Skip to content
.github/workflows/sigstore-updater.yml

erts: improve ordered_set AVL and CA tree memory layout #70

Sign in to view logs

erts: improve ordered_set AVL and CA tree memory layout

erts: improve ordered_set AVL and CA tree memory layout #70

Workflow file for this run

.github/workflows/sigstore-updater.yml at bd03ca6
## %CopyrightBegin%

Check failure on line 1 in .github/workflows/sigstore-updater.yml

View workflow run for this annotation

GitHub Actions / .github/workflows/sigstore-updater.yml

Invalid workflow file 

(Line: 154, Col: 13): The identifier 'changed' may not be used more than once within the same scope.
##
## SPDX-License-Identifier: Apache-2.0
##
## Copyright Ericsson AB 2024-2026. All Rights Reserved.
##
## Licensed under the Apache License, Version 2.0 (the "License");
## you may not use this file except in compliance with the License.
## You may obtain a copy of the License at
##
## http://www.apache.org/licenses/LICENSE-2.0
##
## Unless required by applicable law or agreed to in writing, software
## distributed under the License is distributed on an "AS IS" BASIS,
## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
## See the License for the specific language governing permissions and
## limitations under the License.
##
## %CopyrightEnd%
##
## This workflow has two jobs:
## 1. update-release-sigstore: Regenerates Sigstore attestation files
## when an existing GitHub release is edited.
## 2. attest-vex: Creates Sigstore attestations for modified OpenVEX
## files in PRs targeting the master branch.
##
name: Update Sigstore Files
on:
release:
types: [edited]
pull_request:
branches: [openvex]
paths:
- '*.openvex.json'
permissions:
contents: read
jobs:
update-release-sigstore:
if: github.event_name == 'release'
permissions:
contents: write
attestations: write
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Download release artifacts
env:
GH_TOKEN: "${{ github.token }}"
TAG: "${{ github.event.release.tag_name }}"
run: gh release download "${TAG}"
- name: Copy artifacts
run: mkdir artifacts; cp *.tar.gz artifacts/
- name: Attest Distribution Assets with SBoM
id: attest-sbom
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # ratchet:actions/attest@v4.10
with:
subject-path: |
artifacts/*.tar.gz
sbom-path: bom.spdx.json
- name: Copy SBoM provenance
id: sbom-provenance
shell: bash
env:
ATTESTATION: "${{ steps.attest-sbom.outputs.bundle-path }}"
run: |
shopt -s nullglob
mkdir attestations
for FILE in artifacts/*.tar.gz bom.*.json; do
cp "$ATTESTATION" "attestations/$(basename "$FILE").sigstore"
done
- name: Update release
env:
GH_TOKEN: "${{ github.token }}"
TAG: "${{ github.event.release.tag_name }}"
run: gh release upload "${TAG}" attestations/*.sigstore --clobber
attest-vex:
if: >
github.event_name == 'pull_request' &&
github.repository == 'erlang/otp'
permissions:
contents: write
attestations: write
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout PR branch
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
ref: "${{ github.head_ref }}"
fetch-depth: 0
persist-credentials: false
- name: Find modified OpenVEX files
id: changed
run: |
git diff --name-only --diff-filter=AM HEAD~1 HEAD -- '*.openvex.json' > /tmp/changed-vex.txt
echo "Modified OpenVEX files:"
cat /tmp/changed-vex.txt
if [ -s /tmp/changed-vex.txt ]; then
echo "found=true" >> "$GITHUB_OUTPUT"
else
echo "found=false" >> "$GITHUB_OUTPUT"
fi
- name: Add license files for new OpenVEX files
if: steps.changed.outputs.found == 'true'
shell: bash
run: |
curl -sL https://raw.githubusercontent.com/erlang/otp/master/.github/scripts/add-vex-license.sh
chmod +x .github/scripts/add-vex-license.sh
.github/scripts/add-vex-license.sh /tmp/changed-vex.txt
- name: Check PR author permission
env:
GH_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
PR_AUTHOR: "${{ github.event.pull_request.user.login }}"
PR_AUTHOR_ID: "${{ github.event.pull_request.user.id }}"
REPOSITORY: "${{ github.repository }}"
run: |
# Check permissions for modifying vex files
# erlang-bot-app[bot] user ID: 232538940
if [[ "$PR_AUTHOR_ID" == "232538940" ]]; then
echo "PR opened by erlang-bot-app[bot] (id=$PR_AUTHOR_ID), allowed"
exit 0
fi
PERMISSION=$(gh api \
-H "Accept: application/vnd.github+json" \
-H "X-GitHub-Api-Version: 2022-11-28" \
/repos/$REPOSITORY/collaborators/$PR_AUTHOR/permission --jq '.role_name')
if [[ "$PERMISSION" != "admin" && "$PERMISSION" != "maintain" && "$PERMISSION" != "Security Master" ]]; then
echo "::error::Only maintainers or erlang-bot-app can trigger VEX attestations"
exit 1
fi
- name: Checkout PR branch
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
repository: "${{ github.event.pull_request.head.repo.full_name }}"
ref: "${{ github.event.pull_request.head.ref }}"
fetch-depth: 0
persist-credentials: false
- name: Find modified OpenVEX files
id: changed
run: |
git diff --name-only --diff-filter=AM HEAD~1 HEAD -- 'vex/*.openvex.json' > /tmp/changed-vex.txt
echo "Modified OpenVEX files:"
cat /tmp/changed-vex.txt
if [ -s /tmp/changed-vex.txt ]; then
echo "found=true" >> "$GITHUB_OUTPUT"
else
echo "found=false" >> "$GITHUB_OUTPUT"
fi
- name: Add license files for new OpenVEX files
if: steps.changed.outputs.found == 'true'
run: bash .github/scripts/add-vex-license.sh /tmp/changed-vex.txt
- name: Attest OpenVEX files
if: steps.changed.outputs.found == 'true'
id: attest
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # ratchet:actions/attest@v4.10
with:
subject-path: '*.openvex.json'
- uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
if: steps.changed.outputs.found == 'true'
id: app-token
with:
app-id: ${{ vars.ERLANG_BOT_APP_ID }}
private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}
- name: Authenticate gh
if: steps.changed.outputs.found == 'true'
env:
STEPS_APP_TOKEN_OUTPUTS_TOKEN: "${{ steps.app-token.outputs.token }}"
run: |
echo "${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" | gh auth login --with-token
# register `gh` as git credential helper => git push in otp-compliance
# uses the token from `gh`. otherwise, `persist-credentials` should not be `false`.
# changing `persist-credentials` is not a good option
- name: Configure git to use gh as credential helper
if: steps.changed.outputs.found == 'true'
run: gh auth setup-git
- name: Get GitHub App User ID
if: steps.changed.outputs.found == 'true'
id: get-user-id
env:
GH_TOKEN: "${{ steps.app-token.outputs.token }}"
STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: "${{ steps.app-token.outputs.app-slug }}"
run: echo "user-id=$(gh api "/users/${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
- name: Commit attestations to PR
if: steps.changed.outputs.found == 'true'
shell: bash
env:
ATTESTATION: "${{ steps.attest.outputs.bundle-path }}"
STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: "${{ steps.app-token.outputs.app-slug }}"
STEPS_APP_TOKEN_OUTPUTS_TOKEN: "${{ steps.app-token.outputs.token }}"
STEPS_GET_USER_ID_OUTPUTS_USER_ID: "${{ steps.get-user-id.outputs.user-id }}"
PR_HEAD_REPO: "${{ github.event.pull_request.head.repo.full_name }}"
PR_HEAD_REF: "${{ github.event.pull_request.head.ref }}"
run: |
while IFS= read -r FILE; do
[ -z "$FILE" ] && continue
BASENAME=$(basename "$FILE")
cp "$ATTESTATION" "${BASENAME}.sigstore"
done < /tmp/changed-vex.txt
git config user.name "${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]"
git config user.email "${STEPS_GET_USER_ID_OUTPUTS_USER_ID}+${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]@users.noreply.github.com"
git remote set-url origin "https://x-access-token:${STEPS_APP_TOKEN_OUTPUTS_TOKEN}@github.com/${PR_HEAD_REPO}.git"
git add *.sigstore *.sigstore.license
git commit -m "Update sigstore attestations for OpenVEX files" || true
git push origin "HEAD:${PR_HEAD_REF}"