|
| 1 | +# Copyright (c) 2025, NVIDIA CORPORATION. All rights reserved. |
| 2 | +# |
| 3 | +# Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +# you may not use this file except in compliance with the License. |
| 5 | +# You may obtain a copy of the License at |
| 6 | +# |
| 7 | +# http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +# |
| 9 | +# Unless required by applicable law or agreed to in writing, software |
| 10 | +# distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +# See the License for the specific language governing permissions and |
| 13 | +# limitations under the License. |
| 14 | + |
| 15 | +name: 'CLI E2E Tests' |
| 16 | +description: 'Build attested aicr binary and run CLI chainsaw tests' |
| 17 | + |
| 18 | +inputs: |
| 19 | + go_version: |
| 20 | + description: 'Go version (e.g., 1.25)' |
| 21 | + required: true |
| 22 | + chainsaw_version: |
| 23 | + description: 'Chainsaw version (e.g., v0.2.14)' |
| 24 | + required: true |
| 25 | + |
| 26 | +runs: |
| 27 | + using: 'composite' |
| 28 | + steps: |
| 29 | + - name: Setup Go |
| 30 | + uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0 |
| 31 | + with: |
| 32 | + go-version: '${{ inputs.go_version }}' |
| 33 | + cache: true |
| 34 | + |
| 35 | + - name: Install Cosign |
| 36 | + uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 |
| 37 | + |
| 38 | + - name: Install GoReleaser |
| 39 | + uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0 |
| 40 | + with: |
| 41 | + install-only: true |
| 42 | + |
| 43 | + - name: Install Chainsaw |
| 44 | + shell: bash |
| 45 | + run: | |
| 46 | + set -euo pipefail |
| 47 | + VERSION="${{ inputs.chainsaw_version }}" |
| 48 | + VERSION="${VERSION#v}" |
| 49 | + TAR="chainsaw_linux_amd64.tar.gz" |
| 50 | + URL="https://github.com/kyverno/chainsaw/releases/download/v${VERSION}/${TAR}" |
| 51 | + TMP="$(mktemp -d)" |
| 52 | + curl -fsSL -o "${TMP}/${TAR}" "${URL}" |
| 53 | + tar -xzf "${TMP}/${TAR}" -C "${TMP}" |
| 54 | + sudo mv "${TMP}/chainsaw" /usr/local/bin/chainsaw |
| 55 | + sudo chmod +x /usr/local/bin/chainsaw |
| 56 | + rm -rf "${TMP}" |
| 57 | +
|
| 58 | + - name: Generate SLSA predicate |
| 59 | + uses: ./.github/actions/generate-slsa-predicate |
| 60 | + with: |
| 61 | + workflow_file: qualification.yaml |
| 62 | + |
| 63 | + - name: Build attested binary |
| 64 | + shell: bash |
| 65 | + env: |
| 66 | + GOFLAGS: -mod=vendor |
| 67 | + run: | |
| 68 | + set -euo pipefail |
| 69 | + goreleaser build --clean --single-target --snapshot --timeout 10m |
| 70 | +
|
| 71 | + - name: Locate binary and detect attestation |
| 72 | + id: binary |
| 73 | + shell: bash |
| 74 | + run: | |
| 75 | + set -euo pipefail |
| 76 | + # Find binary (linux/amd64 in CI) |
| 77 | + AICR_BIN="" |
| 78 | + for pattern in dist/aicr_linux_amd64_v1/aicr dist/aicr_linux_amd64/aicr; do |
| 79 | + if [ -x "$pattern" ]; then |
| 80 | + AICR_BIN="$(pwd)/$pattern" |
| 81 | + break |
| 82 | + fi |
| 83 | + done |
| 84 | + if [ -z "$AICR_BIN" ]; then |
| 85 | + echo "::error::Built binary not found in dist/" |
| 86 | + exit 1 |
| 87 | + fi |
| 88 | + echo "AICR_BIN=$AICR_BIN" >> "$GITHUB_ENV" |
| 89 | +
|
| 90 | + # Detect attestation |
| 91 | + ATTEST_FILE="$(dirname "$AICR_BIN")/aicr-attestation.sigstore.json" |
| 92 | + if [ -f "$ATTEST_FILE" ]; then |
| 93 | + echo "AICR_ATTESTED=true" >> "$GITHUB_ENV" |
| 94 | + echo "Binary attestation found: $ATTEST_FILE" |
| 95 | + else |
| 96 | + echo "AICR_ATTESTED=false" >> "$GITHUB_ENV" |
| 97 | + echo "::warning::No binary attestation found (attestation tests will skip)" |
| 98 | + fi |
| 99 | +
|
| 100 | + - name: Run CLI chainsaw tests |
| 101 | + shell: bash |
| 102 | + run: | |
| 103 | + set -euo pipefail |
| 104 | + chainsaw test \ |
| 105 | + --no-cluster \ |
| 106 | + --config tests/chainsaw/chainsaw-config.yaml \ |
| 107 | + --test-dir tests/chainsaw/cli/ |
0 commit comments