITSIGN_LOG: "/tmp/gitsign.log"

    steps:
      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
        with:
          # Use the merge commit if type is pull_request/pull_request_target,
          # else use the default ref.
          # By default pull_request_target will use the base branch as the
          # target since it was originally intended for trusted workloads.
          # However, we need to use this to have access to the OIDC creds
          # for the e2e tests, so insert our own logic here.
          # This is effectively a ternary of the form ${{ <condition> && <true> || <false> }}.
          # See https://docs.github.com/en/actions/learn-github-actions/expressions for more details.
          ref: ${{ startsWith(github.event_name, 'pull_request') && format('refs/pull/{0}/merge', github.event.number) || github.ref }}

      - name: Set up Go
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: '1.21'
          check-latest: true

      - name: Install Gitsign
        run: |
          set -e

          # Setup repo + tool
          make install-gitsign
          export PATH="$PATH:$GOPATH/bin"
          echo "PATH=${PATH}"
          whereis gitsign
          mkdir /tmp/git
          cd /tmp/git
          git init -b main .
          git config --global user.email "test@example.com"
          git config --global user.name "gitsign"
          git config --global gpg.x509.program gitsign
          git config --global gpg.format x509
          git config --global commit.gpgsign true

          # Verify tool is on our path
          gitsign -h
      - name: Test Sign and Verify commit
        run: |
          set -e

          # Sign commit
          git commit --allow-empty -S --message="Signed commit"

          # Verify commit
          echo "========== git verify-commit =========="
          git verify-commit HEAD

          echo "========== gitsign verify =========="
          gitsign verify \
            --certificate-github-workflow-repository=${{ github.repository }} \
            --certificate-github-workflow-sha=${{ github.sha }} \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            --certificate-identity="https://github.com/${{ github.workflow_ref }}"

          # Extra debug info
          git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text
      - name: Test Sign and Verify commit - offline verification
        env:
          GITSIGN_REKOR_MODE: "offline"
        run: |
          set -e

          # Sign commit
          git commit --allow-empty -S --message="Signed commit"

          # Verify commit
          echo "========== git verify-commit =========="
          git verify-commit HEAD

          echo "========== gitsign verify =========="
          gitsign verify \
            --certificate-github-workflow-repository=${{ github.repository }} \
            --certificate-github-workflow-sha=${{ github.sha }} \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            --certificate-identity="https://github.com/${{ github.workflow_ref }}"

          # Extra debug info
          git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text
      - name: Test Sign and Verify commit - staging
        env:
          GITSIGN_OIDC_ISSUER: "https://oauth2.sigstage.dev/auth"
          GITSIGN_FULCIO_URL: "https://fulcio.sigstage.dev"
          GITSIGN_REKOR_URL: "https://rekor.sigstage.dev"
        run: |
          set -e

          # Setup staging TUF root - https://github.com/sigstore/public-good-instance/blob/1023ed05b7a8cf28e6a7de73bf98dd5075d97858/playbooks/tuf.md#updating-tuf-metadata-for-staging
          rm -rf ~/.sigstore
          wget https://tuf-repo-cdn.sigstage.dev/root.json
          gitsign initialize --mirror=https://tuf-repo-cdn.sigstage.dev --root=root.json

          # Sign commit
          git commit --allow-empty -S --message="Signed commit"

          # Verify commit
          echo "========== git verify-commit =========="
          git verify-commit HEAD

          echo "========== gitsign verify =========="
          gitsign verify \
            --certificate-github-workflow-repository=${{ github.repository }} \
            --certificate-github-workflow-sha=${{ github.sha }} \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            --certificate-identity="https://github.com/${{ github.workflow_ref }}"

          # Extra debug info
          git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text

      - name: Debug log
        if: failure()
        run: cat "${GITSIGN_LOG}"