Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Brian DeHamer
|
60a047b675 |
@@ -0,0 +1,10 @@
|
||||
rules:
|
||||
document-end: disable
|
||||
document-start:
|
||||
level: warning
|
||||
present: false
|
||||
line-length:
|
||||
level: warning
|
||||
max: 80
|
||||
allow-non-breakable-words: true
|
||||
allow-non-breakable-inline-mappings: true
|
||||
@@ -1,14 +1,13 @@
|
||||
import eslint from '@eslint/js'
|
||||
import importplugin from 'eslint-plugin-import'
|
||||
import jestplugin from 'eslint-plugin-jest'
|
||||
import path from 'node:path'
|
||||
import tseslint from 'typescript-eslint'
|
||||
|
||||
export default tseslint.config(
|
||||
// Ignore non-project files
|
||||
{
|
||||
name: 'ignore',
|
||||
ignores: ['.github', 'dist', 'coverage', '**/*.json', 'jest.setup.js', 'eslint.config.mjs']
|
||||
ignores: ['.github', 'dist', 'coverage', '**/*.json', 'jest.setup.js']
|
||||
},
|
||||
// Use recommended rules from ESLint, TypeScript, and other plugins
|
||||
eslint.configs.recommended,
|
||||
@@ -22,7 +21,7 @@ export default tseslint.config(
|
||||
languageOptions: {
|
||||
ecmaVersion: 2023,
|
||||
parserOptions: {
|
||||
project: [ './tsconfig.lint.json' ]
|
||||
project: ['./.github/linters/tsconfig.json', './tsconfig.json']
|
||||
}
|
||||
},
|
||||
rules: {
|
||||
@@ -0,0 +1,9 @@
|
||||
{
|
||||
"$schema": "https://json.schemastore.org/tsconfig",
|
||||
"extends": "../../tsconfig.json",
|
||||
"compilerOptions": {
|
||||
"noEmit": true
|
||||
},
|
||||
"include": ["../../__tests__/**/*", "../../src/**/*"],
|
||||
"exclude": ["../../dist", "../../node_modules", "../../coverage", "*.json"]
|
||||
}
|
||||
@@ -28,11 +28,11 @@ jobs:
|
||||
steps:
|
||||
- name: Checkout
|
||||
id: checkout
|
||||
uses: actions/checkout@v6.0.2
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Node.js
|
||||
id: setup-node
|
||||
uses: actions/setup-node@v6.2.0
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version-file: .node-version
|
||||
cache: npm
|
||||
@@ -60,7 +60,7 @@ jobs:
|
||||
- if: ${{ failure() && steps.diff.outcome == 'failure' }}
|
||||
name: Upload Artifact
|
||||
id: upload
|
||||
uses: actions/upload-artifact@v6
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: dist
|
||||
path: dist/
|
||||
|
||||
@@ -21,11 +21,11 @@ jobs:
|
||||
steps:
|
||||
- name: Checkout
|
||||
id: checkout
|
||||
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
|
||||
- name: Setup Node.js
|
||||
id: setup-node
|
||||
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
|
||||
uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
|
||||
with:
|
||||
node-version-file: .node-version
|
||||
cache: npm
|
||||
@@ -58,7 +58,7 @@ jobs:
|
||||
steps:
|
||||
- name: Checkout
|
||||
id: checkout
|
||||
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 # v5.0.1
|
||||
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||
- name: Calculate subject digest
|
||||
id: subject
|
||||
env:
|
||||
|
||||
@@ -32,19 +32,19 @@ jobs:
|
||||
steps:
|
||||
- name: Checkout
|
||||
id: checkout
|
||||
uses: actions/checkout@v6.0.2
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Initialize CodeQL
|
||||
id: initialize
|
||||
uses: github/codeql-action/init@v4
|
||||
uses: github/codeql-action/init@v3
|
||||
with:
|
||||
languages: ${{ matrix.language }}
|
||||
source-root: src
|
||||
|
||||
- name: Autobuild
|
||||
id: autobuild
|
||||
uses: github/codeql-action/autobuild@v4
|
||||
uses: github/codeql-action/autobuild@v3
|
||||
|
||||
- name: Perform CodeQL Analysis
|
||||
id: analyze
|
||||
uses: github/codeql-action/analyze@v4
|
||||
uses: github/codeql-action/analyze@v3
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
name: Lint Codebase
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
branches:
|
||||
- main
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
packages: read
|
||||
statuses: write
|
||||
|
||||
jobs:
|
||||
lint:
|
||||
name: Lint Codebase
|
||||
runs-on: ubuntu-latest
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
id: checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Setup Node.js
|
||||
id: setup-node
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version-file: .node-version
|
||||
cache: npm
|
||||
|
||||
- name: Install Dependencies
|
||||
id: install
|
||||
run: npm ci
|
||||
|
||||
- name: Lint Codebase
|
||||
id: super-linter
|
||||
uses: super-linter/super-linter/slim@v7.2.1
|
||||
env:
|
||||
DEFAULT_BRANCH: main
|
||||
FILTER_REGEX_EXCLUDE: dist/**/*
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
TYPESCRIPT_DEFAULT_STYLE: prettier
|
||||
VALIDATE_ALL_CODEBASE: true
|
||||
VALIDATE_JAVASCRIPT_STANDARD: false
|
||||
VALIDATE_TYPESCRIPT_STANDARD: false
|
||||
VALIDATE_JSCPD: false
|
||||
@@ -0,0 +1,22 @@
|
||||
name: 'Publish Immutable Action Version'
|
||||
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
publish:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
packages: write
|
||||
|
||||
steps:
|
||||
- name: Checking out
|
||||
uses: actions/checkout@v4
|
||||
- name: Publish
|
||||
id: publish
|
||||
uses: actions/publish-immutable-action@v0.0.4
|
||||
+1
-1
@@ -1 +1 @@
|
||||
24.5.0
|
||||
20.6.0
|
||||
|
||||
@@ -18,12 +18,6 @@ Once the attestation has been created and signed, it will be uploaded to the GH
|
||||
attestations API and associated with the repository from which the workflow was
|
||||
initiated.
|
||||
|
||||
When an attestation is created, the attestation is stored on the local
|
||||
filesystem used by the runner. For each attestation created, the filesystem path
|
||||
will be appended to the file `${RUNNER_TEMP}/created_attestation_paths.txt`.
|
||||
This can be used to gather all attestations created by all jobs during a the
|
||||
workflow.
|
||||
|
||||
Attestations can be verified using the [`attestation` command in the GitHub
|
||||
CLI][5].
|
||||
|
||||
@@ -41,21 +35,6 @@ information on artifact attestations.
|
||||
> Artifact attestations are NOT supported on GitHub Enterprise Server.
|
||||
<!-- prettier-ignore-end -->
|
||||
|
||||
## Attestation Modes
|
||||
|
||||
This action supports three attestation modes, automatically detected based on
|
||||
the inputs you provide:
|
||||
|
||||
<!-- markdownlint-disable MD013 -->
|
||||
|
||||
| Mode | When Used | Description |
|
||||
| -------------- | ------------------------------------------------------ | ------------------------------------------------ |
|
||||
| **Provenance** | No `sbom-path` or predicate inputs | Auto-generates [SLSA build provenance][10] |
|
||||
| **SBOM** | `sbom-path` is provided | Creates attestation from SPDX or CycloneDX SBOM |
|
||||
| **Custom** | `predicate-type`/`predicate`/`predicate-path` provided | User-supplied predicate |
|
||||
|
||||
<!-- markdownlint-enable MD013 -->
|
||||
|
||||
## Usage
|
||||
|
||||
Within the GitHub Actions workflow which builds some artifact you would like to
|
||||
@@ -67,32 +46,33 @@ attest:
|
||||
permissions:
|
||||
id-token: write
|
||||
attestations: write
|
||||
artifact-metadata: write
|
||||
```
|
||||
|
||||
The `id-token` permission gives the action the ability to mint the OIDC token
|
||||
necessary to request a Sigstore signing certificate. The `attestations`
|
||||
permission is necessary to persist the attestation. The `artifact-metadata`
|
||||
permission is necessary to create the artifact storage record.
|
||||
permission is necessary to persist the attestation.
|
||||
|
||||
1. Add the following to your workflow after your artifact has been built:
|
||||
|
||||
```yaml
|
||||
- uses: actions/attest@v4
|
||||
- uses: actions/attest@v2
|
||||
with:
|
||||
subject-path: '<PATH TO ARTIFACT>'
|
||||
predicate-type: '<PREDICATE URI>'
|
||||
predicate-path: '<PATH TO PREDICATE>'
|
||||
```
|
||||
|
||||
By default, this generates a [SLSA build provenance][10] attestation. For
|
||||
SBOM or custom attestations, see the [Attestation Modes](#attestation-modes)
|
||||
section.
|
||||
The `subject-path` parameter should identify the artifact for which you want
|
||||
to generate an attestation. The `predicate-type` can be any of the the
|
||||
[vetted predicate types][3] or a custom value. The `predicate-path`
|
||||
identifies a file containing the JSON-encoded predicate parameters.
|
||||
|
||||
### Inputs
|
||||
|
||||
See [action.yml](action.yml)
|
||||
|
||||
```yaml
|
||||
- uses: actions/attest@v4
|
||||
- uses: actions/attest@v2
|
||||
with:
|
||||
# Path to the artifact serving as the subject of the attestation. Must
|
||||
# specify exactly one of "subject-path", "subject-digest", or
|
||||
@@ -114,24 +94,17 @@ See [action.yml](action.yml)
|
||||
# or "subject-checksums".
|
||||
subject-checksums:
|
||||
|
||||
# Path to the JSON-formatted SBOM file (SPDX or CycloneDX) to attest.
|
||||
# File size cannot exceed 16MB. When provided, creates an SBOM attestation.
|
||||
# Cannot be used together with "predicate-type", "predicate", or
|
||||
# "predicate-path".
|
||||
sbom-path:
|
||||
|
||||
# URI identifying the type of the predicate. Required when using "predicate"
|
||||
# or "predicate-path" for custom attestations.
|
||||
# URI identifying the type of the predicate.
|
||||
predicate-type:
|
||||
|
||||
# String containing the value for the attestation predicate. String length
|
||||
# cannot exceed 16MB. Must supply exactly one of "predicate-path" or
|
||||
# "predicate" when creating custom attestations.
|
||||
# "predicate".
|
||||
predicate:
|
||||
|
||||
# Path to the file which contains the content for the attestation predicate.
|
||||
# File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
|
||||
# or "predicate" when creating custom attestations.
|
||||
# or "predicate".
|
||||
predicate-path:
|
||||
|
||||
# Whether to push the attestation to the image registry. Requires that the
|
||||
@@ -139,12 +112,6 @@ See [action.yml](action.yml)
|
||||
# the "subject-digest" parameter be specified. Defaults to false.
|
||||
push-to-registry:
|
||||
|
||||
# Whether to create a storage record for the artifact.
|
||||
# Requires that push-to-registry is set to true.
|
||||
# Requires that the "subject-name" parameter specify the fully-qualified
|
||||
# image name. Defaults to true.
|
||||
create-storage-record:
|
||||
|
||||
# Whether to attach a list of generated attestations to the workflow run
|
||||
# summary page. Defaults to true.
|
||||
show-summary:
|
||||
@@ -158,12 +125,11 @@ See [action.yml](action.yml)
|
||||
|
||||
<!-- markdownlint-disable MD013 -->
|
||||
|
||||
| Name | Description | Example |
|
||||
| ------------------- | -------------------------------------------------------------- | ------------------------------------------------ |
|
||||
| `attestation-id` | GitHub ID for the attestation | `123456` |
|
||||
| `attestation-url` | URL for the attestation summary | `https://github.com/foo/bar/attestations/123456` |
|
||||
| `bundle-path` | Absolute path to the file containing the generated attestation | `/tmp/attestation.json` |
|
||||
| `storage-record-ids` | GitHub IDs for the storage records | `987654` |
|
||||
| Name | Description | Example |
|
||||
| ----------------- | -------------------------------------------------------------- | ------------------------------------------------ |
|
||||
| `attestation-id` | GitHub ID for the attestation | `123456` |
|
||||
| `attestation-url` | URL for the attestation summary | `https://github.com/foo/bar/attestations/123456` |
|
||||
| `bundle-path` | Absolute path to the file containing the generated attestation | `/tmp/attestation.json` |
|
||||
|
||||
<!-- markdownlint-enable MD013 -->
|
||||
|
||||
@@ -185,13 +151,13 @@ string cannot exceed 16MB.
|
||||
|
||||
## Examples
|
||||
|
||||
### Provenance Attestation (Default)
|
||||
### Identify Subject by Path
|
||||
|
||||
The simplest use case - just specify the artifact path and a SLSA build
|
||||
provenance attestation is automatically generated:
|
||||
For the basic use case, simply add the `attest` action to your workflow and
|
||||
supply the path to the artifact for which you want to generate attestation.
|
||||
|
||||
```yaml
|
||||
name: build-attest-provenance
|
||||
name: build-attest
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
@@ -209,36 +175,11 @@ jobs:
|
||||
- name: Build artifact
|
||||
run: make my-app
|
||||
- name: Attest
|
||||
uses: actions/attest@v4
|
||||
uses: actions/attest@v2
|
||||
with:
|
||||
subject-path: '${{ github.workspace }}/my-app'
|
||||
```
|
||||
|
||||
### SBOM Attestation
|
||||
|
||||
To create an SBOM attestation, provide the path to an SPDX or CycloneDX JSON
|
||||
file:
|
||||
|
||||
```yaml
|
||||
- name: Generate SBOM
|
||||
run: syft . -o spdx-json > sbom.spdx.json
|
||||
|
||||
- uses: actions/attest@v4
|
||||
with:
|
||||
subject-path: '${{ github.workspace }}/my-app'
|
||||
sbom-path: '${{ github.workspace }}/sbom.spdx.json'
|
||||
```
|
||||
|
||||
### Custom Attestation
|
||||
|
||||
For custom attestations, provide your own predicate type and content:
|
||||
|
||||
```yaml
|
||||
- uses: actions/attest@v4
|
||||
with:
|
||||
subject-path: '${{ github.workspace }}/my-app'
|
||||
predicate-type: 'https://example.com/predicate/v1'
|
||||
predicate: '{}'
|
||||
predicate-type: 'https://example.com/predicate/v1'
|
||||
predicate: '{}'
|
||||
```
|
||||
|
||||
### Identify Multiple Subjects
|
||||
@@ -247,7 +188,7 @@ If you are generating multiple artifacts, you can attest all of them at the same
|
||||
time by using a wildcard in the `subject-path` input.
|
||||
|
||||
```yaml
|
||||
- uses: actions/attest@v4
|
||||
- uses: actions/attest@v2
|
||||
with:
|
||||
subject-path: 'dist/**/my-bin-*'
|
||||
predicate-type: 'https://example.com/predicate/v1'
|
||||
@@ -261,13 +202,13 @@ Alternatively, you can explicitly list multiple subjects with either a comma or
|
||||
newline delimited list:
|
||||
|
||||
```yaml
|
||||
- uses: actions/attest@v4
|
||||
- uses: actions/attest@v2
|
||||
with:
|
||||
subject-path: 'dist/foo, dist/bar'
|
||||
```
|
||||
|
||||
```yaml
|
||||
- uses: actions/attest@v4
|
||||
- uses: actions/attest@v2
|
||||
with:
|
||||
subject-path: |
|
||||
dist/foo
|
||||
@@ -289,9 +230,11 @@ attestation.
|
||||
run: |
|
||||
shasum -a 256 foo_0.0.1_* > subject.checksums.txt
|
||||
|
||||
- uses: actions/attest@v4
|
||||
- uses: actions/attest@v2
|
||||
with:
|
||||
subject-checksums: subject.checksums.txt
|
||||
predicate-type: 'https://example.com/predicate/v1'
|
||||
predicate: '{}'
|
||||
```
|
||||
|
||||
<!-- markdownlint-disable MD038 -->
|
||||
@@ -320,10 +263,6 @@ fully-qualified image name (e.g. "ghcr.io/user/app" or
|
||||
"acme.azurecr.io/user/app"). Do NOT include a tag as part of the image name --
|
||||
the specific image being attested is identified by the supplied digest.
|
||||
|
||||
If the `push-to-registry` option is set to true, the Action will also
|
||||
emit an Artifact Metadata Storage Record. If you do not want to emit a
|
||||
storage record, set `create-storage-record` to `false`.
|
||||
|
||||
> **NOTE**: When pushing to Docker Hub, please use "docker.io" as the registry
|
||||
> portion of the image name.
|
||||
|
||||
@@ -342,7 +281,6 @@ jobs:
|
||||
packages: write
|
||||
contents: read
|
||||
attestations: write
|
||||
artifact-metadata: write
|
||||
env:
|
||||
REGISTRY: ghcr.io
|
||||
IMAGE_NAME: ${{ github.repository }}
|
||||
@@ -364,11 +302,13 @@ jobs:
|
||||
push: true
|
||||
tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
|
||||
- name: Attest
|
||||
uses: actions/attest@v4
|
||||
uses: actions/attest@v2
|
||||
id: attest
|
||||
with:
|
||||
subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||
subject-digest: ${{ steps.push.outputs.digest }}
|
||||
predicate-type: 'https://in-toto.io/attestation/release/v0.1'
|
||||
predicate: '{"purl":"pkg:oci/..."}'
|
||||
push-to-registry: true
|
||||
```
|
||||
|
||||
@@ -383,4 +323,3 @@ jobs:
|
||||
[8]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns
|
||||
[9]:
|
||||
https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
|
||||
[10]: https://slsa.dev/spec/v1.0/provenance
|
||||
|
||||
@@ -1,195 +0,0 @@
|
||||
import { jest } from '@jest/globals'
|
||||
import type { Descriptor } from '@sigstore/oci'
|
||||
// Mock functions
|
||||
const mockGetOctokit = jest.fn()
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const mockAttest = jest.fn<() => Promise<any>>()
|
||||
const mockCreateStorageRecord = jest.fn<() => Promise<number[]>>()
|
||||
const mockGetRegistryCredentials = jest.fn()
|
||||
const mockAttachArtifactToImage = jest.fn<() => Promise<Descriptor>>()
|
||||
|
||||
// Mock @actions/github
|
||||
jest.unstable_mockModule('@actions/github', () => ({
|
||||
getOctokit: mockGetOctokit,
|
||||
context: {
|
||||
repo: { owner: 'foo', repo: 'bar' },
|
||||
payload: { repository: { visibility: 'private' } }
|
||||
}
|
||||
}))
|
||||
|
||||
// Mock @actions/attest
|
||||
jest.unstable_mockModule('@actions/attest', () => ({
|
||||
attest: mockAttest,
|
||||
createStorageRecord: mockCreateStorageRecord
|
||||
}))
|
||||
|
||||
// Mock @sigstore/oci
|
||||
jest.unstable_mockModule('@sigstore/oci', () => ({
|
||||
getRegistryCredentials: mockGetRegistryCredentials,
|
||||
attachArtifactToImage: mockAttachArtifactToImage
|
||||
}))
|
||||
|
||||
// Dynamic imports after mocking
|
||||
const { createAttestation, repoOwnerIsOrg } = await import('../src/attest')
|
||||
|
||||
const subjectName = 'ghcr.io/foo/bar'
|
||||
const subjectDigest =
|
||||
'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
|
||||
|
||||
const predicate = {
|
||||
type: 'https://in-toto.io/attestation/release/v0.1',
|
||||
params: {}
|
||||
}
|
||||
|
||||
describe('repoOwnerIsOrg', () => {
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
})
|
||||
|
||||
it('returns true when repo owner is an organization', async () => {
|
||||
mockGetOctokit.mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
get: jest
|
||||
.fn<() => Promise<{ data: { owner: { type: string } } }>>()
|
||||
.mockResolvedValue({
|
||||
data: { owner: { type: 'Organization' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
const result = await repoOwnerIsOrg('gh-token')
|
||||
expect(result).toBe(true)
|
||||
})
|
||||
|
||||
it('returns false when repo owner is a user', async () => {
|
||||
mockGetOctokit.mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
get: jest.fn<() => Promise<any>>().mockResolvedValue({
|
||||
data: { owner: { type: 'User' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
})
|
||||
|
||||
const result = await repoOwnerIsOrg('gh-token')
|
||||
expect(result).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('createAttestation', () => {
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
|
||||
// Default mock implementations
|
||||
mockAttest.mockResolvedValue({
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' },
|
||||
certificate: 'cert',
|
||||
tlogID: 'tlog-123',
|
||||
attestationID: 'att-123'
|
||||
})
|
||||
|
||||
mockGetRegistryCredentials.mockReturnValue({
|
||||
username: 'user',
|
||||
password: 'pass'
|
||||
})
|
||||
|
||||
mockAttachArtifactToImage.mockResolvedValue({
|
||||
digest: 'sha256:abc123',
|
||||
mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
|
||||
size: 100
|
||||
})
|
||||
})
|
||||
|
||||
describe('when createStorageRecord is false', () => {
|
||||
it('skips storage record creation', async () => {
|
||||
const subjects = [
|
||||
{
|
||||
name: subjectName,
|
||||
digest: { sha256: subjectDigest.replace('sha256:', '') }
|
||||
}
|
||||
]
|
||||
|
||||
const result = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance: 'github',
|
||||
pushToRegistry: true,
|
||||
createStorageRecord: false,
|
||||
githubToken: 'gh-token'
|
||||
})
|
||||
|
||||
expect(result.attestationDigest).toBe('sha256:abc123')
|
||||
expect(mockCreateStorageRecord).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when storage records are empty', () => {
|
||||
beforeEach(() => {
|
||||
mockGetOctokit.mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
get: jest.fn<() => Promise<any>>().mockResolvedValue({
|
||||
data: { owner: { type: 'Organization' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
})
|
||||
mockCreateStorageRecord.mockResolvedValue([])
|
||||
})
|
||||
|
||||
it('handles empty storage records gracefully', async () => {
|
||||
const subjects = [
|
||||
{
|
||||
name: subjectName,
|
||||
digest: { sha256: subjectDigest.replace('sha256:', '') }
|
||||
}
|
||||
]
|
||||
|
||||
const result = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance: 'github',
|
||||
pushToRegistry: true,
|
||||
createStorageRecord: true,
|
||||
githubToken: 'gh-token'
|
||||
})
|
||||
|
||||
expect(result.attestationDigest).toBe('sha256:abc123')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when subject has unsupported protocol', () => {
|
||||
beforeEach(() => {
|
||||
mockGetOctokit.mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
get: jest.fn<() => Promise<any>>().mockResolvedValue({
|
||||
data: { owner: { type: 'Organization' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
})
|
||||
mockCreateStorageRecord.mockResolvedValue([123])
|
||||
})
|
||||
|
||||
it('handles unsupported protocol gracefully', async () => {
|
||||
const subjects = [
|
||||
{
|
||||
name: 'http://registry.example.com/foo/bar',
|
||||
digest: { sha256: subjectDigest.replace('sha256:', '') }
|
||||
}
|
||||
]
|
||||
|
||||
const result = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance: 'github',
|
||||
pushToRegistry: true,
|
||||
createStorageRecord: true,
|
||||
githubToken: 'gh-token'
|
||||
})
|
||||
|
||||
expect(result.attestationDigest).toBe('sha256:abc123')
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -1,190 +0,0 @@
|
||||
import {
|
||||
detectAttestationType,
|
||||
validateAttestationInputs,
|
||||
DetectionInputs
|
||||
} from '../src/detect'
|
||||
|
||||
describe('detectAttestationType', () => {
|
||||
const blankInputs: DetectionInputs = {
|
||||
sbomPath: '',
|
||||
predicateType: '',
|
||||
predicate: '',
|
||||
predicatePath: ''
|
||||
}
|
||||
|
||||
describe('when no inputs are provided', () => {
|
||||
it('returns provenance', () => {
|
||||
expect(detectAttestationType(blankInputs)).toBe('provenance')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is provided', () => {
|
||||
it('returns sbom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('sbom')
|
||||
})
|
||||
|
||||
it('returns sbom even when predicate inputs are also provided', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('sbom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type is provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate is provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-path is provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type and predicate are provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('validateAttestationInputs', () => {
|
||||
const blankInputs: DetectionInputs = {
|
||||
sbomPath: '',
|
||||
predicateType: '',
|
||||
predicate: '',
|
||||
predicatePath: ''
|
||||
}
|
||||
|
||||
describe('when no inputs are provided', () => {
|
||||
it('does not throw', () => {
|
||||
expect(() => validateAttestationInputs(blankInputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is provided alone', () => {
|
||||
it('does not throw', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is combined with predicate-type', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/Cannot specify sbom-path together with/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is combined with predicate', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/Cannot specify sbom-path together with/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is combined with predicate-path', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/Cannot specify sbom-path together with/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate is provided without predicate-type', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/predicate-type is required/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-path is provided without predicate-type', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/predicate-type is required/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type and predicate are provided', () => {
|
||||
it('does not throw', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type and predicate-path are provided', () => {
|
||||
it('does not throw', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
})
|
||||
+10
-23
@@ -1,35 +1,22 @@
|
||||
/**
|
||||
* Unit tests for the action's entrypoint, src/index.ts
|
||||
*/
|
||||
import { jest } from '@jest/globals'
|
||||
|
||||
// Mock functions
|
||||
const mockRun = jest.fn()
|
||||
const mockGetInput = jest.fn()
|
||||
const mockGetBooleanInput = jest.fn()
|
||||
import * as core from '@actions/core'
|
||||
import * as main from '../src/main'
|
||||
|
||||
// Mock @actions/core
|
||||
jest.unstable_mockModule('@actions/core', () => ({
|
||||
getInput: mockGetInput,
|
||||
getBooleanInput: mockGetBooleanInput
|
||||
}))
|
||||
|
||||
// Mock ../src/main
|
||||
jest.unstable_mockModule('../src/main', () => ({
|
||||
run: mockRun
|
||||
}))
|
||||
// Mock the action's entrypoint
|
||||
const runMock = jest.spyOn(main, 'run').mockImplementation()
|
||||
const getBooleanInputMock = jest.spyOn(core, 'getBooleanInput')
|
||||
|
||||
describe('index', () => {
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
mockGetBooleanInput.mockReturnValue(false)
|
||||
mockGetInput.mockReturnValue('')
|
||||
getBooleanInputMock.mockImplementation(() => false)
|
||||
})
|
||||
it('calls run when imported', () => {
|
||||
// eslint-disable-next-line @typescript-eslint/no-require-imports
|
||||
require('../src/index')
|
||||
|
||||
it('calls run when imported', async () => {
|
||||
// Dynamic import after mocking
|
||||
await import('../src/index')
|
||||
|
||||
expect(mockRun).toHaveBeenCalled()
|
||||
expect(runMock).toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
|
||||
+144
-395
@@ -5,140 +5,56 @@
|
||||
* Specifically, the inputs listed in `action.yml` should be set as environment
|
||||
* variables following the pattern `INPUT_<INPUT_NAME>`.
|
||||
*/
|
||||
import type { Predicate } from '@actions/attest'
|
||||
import { jest } from '@jest/globals'
|
||||
import type { RunInputs } from '../src/main'
|
||||
import * as core from '@actions/core'
|
||||
import * as github from '@actions/github'
|
||||
import { mockFulcio, mockRekor, mockTSA } from '@sigstore/mock'
|
||||
import * as oci from '@sigstore/oci'
|
||||
import fs from 'fs/promises'
|
||||
import nock from 'nock'
|
||||
import os from 'os'
|
||||
import path from 'path'
|
||||
import { MockAgent, setGlobalDispatcher } from 'undici'
|
||||
import { SEARCH_PUBLIC_GOOD_URL } from '../src/endpoints'
|
||||
import * as main from '../src/main'
|
||||
|
||||
// Create mock functions before mocking modules
|
||||
const infoMock = jest.fn()
|
||||
const warningMock = jest.fn()
|
||||
const startGroupMock = jest.fn()
|
||||
const endGroupMock = jest.fn()
|
||||
const setOutputMock = jest.fn()
|
||||
const setFailedMock = jest.fn()
|
||||
const debugMock = jest.fn()
|
||||
// Mock the GitHub Actions core library
|
||||
const infoMock = jest.spyOn(core, 'info')
|
||||
const startGroupMock = jest.spyOn(core, 'startGroup')
|
||||
const setOutputMock = jest.spyOn(core, 'setOutput')
|
||||
const setFailedMock = jest.spyOn(core, 'setFailed')
|
||||
|
||||
// OCI mocks
|
||||
const getRegCredsMock = jest.fn()
|
||||
const attachArtifactMock = jest.fn()
|
||||
// Ensure that setFailed doesn't set an exit code during tests
|
||||
setFailedMock.mockImplementation(() => {})
|
||||
|
||||
// Attest mocks
|
||||
const attestMock = jest.fn()
|
||||
const createStorageRecordMock = jest.fn()
|
||||
const summaryWriteMock = jest.spyOn(core.summary, 'write')
|
||||
summaryWriteMock.mockImplementation(async () => Promise.resolve(core.summary))
|
||||
|
||||
// Local attest mocks
|
||||
// eslint-disable-next-line @typescript-eslint/no-explicit-any
|
||||
const createAttestationMock = jest.fn<() => Promise<any>>()
|
||||
const repoOwnerIsOrgMock = jest.fn()
|
||||
|
||||
// Provenance mock
|
||||
const generateProvenancePredicateMock = jest.fn<() => Promise<Predicate>>()
|
||||
|
||||
// GitHub context mock
|
||||
const mockContext = {
|
||||
repo: { owner: 'foo', repo: 'bar' },
|
||||
payload: { repository: { visibility: 'private' } }
|
||||
}
|
||||
const mockGetOctokit = jest.fn()
|
||||
|
||||
// Summary mock with chainable methods
|
||||
const summaryMock = {
|
||||
write: jest.fn().mockReturnThis(),
|
||||
addRaw: jest.fn().mockReturnThis(),
|
||||
addHeading: jest.fn().mockReturnThis(),
|
||||
addLink: jest.fn().mockReturnThis(),
|
||||
addTable: jest.fn().mockReturnThis(),
|
||||
addBreak: jest.fn().mockReturnThis(),
|
||||
addSeparator: jest.fn().mockReturnThis(),
|
||||
addQuote: jest.fn().mockReturnThis(),
|
||||
addCodeBlock: jest.fn().mockReturnThis(),
|
||||
addList: jest.fn().mockReturnThis(),
|
||||
addImage: jest.fn().mockReturnThis(),
|
||||
addDetails: jest.fn().mockReturnThis(),
|
||||
addEOL: jest.fn().mockReturnThis(),
|
||||
emptyBuffer: jest.fn().mockReturnThis(),
|
||||
stringify: jest.fn().mockReturnValue(''),
|
||||
isEmptyBuffer: jest.fn().mockReturnValue(true),
|
||||
clear: jest.fn().mockReturnThis()
|
||||
}
|
||||
|
||||
// Mock @actions/core
|
||||
jest.unstable_mockModule('@actions/core', () => ({
|
||||
info: infoMock,
|
||||
warning: warningMock,
|
||||
startGroup: startGroupMock,
|
||||
endGroup: endGroupMock,
|
||||
setOutput: setOutputMock,
|
||||
setFailed: setFailedMock,
|
||||
debug: debugMock,
|
||||
summary: summaryMock
|
||||
}))
|
||||
|
||||
// Mock @actions/github
|
||||
jest.unstable_mockModule('@actions/github', () => ({
|
||||
context: mockContext,
|
||||
getOctokit: mockGetOctokit
|
||||
}))
|
||||
|
||||
// Mock @sigstore/oci
|
||||
jest.unstable_mockModule('@sigstore/oci', () => ({
|
||||
getRegistryCredentials: getRegCredsMock,
|
||||
attachArtifactToImage: attachArtifactMock
|
||||
}))
|
||||
|
||||
// Mock @actions/attest
|
||||
jest.unstable_mockModule('@actions/attest', () => ({
|
||||
attest: attestMock,
|
||||
createStorageRecord: createStorageRecordMock
|
||||
}))
|
||||
|
||||
// Mock ../src/attest
|
||||
jest.unstable_mockModule('../src/attest', () => ({
|
||||
createAttestation: createAttestationMock,
|
||||
repoOwnerIsOrg: repoOwnerIsOrgMock
|
||||
}))
|
||||
|
||||
// Mock ../src/provenance
|
||||
jest.unstable_mockModule('../src/provenance', () => ({
|
||||
generateProvenancePredicate: generateProvenancePredicateMock
|
||||
}))
|
||||
|
||||
// Dynamic imports after mocking
|
||||
const { mockFulcio, mockRekor, mockTSA } = await import('@sigstore/mock')
|
||||
const fs = (await import('fs/promises')).default
|
||||
const nock = (await import('nock')).default
|
||||
const os = (await import('os')).default
|
||||
const path = (await import('path')).default
|
||||
const { MockAgent, setGlobalDispatcher } = await import('undici')
|
||||
const { run } = await import('../src/main')
|
||||
// Mock the action's main function
|
||||
const runMock = jest.spyOn(main, 'run')
|
||||
|
||||
// MockAgent for mocking @actions/github
|
||||
const mockAgent = new MockAgent()
|
||||
setGlobalDispatcher(mockAgent)
|
||||
|
||||
const defaultInputs: RunInputs = {
|
||||
const defaultInputs: main.RunInputs = {
|
||||
predicate: '',
|
||||
predicateType: '',
|
||||
predicatePath: '',
|
||||
sbomPath: '',
|
||||
subjectName: '',
|
||||
subjectDigest: '',
|
||||
subjectPath: '',
|
||||
subjectChecksums: '',
|
||||
pushToRegistry: false,
|
||||
createStorageRecord: true,
|
||||
showSummary: true,
|
||||
githubToken: '',
|
||||
privateSigning: false
|
||||
}
|
||||
|
||||
describe('action', () => {
|
||||
// Capture original environment variables so we can restore after each test
|
||||
// Capture original environment variables and GitHub context so we can restore
|
||||
// them after each test
|
||||
const originalEnv = process.env
|
||||
const originalContext = {
|
||||
repo: { owner: 'foo', repo: 'bar' },
|
||||
payload: { repository: { visibility: 'private' } }
|
||||
}
|
||||
const originalContext = { ...github.context }
|
||||
|
||||
// Mock OIDC token endpoint
|
||||
const tokenURL = 'https://token.url'
|
||||
@@ -150,14 +66,13 @@ describe('action', () => {
|
||||
'base64'
|
||||
)}.}`
|
||||
|
||||
const subjectName = 'ghcr.io/registry/foo/bar'
|
||||
const subjectName = 'registry/foo/bar'
|
||||
const subjectDigest =
|
||||
'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
|
||||
const predicate = '{}'
|
||||
const predicateType = 'https://in-toto.io/attestation/release/v0.1'
|
||||
|
||||
const attestationID = '1234567890'
|
||||
const storageRecordID = 987654321
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
@@ -167,21 +82,14 @@ describe('action', () => {
|
||||
.query({ audience: 'sigstore' })
|
||||
.reply(200, { value: oidcToken })
|
||||
|
||||
const pool = mockAgent.get('https://api.github.com')
|
||||
pool
|
||||
mockAgent
|
||||
.get('https://api.github.com')
|
||||
.intercept({
|
||||
path: /^\/repos\/.*\/.*\/attestations$/,
|
||||
method: 'post'
|
||||
})
|
||||
.reply(201, { id: attestationID })
|
||||
|
||||
pool
|
||||
.intercept({
|
||||
path: /^\/orgs\/.*\/artifacts\/metadata\/storage-record$/,
|
||||
method: 'post'
|
||||
})
|
||||
.reply(200, { storage_records: [{ id: storageRecordID }] })
|
||||
|
||||
process.env = {
|
||||
...originalEnv,
|
||||
ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
|
||||
@@ -199,7 +107,7 @@ describe('action', () => {
|
||||
})
|
||||
|
||||
describe('when ACTIONS_ID_TOKEN_REQUEST_URL is not set', () => {
|
||||
const inputs: RunInputs = {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
@@ -214,8 +122,9 @@ describe('action', () => {
|
||||
})
|
||||
|
||||
it('sets a failed status', async () => {
|
||||
await run(inputs)
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'missing "id-token" permission. Please add "permissions: id-token: write" to your workflow.'
|
||||
@@ -226,8 +135,9 @@ describe('action', () => {
|
||||
|
||||
describe('when no inputs are provided', () => {
|
||||
it('sets a failed status', async () => {
|
||||
await run(defaultInputs)
|
||||
await main.run(defaultInputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'One of subject-path, subject-digest, or subject-checksums must be provided'
|
||||
@@ -237,7 +147,7 @@ describe('action', () => {
|
||||
})
|
||||
|
||||
describe('when the repository is private', () => {
|
||||
const inputs: RunInputs = {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
@@ -253,16 +163,6 @@ describe('action', () => {
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
// Mock createAttestation to return expected values
|
||||
createAttestationMock.mockResolvedValue({
|
||||
attestationID,
|
||||
certificate:
|
||||
'-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
|
||||
tlogID: 'tlog-123',
|
||||
attestationDigest: 'sha256:123456',
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
@@ -271,21 +171,56 @@ describe('action', () => {
|
||||
})
|
||||
|
||||
it('invokes the action w/o error', async () => {
|
||||
await run(inputs)
|
||||
await main.run(inputs)
|
||||
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
|
||||
expect(infoMock).toHaveBeenCalledWith(
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalledWith()
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
expect.stringMatching(
|
||||
`Attestation created for ${subjectName}@${subjectDigest}`
|
||||
)
|
||||
)
|
||||
expect(createAttestationMock).toHaveBeenCalled()
|
||||
expect(startGroupMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
expect.stringMatching('GitHub Sigstore')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
expect.stringMatching('-----BEGIN CERTIFICATE-----')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
3,
|
||||
expect.stringMatching(/attestation uploaded/i)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
4,
|
||||
expect.stringMatching(attestationID)
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
'bundle-path',
|
||||
expect.stringMatching('attestation.json')
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
'attestation-id',
|
||||
expect.stringMatching(attestationID)
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
3,
|
||||
'attestation-url',
|
||||
expect.stringContaining(`foo/bar/attestations/${attestationID}`)
|
||||
)
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when the repository is public', () => {
|
||||
const inputs: RunInputs = {
|
||||
const getRegCredsSpy = jest.spyOn(oci, 'getRegistryCredentials')
|
||||
const attachArtifactSpy = jest.spyOn(oci, 'attachArtifactToImage')
|
||||
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
@@ -302,87 +237,78 @@ describe('action', () => {
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
// Setup createAttestation mock
|
||||
createAttestationMock.mockResolvedValue({
|
||||
attestationID,
|
||||
certificate:
|
||||
'-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
|
||||
tlogID: 'tlog-123',
|
||||
attestationDigest: 'sha256:123456',
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' },
|
||||
storageRecordIds: [storageRecordID]
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.sigstore.dev',
|
||||
strict: false
|
||||
})
|
||||
await mockRekor({ baseURL: 'https://rekor.sigstore.dev' })
|
||||
|
||||
mockGetOctokit.mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
get: jest
|
||||
.fn<() => Promise<{ data: { owner: { type: string } } }>>()
|
||||
.mockResolvedValue({
|
||||
data: { owner: { type: 'Organization' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
})
|
||||
getRegCredsSpy.mockImplementation(() => ({
|
||||
username: 'username',
|
||||
password: 'password'
|
||||
}))
|
||||
attachArtifactSpy.mockImplementation(async () =>
|
||||
Promise.resolve({
|
||||
digest: 'sha256:123456',
|
||||
mediaType: 'application/vnd.cncf.notary.v2',
|
||||
size: 123456
|
||||
})
|
||||
)
|
||||
})
|
||||
|
||||
it('invokes the action w/o error', async () => {
|
||||
await run(inputs)
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(createAttestationMock).toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
|
||||
expect(infoMock).toHaveBeenCalledWith(
|
||||
expect(getRegCredsSpy).toHaveBeenCalledWith(subjectName)
|
||||
expect(attachArtifactSpy).toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
expect.stringMatching(
|
||||
`Attestation created for ${subjectName}@${subjectDigest}`
|
||||
)
|
||||
)
|
||||
})
|
||||
|
||||
it('catches error when storage record creation fails and continues', async () => {
|
||||
// Mock createAttestation to simulate storage record failure (but still succeed overall)
|
||||
createAttestationMock.mockResolvedValue({
|
||||
attestationID,
|
||||
certificate:
|
||||
'-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
|
||||
tlogID: 'tlog-123',
|
||||
attestationDigest: 'sha256:123456',
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
|
||||
// No storageRecordIDs - simulates empty/failed storage record
|
||||
})
|
||||
|
||||
await run(inputs)
|
||||
|
||||
expect(createAttestationMock).toHaveBeenCalled()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('does not create a storage record when the repo is owned by a user', async () => {
|
||||
// Mock createAttestation to not return storage record IDs
|
||||
createAttestationMock.mockResolvedValue({
|
||||
attestationID,
|
||||
certificate:
|
||||
'-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
|
||||
tlogID: 'tlog-123',
|
||||
attestationDigest: 'sha256:123456',
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
|
||||
})
|
||||
|
||||
await run(inputs)
|
||||
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(createAttestationMock).toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith(
|
||||
expect.stringMatching(
|
||||
`Attestation created for ${subjectName}@${subjectDigest}`
|
||||
)
|
||||
expect(startGroupMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
expect.stringMatching('Public Good Sigstore')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
expect.stringMatching('-----BEGIN CERTIFICATE-----')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
3,
|
||||
expect.stringMatching(/signature uploaded/i)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
4,
|
||||
expect.stringMatching(SEARCH_PUBLIC_GOOD_URL)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
5,
|
||||
expect.stringMatching(/attestation uploaded/i)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
6,
|
||||
expect.stringMatching(attestationID)
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
'bundle-path',
|
||||
expect.stringMatching('attestation.json')
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
'attestation-id',
|
||||
expect.stringMatching(attestationID)
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
3,
|
||||
'attestation-url',
|
||||
expect.stringContaining(`foo/bar/attestations/${attestationID}`)
|
||||
)
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
|
||||
@@ -425,19 +351,19 @@ describe('action', () => {
|
||||
})
|
||||
|
||||
it('invokes the action w/o error', async () => {
|
||||
const inputs: RunInputs = {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectPath: path.join(dir, `${filename}-*`),
|
||||
predicateType,
|
||||
predicate,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
await run(inputs)
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenNthCalledWith(1, 'Attestation type: Custom')
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
1,
|
||||
expect.stringMatching('Attestation created for 5 subjects')
|
||||
)
|
||||
})
|
||||
@@ -473,204 +399,27 @@ describe('action', () => {
|
||||
})
|
||||
|
||||
it('sets a failed status', async () => {
|
||||
const inputs: RunInputs = {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectPath: path.join(dir, `${filename}-*`),
|
||||
predicateType,
|
||||
predicate,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
await run(inputs)
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'Too many subjects specified (>1024). The maximum number of subjects is 1024.'
|
||||
'Too many subjects specified. The maximum number of subjects is 1024.'
|
||||
)
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('attestation type detection', () => {
|
||||
describe('when sbom-path is provided with predicate inputs', () => {
|
||||
it('sets a failed status for conflicting inputs', async () => {
|
||||
const inputs: RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicateType: 'https://example.com/predicate',
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
await run(inputs)
|
||||
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'Cannot specify sbom-path together with predicate-type, predicate, or predicate-path'
|
||||
)
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate is provided without predicate-type', () => {
|
||||
it('sets a failed status for missing predicate-type', async () => {
|
||||
const inputs: RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
predicate: '{}',
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
await run(inputs)
|
||||
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'predicate-type is required when using predicate or predicate-path'
|
||||
)
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when custom attestation inputs are provided', () => {
|
||||
const inputs: RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
predicateType,
|
||||
predicate,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
beforeEach(async () => {
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
})
|
||||
await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
|
||||
})
|
||||
|
||||
it('logs the attestation type as Custom', async () => {
|
||||
await run(inputs)
|
||||
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when provenance attestation is detected', () => {
|
||||
const inputs: RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
const mockProvPredicate = {
|
||||
type: 'https://slsa.dev/provenance/v1',
|
||||
params: { buildDefinition: {}, runDetails: {} }
|
||||
}
|
||||
|
||||
beforeEach(async () => {
|
||||
// Configure mock for provenance predicate
|
||||
generateProvenancePredicateMock.mockResolvedValue(mockProvPredicate)
|
||||
|
||||
// Configure mock for createAttestation
|
||||
createAttestationMock.mockResolvedValue({
|
||||
attestationID: '1234567890',
|
||||
certificate:
|
||||
'-----BEGIN CERTIFICATE-----\ntest\n-----END CERTIFICATE-----',
|
||||
tlogID: 'tlog-123',
|
||||
attestationDigest: 'sha256:123456',
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' }
|
||||
})
|
||||
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
})
|
||||
await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
|
||||
})
|
||||
|
||||
it('logs the attestation type as Build Provenance and generates predicate', async () => {
|
||||
await run(inputs)
|
||||
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith(
|
||||
'Attestation type: Build Provenance'
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom attestation is detected', () => {
|
||||
let tmpDir: string
|
||||
let sbomFilePath: string
|
||||
|
||||
const spdxSBOM = {
|
||||
spdxVersion: 'SPDX-2.3',
|
||||
SPDXID: 'SPDXRef-DOCUMENT',
|
||||
name: 'test-package',
|
||||
packages: []
|
||||
}
|
||||
|
||||
beforeEach(async () => {
|
||||
tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'main-test-'))
|
||||
sbomFilePath = path.join(tmpDir, 'sbom.spdx.json')
|
||||
await fs.writeFile(sbomFilePath, JSON.stringify(spdxSBOM))
|
||||
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
})
|
||||
await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
|
||||
})
|
||||
|
||||
afterEach(async () => {
|
||||
await fs.rm(tmpDir, { recursive: true })
|
||||
})
|
||||
|
||||
it('logs the attestation type as SBOM and generates predicate', async () => {
|
||||
const inputs: RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
sbomPath: sbomFilePath,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
await run(inputs)
|
||||
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith('Attestation type: SBOM')
|
||||
})
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
// Helper to update the mock context
|
||||
function setGHContext(context: {
|
||||
repo?: { owner: string; repo: string }
|
||||
payload?: { repository?: { visibility: string } }
|
||||
}): void {
|
||||
if (context.repo) {
|
||||
mockContext.repo = context.repo
|
||||
}
|
||||
if (context.payload) {
|
||||
mockContext.payload = context.payload as typeof mockContext.payload
|
||||
}
|
||||
// Stubbing the GitHub context is a bit tricky. We need to use
|
||||
// `Object.defineProperty` because `github.context` is read-only.
|
||||
function setGHContext(context: object): void {
|
||||
Object.defineProperty(github, 'context', { value: context })
|
||||
}
|
||||
|
||||
+14
-18
@@ -11,35 +11,33 @@ describe('subjectFromInputs', () => {
|
||||
}
|
||||
|
||||
describe('when no inputs are provided', () => {
|
||||
it('throws an error', async () => {
|
||||
await expect(predicateFromInputs(blankInputs)).rejects.toThrow(
|
||||
/predicate-type/i
|
||||
)
|
||||
it('throws an error', () => {
|
||||
expect(() => predicateFromInputs(blankInputs)).toThrow(/predicate-type/i)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when neither predicate path nor predicate are provided', () => {
|
||||
it('throws an error', async () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: PredicateInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
|
||||
await expect(predicateFromInputs(inputs)).rejects.toThrow(
|
||||
expect(() => predicateFromInputs(inputs)).toThrow(
|
||||
/one of predicate-path or predicate must be provided/i
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when both predicate path and predicate are provided', () => {
|
||||
it('throws an error', async () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: PredicateInputs = {
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicate: '{}',
|
||||
predicatePath: 'path/to/predicate'
|
||||
}
|
||||
|
||||
await expect(predicateFromInputs(inputs)).rejects.toThrow(
|
||||
expect(() => predicateFromInputs(inputs)).toThrow(
|
||||
/only one of predicate-path or predicate may be provided/i
|
||||
)
|
||||
})
|
||||
@@ -67,13 +65,13 @@ describe('subjectFromInputs', () => {
|
||||
await fs.rm(path.parse(predicatePath).dir, { recursive: true })
|
||||
})
|
||||
|
||||
it('returns the predicate', async () => {
|
||||
it('returns the predicate', () => {
|
||||
const inputs: PredicateInputs = {
|
||||
...blankInputs,
|
||||
predicateType,
|
||||
predicatePath
|
||||
}
|
||||
await expect(predicateFromInputs(inputs)).resolves.toEqual({
|
||||
expect(predicateFromInputs(inputs)).toEqual({
|
||||
type: predicateType,
|
||||
params: JSON.parse(content)
|
||||
})
|
||||
@@ -84,15 +82,13 @@ describe('subjectFromInputs', () => {
|
||||
const predicateType = 'https://example.com/predicate'
|
||||
const predicatePath = 'foo'
|
||||
|
||||
it('returns the predicate', async () => {
|
||||
it('returns the predicate', () => {
|
||||
const inputs: PredicateInputs = {
|
||||
...blankInputs,
|
||||
predicateType,
|
||||
predicatePath
|
||||
}
|
||||
await expect(predicateFromInputs(inputs)).rejects.toThrow(
|
||||
/file not found/
|
||||
)
|
||||
expect(() => predicateFromInputs(inputs)).toThrow(/file not found/)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -100,14 +96,14 @@ describe('subjectFromInputs', () => {
|
||||
const predicateType = 'https://example.com/predicate'
|
||||
const content = '{}'
|
||||
|
||||
it('returns the predicate', async () => {
|
||||
it('returns the predicate', () => {
|
||||
const inputs: PredicateInputs = {
|
||||
...blankInputs,
|
||||
predicateType,
|
||||
predicate: content
|
||||
}
|
||||
|
||||
await expect(predicateFromInputs(inputs)).resolves.toEqual({
|
||||
expect(predicateFromInputs(inputs)).toEqual({
|
||||
type: predicateType,
|
||||
params: JSON.parse(content)
|
||||
})
|
||||
@@ -118,14 +114,14 @@ describe('subjectFromInputs', () => {
|
||||
const predicateType = 'https://example.com/predicate'
|
||||
const content = JSON.stringify({ a: 'a'.repeat(16 * 1024 * 1024) })
|
||||
|
||||
it('throws an error', async () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: PredicateInputs = {
|
||||
...blankInputs,
|
||||
predicateType,
|
||||
predicate: content
|
||||
}
|
||||
|
||||
await expect(predicateFromInputs(inputs)).rejects.toThrow(
|
||||
expect(() => predicateFromInputs(inputs)).toThrow(
|
||||
/predicate string exceeds maximum/
|
||||
)
|
||||
})
|
||||
|
||||
@@ -1,48 +0,0 @@
|
||||
import type { Predicate } from '@actions/attest'
|
||||
import { jest } from '@jest/globals'
|
||||
|
||||
// Mock function
|
||||
const mockBuildSLSAProvenancePredicate = jest.fn<() => Promise<Predicate>>()
|
||||
|
||||
// Mock @actions/attest
|
||||
jest.unstable_mockModule('@actions/attest', () => ({
|
||||
buildSLSAProvenancePredicate: mockBuildSLSAProvenancePredicate
|
||||
}))
|
||||
|
||||
// Dynamic import after mocking
|
||||
const { generateProvenancePredicate } = await import('../src/provenance')
|
||||
|
||||
describe('generateProvenancePredicate', () => {
|
||||
const mockPredicate = {
|
||||
type: 'https://slsa.dev/provenance/v1',
|
||||
params: {
|
||||
buildDefinition: {
|
||||
buildType: 'https://actions.github.io/buildtypes/workflow/v1'
|
||||
},
|
||||
runDetails: {
|
||||
builder: { id: 'https://github.com/actions/runner' }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
mockBuildSLSAProvenancePredicate.mockResolvedValue(mockPredicate)
|
||||
})
|
||||
|
||||
it('returns the SLSA provenance predicate', async () => {
|
||||
const result = await generateProvenancePredicate()
|
||||
|
||||
expect(mockBuildSLSAProvenancePredicate).toHaveBeenCalledTimes(1)
|
||||
expect(result).toEqual(mockPredicate)
|
||||
})
|
||||
|
||||
it('propagates errors from buildSLSAProvenancePredicate', async () => {
|
||||
const error = new Error('Failed to build provenance')
|
||||
mockBuildSLSAProvenancePredicate.mockRejectedValue(error)
|
||||
|
||||
await expect(generateProvenancePredicate()).rejects.toThrow(
|
||||
'Failed to build provenance'
|
||||
)
|
||||
})
|
||||
})
|
||||
@@ -1,161 +0,0 @@
|
||||
import fs from 'fs/promises'
|
||||
import os from 'os'
|
||||
import path from 'path'
|
||||
import { parseSBOMFromPath, generateSBOMPredicate, SBOM } from '../src/sbom'
|
||||
|
||||
describe('parseSBOMFromPath', () => {
|
||||
let tmpDir: string
|
||||
|
||||
beforeEach(async () => {
|
||||
tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sbom-test-'))
|
||||
})
|
||||
|
||||
afterEach(async () => {
|
||||
await fs.rm(tmpDir, { recursive: true })
|
||||
})
|
||||
|
||||
describe('when file does not exist', () => {
|
||||
it('throws an error', async () => {
|
||||
await expect(parseSBOMFromPath('/nonexistent/file.json')).rejects.toThrow(
|
||||
/ENOENT/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains valid SPDX SBOM', () => {
|
||||
const spdxSBOM = {
|
||||
spdxVersion: 'SPDX-2.3',
|
||||
SPDXID: 'SPDXRef-DOCUMENT',
|
||||
name: 'test-package',
|
||||
packages: []
|
||||
}
|
||||
|
||||
it('returns SBOM with type spdx', async () => {
|
||||
const filePath = path.join(tmpDir, 'sbom.spdx.json')
|
||||
await fs.writeFile(filePath, JSON.stringify(spdxSBOM))
|
||||
|
||||
const result = await parseSBOMFromPath(filePath)
|
||||
|
||||
expect(result.type).toBe('spdx')
|
||||
expect(result.object).toEqual(spdxSBOM)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains valid CycloneDX SBOM', () => {
|
||||
const cyclonedxSBOM = {
|
||||
bomFormat: 'CycloneDX',
|
||||
specVersion: '1.4',
|
||||
serialNumber: 'urn:uuid:12345',
|
||||
components: []
|
||||
}
|
||||
|
||||
it('returns SBOM with type cyclonedx', async () => {
|
||||
const filePath = path.join(tmpDir, 'sbom.cdx.json')
|
||||
await fs.writeFile(filePath, JSON.stringify(cyclonedxSBOM))
|
||||
|
||||
const result = await parseSBOMFromPath(filePath)
|
||||
|
||||
expect(result.type).toBe('cyclonedx')
|
||||
expect(result.object).toEqual(cyclonedxSBOM)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains invalid SBOM format', () => {
|
||||
it('throws an error', async () => {
|
||||
const filePath = path.join(tmpDir, 'invalid.json')
|
||||
await fs.writeFile(filePath, JSON.stringify({ random: 'data' }))
|
||||
|
||||
await expect(parseSBOMFromPath(filePath)).rejects.toThrow(
|
||||
/Unsupported SBOM format/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains invalid JSON', () => {
|
||||
it('throws an error', async () => {
|
||||
const filePath = path.join(tmpDir, 'invalid.json')
|
||||
await fs.writeFile(filePath, 'not valid json')
|
||||
|
||||
await expect(parseSBOMFromPath(filePath)).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file exceeds maximum size', () => {
|
||||
it('throws an error', async () => {
|
||||
const filePath = path.join(tmpDir, 'large.json')
|
||||
// Create a file larger than 16MB
|
||||
const largeContent = 'x'.repeat(17 * 1024 * 1024)
|
||||
await fs.writeFile(filePath, largeContent)
|
||||
|
||||
await expect(parseSBOMFromPath(filePath)).rejects.toThrow(
|
||||
/SBOM file exceeds maximum allowed size/
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('generateSBOMPredicate', () => {
|
||||
describe('for SPDX SBOM', () => {
|
||||
const spdxSBOM: SBOM = {
|
||||
type: 'spdx',
|
||||
object: {
|
||||
spdxVersion: 'SPDX-2.3',
|
||||
SPDXID: 'SPDXRef-DOCUMENT',
|
||||
name: 'test-package'
|
||||
}
|
||||
}
|
||||
|
||||
it('returns predicate with correct SPDX type', () => {
|
||||
const predicate = generateSBOMPredicate(spdxSBOM)
|
||||
|
||||
expect(predicate.type).toBe('https://spdx.dev/Document/v2.3')
|
||||
expect(predicate.params).toEqual(spdxSBOM.object)
|
||||
})
|
||||
})
|
||||
|
||||
describe('for CycloneDX SBOM', () => {
|
||||
const cyclonedxSBOM: SBOM = {
|
||||
type: 'cyclonedx',
|
||||
object: {
|
||||
bomFormat: 'CycloneDX',
|
||||
specVersion: '1.4',
|
||||
serialNumber: 'urn:uuid:12345'
|
||||
}
|
||||
}
|
||||
|
||||
it('returns predicate with correct CycloneDX type', () => {
|
||||
const predicate = generateSBOMPredicate(cyclonedxSBOM)
|
||||
|
||||
expect(predicate.type).toBe('https://cyclonedx.org/bom')
|
||||
expect(predicate.params).toEqual(cyclonedxSBOM.object)
|
||||
})
|
||||
})
|
||||
|
||||
describe('for SPDX without version', () => {
|
||||
const invalidSBOM: SBOM = {
|
||||
type: 'spdx',
|
||||
object: {
|
||||
SPDXID: 'SPDXRef-DOCUMENT'
|
||||
}
|
||||
}
|
||||
|
||||
it('throws an error', () => {
|
||||
expect(() => generateSBOMPredicate(invalidSBOM)).toThrow(
|
||||
/Cannot find spdxVersion/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('for unsupported SBOM type', () => {
|
||||
const unsupportedSBOM = {
|
||||
type: 'unknown' as SBOM['type'],
|
||||
object: { foo: 'bar' }
|
||||
}
|
||||
|
||||
it('throws an error', () => {
|
||||
expect(() => generateSBOMPredicate(unsupportedSBOM)).toThrow(
|
||||
/Unsupported SBOM format/
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -473,13 +473,6 @@ badline
|
||||
'187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d'
|
||||
}
|
||||
})
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_darwin_arm64',
|
||||
digest: {
|
||||
sha512:
|
||||
'5d8b4751ef31f9440d843fcfa4e53ca2e25b1cb1f13fd355fdc7c24b41fe645293291ea9297ba3989078abb77ebbaac66be073618a9e4974dbd0361881d4c718'
|
||||
}
|
||||
})
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -487,8 +480,8 @@ badline
|
||||
describe('when specifying a subject checksums string', () => {
|
||||
const checksums = `
|
||||
f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_linux_386
|
||||
187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d *demo_0.0.1_linux_amd64
|
||||
9ecbf449e286a8a8748c161c52aa28b6b2fc64ab86f94161c5d1b3abc18156c5 demo_0.0.1_linux_arm64`
|
||||
187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d demo_0.0.1_linux_amd64
|
||||
9ecbf449e286a8a8748c161c52aa28b6b2fc64ab86f94161c5d1b3abc18156c5 demo_0.0.1_linux_arm64`
|
||||
|
||||
it('returns the multiple subjects', async () => {
|
||||
const inputs: SubjectInputs = {
|
||||
@@ -507,53 +500,6 @@ f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_lin
|
||||
'f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e'
|
||||
}
|
||||
})
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_linux_amd64',
|
||||
digest: {
|
||||
sha256:
|
||||
'187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d'
|
||||
}
|
||||
})
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_linux_arm64',
|
||||
digest: {
|
||||
sha256:
|
||||
'9ecbf449e286a8a8748c161c52aa28b6b2fc64ab86f94161c5d1b3abc18156c5'
|
||||
}
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('when specifying a subject checksums string with duplicates', () => {
|
||||
const checksums = `
|
||||
f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_linux_386
|
||||
f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_linux_386
|
||||
187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d *demo_0.0.1_linux_amd64`
|
||||
|
||||
it('returns de-duplicated subjects', async () => {
|
||||
const inputs: SubjectInputs = {
|
||||
...blankInputs,
|
||||
subjectChecksums: checksums
|
||||
}
|
||||
const subjects = await subjectFromInputs(inputs)
|
||||
|
||||
expect(subjects).toBeDefined()
|
||||
expect(subjects).toHaveLength(2)
|
||||
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_linux_386',
|
||||
digest: {
|
||||
sha256:
|
||||
'f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e'
|
||||
}
|
||||
})
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_linux_amd64',
|
||||
digest: {
|
||||
sha256:
|
||||
'187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d'
|
||||
}
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
|
||||
+5
-21
@@ -30,29 +30,21 @@ inputs:
|
||||
attestation. Must specify exactly one of "subject-path", "subject-digest",
|
||||
or "subject-checksums".
|
||||
required: false
|
||||
sbom-path:
|
||||
description: >
|
||||
Path to the JSON-formatted SBOM file (SPDX or CycloneDX) to attest.
|
||||
File size cannot exceed 16MB. When provided, creates an SBOM attestation.
|
||||
Cannot be used together with "predicate-type", "predicate", or
|
||||
"predicate-path".
|
||||
required: false
|
||||
predicate-type:
|
||||
description: >
|
||||
URI identifying the type of the predicate. Required when using "predicate"
|
||||
or "predicate-path" for custom attestations.
|
||||
required: false
|
||||
URI identifying the type of the predicate.
|
||||
required: true
|
||||
predicate:
|
||||
description: >
|
||||
String containing the value for the attestation predicate. String length
|
||||
cannot exceed 16MB. Must supply exactly one of "predicate-path" or
|
||||
"predicate" when creating custom attestations.
|
||||
"predicate".
|
||||
required: false
|
||||
predicate-path:
|
||||
description: >
|
||||
Path to the file which contains the content for the attestation predicate.
|
||||
File size cannot exceed 16MB. Must supply exactly one of "predicate-path"
|
||||
or "predicate" when creating custom attestations.
|
||||
or "predicate".
|
||||
required: false
|
||||
push-to-registry:
|
||||
description: >
|
||||
@@ -61,12 +53,6 @@ inputs:
|
||||
the "subject-digest" parameter be specified. Defaults to false.
|
||||
default: false
|
||||
required: false
|
||||
create-storage-record:
|
||||
description: >
|
||||
Whether to create a storage record for the artifact.
|
||||
Requires that push-to-registry is set to true. Defaults to true.
|
||||
default: true
|
||||
required: false
|
||||
show-summary:
|
||||
description: >
|
||||
Whether to attach a list of generated attestations to the workflow run
|
||||
@@ -85,9 +71,7 @@ outputs:
|
||||
description: 'The ID of the attestation.'
|
||||
attestation-url:
|
||||
description: 'The URL for the attestation summary.'
|
||||
storage-record-ids:
|
||||
description: 'The IDs of the storage records created for the artifact.'
|
||||
|
||||
runs:
|
||||
using: node24
|
||||
using: node20
|
||||
main: ./dist/index.js
|
||||
|
||||
+14
-26
@@ -1,6 +1,7 @@
|
||||
export const id = 606;
|
||||
export const ids = [606];
|
||||
export const modules = {
|
||||
"use strict";
|
||||
exports.id = 606;
|
||||
exports.ids = [606];
|
||||
exports.modules = {
|
||||
|
||||
/***/ 606:
|
||||
/***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
|
||||
@@ -18,7 +19,7 @@ async function pMap(
|
||||
signal,
|
||||
} = {},
|
||||
) {
|
||||
return new Promise((resolve_, reject_) => {
|
||||
return new Promise((resolve, reject_) => {
|
||||
if (iterable[Symbol.iterator] === undefined && iterable[Symbol.asyncIterator] === undefined) {
|
||||
throw new TypeError(`Expected \`input\` to be either an \`Iterable\` or \`AsyncIterable\`, got (${typeof iterable})`);
|
||||
}
|
||||
@@ -41,24 +42,10 @@ async function pMap(
|
||||
let currentIndex = 0;
|
||||
const iterator = iterable[Symbol.iterator] === undefined ? iterable[Symbol.asyncIterator]() : iterable[Symbol.iterator]();
|
||||
|
||||
const signalListener = () => {
|
||||
reject(signal.reason);
|
||||
};
|
||||
|
||||
const cleanup = () => {
|
||||
signal?.removeEventListener('abort', signalListener);
|
||||
};
|
||||
|
||||
const resolve = value => {
|
||||
resolve_(value);
|
||||
cleanup();
|
||||
};
|
||||
|
||||
const reject = reason => {
|
||||
isRejected = true;
|
||||
isResolved = true;
|
||||
reject_(reason);
|
||||
cleanup();
|
||||
};
|
||||
|
||||
if (signal) {
|
||||
@@ -66,7 +53,9 @@ async function pMap(
|
||||
reject(signal.reason);
|
||||
}
|
||||
|
||||
signal.addEventListener('abort', signalListener, {once: true});
|
||||
signal.addEventListener('abort', () => {
|
||||
reject(signal.reason);
|
||||
});
|
||||
}
|
||||
|
||||
const next = async () => {
|
||||
@@ -214,32 +203,31 @@ function pMapIterable(
|
||||
const iterator = iterable[Symbol.asyncIterator] === undefined ? iterable[Symbol.iterator]() : iterable[Symbol.asyncIterator]();
|
||||
|
||||
const promises = [];
|
||||
let pendingPromisesCount = 0;
|
||||
let runningMappersCount = 0;
|
||||
let isDone = false;
|
||||
let index = 0;
|
||||
|
||||
function trySpawn() {
|
||||
if (isDone || !(pendingPromisesCount < concurrency && promises.length < backpressure)) {
|
||||
if (isDone || !(runningMappersCount < concurrency && promises.length < backpressure)) {
|
||||
return;
|
||||
}
|
||||
|
||||
pendingPromisesCount++;
|
||||
|
||||
const promise = (async () => {
|
||||
const {done, value} = await iterator.next();
|
||||
|
||||
if (done) {
|
||||
pendingPromisesCount--;
|
||||
return {done: true};
|
||||
}
|
||||
|
||||
runningMappersCount++;
|
||||
|
||||
// Spawn if still below concurrency and backpressure limit
|
||||
trySpawn();
|
||||
|
||||
try {
|
||||
const returnValue = await mapper(await value, index++);
|
||||
|
||||
pendingPromisesCount--;
|
||||
runningMappersCount--;
|
||||
|
||||
if (returnValue === pMapSkip) {
|
||||
const index = promises.indexOf(promise);
|
||||
@@ -254,7 +242,6 @@ function pMapIterable(
|
||||
|
||||
return {done: false, value: returnValue};
|
||||
} catch (error) {
|
||||
pendingPromisesCount--;
|
||||
isDone = true;
|
||||
return {error};
|
||||
}
|
||||
@@ -297,3 +284,4 @@ const pMapSkip = Symbol('skip');
|
||||
/***/ })
|
||||
|
||||
};
|
||||
;
|
||||
+45590
-80046
File diff suppressed because one or more lines are too long
-3
@@ -1,3 +0,0 @@
|
||||
{
|
||||
"type": "module"
|
||||
}
|
||||
@@ -1,3 +1 @@
|
||||
import { jest } from '@jest/globals'
|
||||
|
||||
process.stdout.write = jest.fn()
|
||||
|
||||
Generated
+8628
-4262
File diff suppressed because it is too large
Load Diff
+29
-39
@@ -1,10 +1,9 @@
|
||||
{
|
||||
"name": "actions/attest",
|
||||
"description": "Generate signed attestations for workflow artifacts",
|
||||
"version": "3.2.0",
|
||||
"version": "2.2.1",
|
||||
"author": "",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"homepage": "https://github.com/actions/attest",
|
||||
"repository": {
|
||||
"type": "git",
|
||||
@@ -21,27 +20,24 @@
|
||||
".": "./dist/index.js"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=24"
|
||||
"node": ">=20"
|
||||
},
|
||||
"scripts": {
|
||||
"bundle": "npm run format:write && npm run package",
|
||||
"ci-test": "NODE_OPTIONS='--experimental-vm-modules' jest",
|
||||
"ci-test": "jest",
|
||||
"format:write": "prettier --write **/*.ts",
|
||||
"format:check": "prettier --check **/*.ts",
|
||||
"lint:eslint": "npx eslint",
|
||||
"lint:markdown": "npx markdownlint --config .markdown-lint.yml \"*.md\"",
|
||||
"lint:eslint": "npx eslint . -c ./.github/linters/eslint.config.mjs",
|
||||
"lint:markdown": "npx markdownlint --config .github/linters/.markdown-lint.yml \"*.md\"",
|
||||
"lint": "npm run lint:eslint && npm run lint:markdown",
|
||||
"package": "ncc build src/index.ts --license licenses.txt",
|
||||
"package:watch": "npm run package -- --watch",
|
||||
"test": "NODE_OPTIONS='--experimental-vm-modules' jest",
|
||||
"test": "jest",
|
||||
"all": "npm run format:write && npm run lint && npm run test && npm run package"
|
||||
},
|
||||
"license": "MIT",
|
||||
"jest": {
|
||||
"preset": "ts-jest/presets/default-esm",
|
||||
"extensionsToTreatAsEsm": [
|
||||
".ts"
|
||||
],
|
||||
"preset": "ts-jest",
|
||||
"setupFilesAfterEnv": [
|
||||
"./jest.setup.js"
|
||||
],
|
||||
@@ -60,12 +56,7 @@
|
||||
"/dist/"
|
||||
],
|
||||
"transform": {
|
||||
"^.+\\.ts$": [
|
||||
"ts-jest",
|
||||
{
|
||||
"useESM": true
|
||||
}
|
||||
]
|
||||
"^.+\\.ts$": "ts-jest"
|
||||
},
|
||||
"coverageReporters": [
|
||||
"json-summary",
|
||||
@@ -78,32 +69,31 @@
|
||||
]
|
||||
},
|
||||
"dependencies": {
|
||||
"@actions/attest": "^3.0.0",
|
||||
"@actions/core": "^3.0.0",
|
||||
"@actions/github": "^9.0.0",
|
||||
"@actions/glob": "^0.6.1",
|
||||
"@sigstore/oci": "^0.6.0",
|
||||
"@actions/attest": "^1.6.0",
|
||||
"@actions/core": "^1.11.1",
|
||||
"@actions/github": "^6.0.0",
|
||||
"@actions/glob": "^0.5.0",
|
||||
"@sigstore/oci": "^0.4.0",
|
||||
"csv-parse": "^5.6.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@eslint/js": "^9.39.2",
|
||||
"@jest/globals": "^30.2.0",
|
||||
"@sigstore/mock": "^0.11.0",
|
||||
"@types/jest": "^30.0.0",
|
||||
"@eslint/js": "^9.23.0",
|
||||
"@sigstore/mock": "^0.10.0",
|
||||
"@types/jest": "^29.5.14",
|
||||
"@types/make-fetch-happen": "^10.0.4",
|
||||
"@types/node": "^25.2.0",
|
||||
"@vercel/ncc": "^0.38.4",
|
||||
"eslint": "^9.39.2",
|
||||
"eslint-plugin-import": "^2.32.0",
|
||||
"eslint-plugin-jest": "^29.12.1",
|
||||
"jest": "^30.2.0",
|
||||
"js-yaml": "^4.1.1",
|
||||
"markdownlint-cli": "^0.47.0",
|
||||
"@types/node": "^22.13.14",
|
||||
"@vercel/ncc": "^0.38.3",
|
||||
"eslint": "^9.23.0",
|
||||
"eslint-plugin-import": "^2.31.0",
|
||||
"eslint-plugin-jest": "^28.11.0",
|
||||
"jest": "^29.7.0",
|
||||
"js-yaml": "^4.1.0",
|
||||
"markdownlint-cli": "^0.44.0",
|
||||
"nock": "^13.5.6",
|
||||
"prettier": "^3.8.1",
|
||||
"ts-jest": "^29.4.6",
|
||||
"typescript": "^5.9.3",
|
||||
"typescript-eslint": "^8.54.0",
|
||||
"undici": "^7.20.0"
|
||||
"prettier": "^3.5.3",
|
||||
"ts-jest": "^29.3.1",
|
||||
"typescript": "^5.8.2",
|
||||
"typescript-eslint": "^8.29.0",
|
||||
"undici": "^5.28.5"
|
||||
}
|
||||
}
|
||||
|
||||
+4
-84
@@ -1,12 +1,4 @@
|
||||
import {
|
||||
Attestation,
|
||||
Predicate,
|
||||
Subject,
|
||||
attest,
|
||||
createStorageRecord
|
||||
} from '@actions/attest'
|
||||
import * as core from '@actions/core'
|
||||
import * as github from '@actions/github'
|
||||
import { Attestation, Predicate, Subject, attest } from '@actions/attest'
|
||||
import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
|
||||
import { formatSubjectDigest } from './subject'
|
||||
|
||||
@@ -16,7 +8,6 @@ const OCI_RETRY = 3
|
||||
export type SigstoreInstance = 'public-good' | 'github'
|
||||
export type AttestResult = Attestation & {
|
||||
attestationDigest?: string
|
||||
storageRecordIds?: number[]
|
||||
}
|
||||
|
||||
export const createAttestation = async (
|
||||
@@ -25,8 +16,8 @@ export const createAttestation = async (
|
||||
opts: {
|
||||
sigstoreInstance: SigstoreInstance
|
||||
pushToRegistry: boolean
|
||||
createStorageRecord: boolean
|
||||
githubToken: string
|
||||
ociCompatMode: boolean
|
||||
}
|
||||
): Promise<AttestResult> => {
|
||||
// Sign provenance w/ Sigstore
|
||||
@@ -43,94 +34,23 @@ export const createAttestation = async (
|
||||
if (subjects.length === 1 && opts.pushToRegistry) {
|
||||
const subject = subjects[0]
|
||||
const credentials = getRegistryCredentials(subject.name)
|
||||
const subjectDigest = formatSubjectDigest(subject)
|
||||
const artifact = await attachArtifactToImage({
|
||||
credentials,
|
||||
imageName: subject.name,
|
||||
imageDigest: subjectDigest,
|
||||
imageDigest: formatSubjectDigest(subject),
|
||||
artifact: Buffer.from(JSON.stringify(attestation.bundle)),
|
||||
mediaType: attestation.bundle.mediaType,
|
||||
annotations: {
|
||||
'dev.sigstore.bundle.content': 'dsse-envelope',
|
||||
'dev.sigstore.bundle.predicateType': predicate.type
|
||||
},
|
||||
compatibility: opts.ociCompatMode,
|
||||
fetchOpts: { timeout: OCI_TIMEOUT, retry: OCI_RETRY }
|
||||
})
|
||||
|
||||
// Add the attestation's digest to the result
|
||||
result.attestationDigest = artifact.digest
|
||||
|
||||
// Because creating a storage record requires the 'artifact-metadata:write'
|
||||
// permission, we wrap this in a try/catch to avoid failing the entire
|
||||
// attestation process if the token does not have the correct permissions.
|
||||
if (opts.createStorageRecord) {
|
||||
try {
|
||||
const token = opts.githubToken
|
||||
const isOrg = await repoOwnerIsOrg(token)
|
||||
if (!isOrg) {
|
||||
// The Artifact Metadata Storage Record API is only available to
|
||||
// organizations. So if the repo owner is not an organization,
|
||||
// storage record creation should not be attempted.
|
||||
return result
|
||||
}
|
||||
|
||||
const registryUrl = getRegistryURL(subject.name)
|
||||
const artifactOpts = {
|
||||
name: subject.name,
|
||||
digest: subjectDigest
|
||||
}
|
||||
const packageRegistryOpts = {
|
||||
registryUrl
|
||||
}
|
||||
const records = await createStorageRecord(
|
||||
artifactOpts,
|
||||
packageRegistryOpts,
|
||||
token
|
||||
)
|
||||
|
||||
if (!records || records.length === 0) {
|
||||
core.warning('No storage records were created.')
|
||||
}
|
||||
|
||||
result.storageRecordIds = records
|
||||
} catch (error) {
|
||||
core.warning(`Failed to create storage record: ${error}`)
|
||||
core.warning(
|
||||
'Please check that the "artifact-metadata:write" permission has been included'
|
||||
)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return result
|
||||
}
|
||||
|
||||
// Call the GET /repos/{owner}/{repo} endpoint to determine if the repo
|
||||
// owner is an organization. This is used to determine if storage
|
||||
// record creation should be attempted.
|
||||
export const repoOwnerIsOrg = async (githubToken: string): Promise<boolean> => {
|
||||
const octokit = github.getOctokit(githubToken)
|
||||
const { data: repo } = await octokit.rest.repos.get({
|
||||
owner: github.context.repo.owner,
|
||||
repo: github.context.repo.repo
|
||||
})
|
||||
return repo.owner?.type === 'Organization'
|
||||
}
|
||||
|
||||
function getRegistryURL(subjectName: string): string {
|
||||
let url: URL
|
||||
|
||||
try {
|
||||
url = new URL(subjectName)
|
||||
} catch {
|
||||
url = new URL(`https://${subjectName}`)
|
||||
}
|
||||
|
||||
if (url.protocol !== 'https:') {
|
||||
throw new Error(
|
||||
`Unsupported protocol ${url.protocol} in subject name ${subjectName}`
|
||||
)
|
||||
}
|
||||
|
||||
return url.origin
|
||||
}
|
||||
|
||||
@@ -1,45 +0,0 @@
|
||||
export type AttestationType = 'provenance' | 'sbom' | 'custom'
|
||||
|
||||
export type DetectionInputs = {
|
||||
sbomPath: string
|
||||
predicateType: string
|
||||
predicate: string
|
||||
predicatePath: string
|
||||
}
|
||||
|
||||
export const detectAttestationType = (
|
||||
inputs: DetectionInputs
|
||||
): AttestationType => {
|
||||
const { sbomPath, predicateType, predicate, predicatePath } = inputs
|
||||
|
||||
// SBOM mode takes priority
|
||||
if (sbomPath) {
|
||||
return 'sbom'
|
||||
}
|
||||
|
||||
// Custom mode when any predicate inputs are provided
|
||||
if (predicateType || predicate || predicatePath) {
|
||||
return 'custom'
|
||||
}
|
||||
|
||||
// Default to provenance mode
|
||||
return 'provenance'
|
||||
}
|
||||
|
||||
export const validateAttestationInputs = (inputs: DetectionInputs): void => {
|
||||
const { sbomPath, predicateType, predicate, predicatePath } = inputs
|
||||
|
||||
// Cannot combine sbom-path with predicate inputs
|
||||
if (sbomPath && (predicateType || predicate || predicatePath)) {
|
||||
throw new Error(
|
||||
'Cannot specify sbom-path together with predicate-type, predicate, or predicate-path'
|
||||
)
|
||||
}
|
||||
|
||||
// Custom mode requires predicate-type
|
||||
if ((predicate || predicatePath) && !predicateType) {
|
||||
throw new Error(
|
||||
'predicate-type is required when using predicate or predicate-path'
|
||||
)
|
||||
}
|
||||
}
|
||||
+3
-2
@@ -9,17 +9,18 @@ const inputs: RunInputs = {
|
||||
subjectName: core.getInput('subject-name'),
|
||||
subjectDigest: core.getInput('subject-digest'),
|
||||
subjectChecksums: core.getInput('subject-checksums'),
|
||||
sbomPath: core.getInput('sbom-path'),
|
||||
predicateType: core.getInput('predicate-type'),
|
||||
predicate: core.getInput('predicate'),
|
||||
predicatePath: core.getInput('predicate-path'),
|
||||
pushToRegistry: core.getBooleanInput('push-to-registry'),
|
||||
createStorageRecord: core.getBooleanInput('create-storage-record'),
|
||||
showSummary: core.getBooleanInput('show-summary'),
|
||||
githubToken: core.getInput('github-token'),
|
||||
// undocumented -- not part of public interface
|
||||
privateSigning: ['true', 'True', 'TRUE', '1'].includes(
|
||||
core.getInput('private-signing')
|
||||
),
|
||||
ociCompatMode: ['true', 'True', 'TRUE', '1'].includes(
|
||||
core.getInput('oci-compatibility-mode')
|
||||
)
|
||||
}
|
||||
|
||||
|
||||
+11
-93
@@ -1,19 +1,11 @@
|
||||
import * as core from '@actions/core'
|
||||
import * as github from '@actions/github'
|
||||
import fs from 'fs/promises'
|
||||
import fs from 'fs'
|
||||
import os from 'os'
|
||||
import path from 'path'
|
||||
import { AttestResult, SigstoreInstance, createAttestation } from './attest'
|
||||
import {
|
||||
AttestationType,
|
||||
DetectionInputs,
|
||||
detectAttestationType,
|
||||
validateAttestationInputs
|
||||
} from './detect'
|
||||
import { SEARCH_PUBLIC_GOOD_URL } from './endpoints'
|
||||
import { PredicateInputs, predicateFromInputs } from './predicate'
|
||||
import { generateProvenancePredicate } from './provenance'
|
||||
import { generateSBOMPredicate, parseSBOMFromPath } from './sbom'
|
||||
import * as style from './style'
|
||||
import {
|
||||
SubjectInputs,
|
||||
@@ -21,23 +13,17 @@ import {
|
||||
subjectFromInputs
|
||||
} from './subject'
|
||||
|
||||
import type { Predicate, Subject } from '@actions/attest'
|
||||
import type { Subject } from '@actions/attest'
|
||||
|
||||
const ATTESTATION_FILE_NAME = 'attestation.json'
|
||||
const ATTESTATION_PATHS_FILE_NAME = 'created_attestation_paths.txt'
|
||||
|
||||
export type SBOMInputs = {
|
||||
sbomPath: string
|
||||
}
|
||||
|
||||
export type RunInputs = SubjectInputs &
|
||||
PredicateInputs &
|
||||
SBOMInputs & {
|
||||
PredicateInputs & {
|
||||
pushToRegistry: boolean
|
||||
createStorageRecord: boolean
|
||||
githubToken: string
|
||||
showSummary: boolean
|
||||
privateSigning: boolean
|
||||
ociCompatMode: boolean
|
||||
}
|
||||
|
||||
/* istanbul ignore next */
|
||||
@@ -71,69 +57,35 @@ export async function run(inputs: RunInputs): Promise<void> {
|
||||
)
|
||||
}
|
||||
|
||||
// Detect attestation type and validate inputs
|
||||
const detectionInputs: DetectionInputs = {
|
||||
sbomPath: inputs.sbomPath,
|
||||
predicateType: inputs.predicateType,
|
||||
predicate: inputs.predicate,
|
||||
predicatePath: inputs.predicatePath
|
||||
}
|
||||
validateAttestationInputs(detectionInputs)
|
||||
const attestationType = detectAttestationType(detectionInputs)
|
||||
logAttestationType(attestationType)
|
||||
|
||||
const subjects = await subjectFromInputs({
|
||||
...inputs,
|
||||
downcaseName: inputs.pushToRegistry
|
||||
})
|
||||
const predicate = predicateFromInputs(inputs)
|
||||
|
||||
// Generate predicate based on attestation type
|
||||
const predicate = await getPredicateForType(attestationType, inputs)
|
||||
|
||||
const outputPath = path.join(await tempDir(), ATTESTATION_FILE_NAME)
|
||||
const outputPath = path.join(tempDir(), ATTESTATION_FILE_NAME)
|
||||
core.setOutput('bundle-path', outputPath)
|
||||
|
||||
const att = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance,
|
||||
pushToRegistry: inputs.pushToRegistry,
|
||||
createStorageRecord: inputs.createStorageRecord,
|
||||
githubToken: inputs.githubToken
|
||||
githubToken: inputs.githubToken,
|
||||
ociCompatMode: inputs.ociCompatMode
|
||||
})
|
||||
|
||||
logAttestation(subjects, att, sigstoreInstance)
|
||||
|
||||
// Write attestation bundle to output file
|
||||
await fs.writeFile(outputPath, JSON.stringify(att.bundle) + os.EOL, {
|
||||
fs.writeFileSync(outputPath, JSON.stringify(att.bundle) + os.EOL, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'a'
|
||||
})
|
||||
|
||||
const baseDir = process.env.RUNNER_TEMP
|
||||
/* istanbul ignore else */
|
||||
if (baseDir) {
|
||||
const outputSummaryPath = path.join(baseDir, ATTESTATION_PATHS_FILE_NAME)
|
||||
// Append the output path to the attestations paths file
|
||||
await fs.appendFile(outputSummaryPath, outputPath + os.EOL, {
|
||||
encoding: 'utf-8',
|
||||
flag: 'a'
|
||||
})
|
||||
} else {
|
||||
core.warning(
|
||||
'RUNNER_TEMP environment variable is not set. Cannot write attestation paths file.'
|
||||
)
|
||||
}
|
||||
|
||||
/* istanbul ignore else */
|
||||
if (att.attestationID) {
|
||||
core.setOutput('attestation-id', att.attestationID)
|
||||
core.setOutput('attestation-url', attestationURL(att.attestationID))
|
||||
}
|
||||
|
||||
if (att.storageRecordIds) {
|
||||
core.setOutput('storage-record-ids', att.storageRecordIds.join(','))
|
||||
}
|
||||
|
||||
/* istanbul ignore else */
|
||||
if (inputs.showSummary) {
|
||||
await logSummary(att)
|
||||
}
|
||||
@@ -191,7 +143,6 @@ const logAttestation = (
|
||||
core.info(`${SEARCH_PUBLIC_GOOD_URL}?logIndex=${attestation.tlogID}`)
|
||||
}
|
||||
|
||||
/* istanbul ignore else */
|
||||
if (attestation.attestationID) {
|
||||
core.info(style.highlight('Attestation uploaded to repository'))
|
||||
core.info(attestationURL(attestation.attestationID))
|
||||
@@ -201,18 +152,12 @@ const logAttestation = (
|
||||
core.info(style.highlight('Attestation uploaded to registry'))
|
||||
core.info(`${subjects[0].name}@${attestation.attestationDigest}`)
|
||||
}
|
||||
|
||||
if (attestation.storageRecordIds && attestation.storageRecordIds.length > 0) {
|
||||
core.info(style.highlight('Storage record created'))
|
||||
core.info(`Storage record IDs: ${attestation.storageRecordIds.join(',')}`)
|
||||
}
|
||||
}
|
||||
|
||||
// Attach summary information to the GitHub Actions run
|
||||
const logSummary = async (attestation: AttestResult): Promise<void> => {
|
||||
const { attestationID } = attestation
|
||||
|
||||
/* istanbul ignore else */
|
||||
if (attestationID) {
|
||||
const url = attestationURL(attestationID)
|
||||
core.summary.addHeading('Attestation Created', 3)
|
||||
@@ -221,7 +166,7 @@ const logSummary = async (attestation: AttestResult): Promise<void> => {
|
||||
}
|
||||
}
|
||||
|
||||
const tempDir = async (): Promise<string> => {
|
||||
const tempDir = (): string => {
|
||||
const basePath = process.env['RUNNER_TEMP']
|
||||
|
||||
/* istanbul ignore if */
|
||||
@@ -229,35 +174,8 @@ const tempDir = async (): Promise<string> => {
|
||||
throw new Error('Missing RUNNER_TEMP environment variable')
|
||||
}
|
||||
|
||||
return fs.mkdtemp(path.join(basePath, path.sep))
|
||||
return fs.mkdtempSync(path.join(basePath, path.sep))
|
||||
}
|
||||
|
||||
const attestationURL = (id: string): string =>
|
||||
`${github.context.serverUrl}/${github.context.repo.owner}/${github.context.repo.repo}/attestations/${id}`
|
||||
|
||||
// Log the detected attestation type
|
||||
const logAttestationType = (type: AttestationType): void => {
|
||||
const typeLabels: Record<AttestationType, string> = {
|
||||
provenance: 'Build Provenance',
|
||||
sbom: 'SBOM',
|
||||
custom: 'Custom'
|
||||
}
|
||||
core.info(`Attestation type: ${typeLabels[type]}`)
|
||||
}
|
||||
|
||||
// Generate predicate based on attestation type
|
||||
const getPredicateForType = async (
|
||||
type: AttestationType,
|
||||
inputs: RunInputs
|
||||
): Promise<Predicate> => {
|
||||
switch (type) {
|
||||
case 'provenance':
|
||||
return generateProvenancePredicate()
|
||||
case 'sbom': {
|
||||
const sbom = await parseSBOMFromPath(inputs.sbomPath)
|
||||
return generateSBOMPredicate(sbom)
|
||||
}
|
||||
case 'custom':
|
||||
return predicateFromInputs(inputs)
|
||||
}
|
||||
}
|
||||
|
||||
+5
-11
@@ -1,4 +1,4 @@
|
||||
import fs from 'fs/promises'
|
||||
import fs from 'fs'
|
||||
|
||||
import type { Predicate } from '@actions/attest'
|
||||
|
||||
@@ -12,9 +12,7 @@ const MAX_PREDICATE_SIZE_BYTES = 16 * 1024 * 1024
|
||||
|
||||
// Returns the predicate specified by the action's inputs. The predicate value
|
||||
// may be specified as a path to a file or as a string.
|
||||
export const predicateFromInputs = async (
|
||||
inputs: PredicateInputs
|
||||
): Promise<Predicate> => {
|
||||
export const predicateFromInputs = (inputs: PredicateInputs): Predicate => {
|
||||
const { predicateType, predicate, predicatePath } = inputs
|
||||
|
||||
if (!predicateType) {
|
||||
@@ -32,22 +30,18 @@ export const predicateFromInputs = async (
|
||||
let params: string = predicate
|
||||
|
||||
if (predicatePath) {
|
||||
try {
|
||||
await fs.access(predicatePath)
|
||||
} catch {
|
||||
if (!fs.existsSync(predicatePath)) {
|
||||
throw new Error(`predicate file not found: ${predicatePath}`)
|
||||
}
|
||||
|
||||
const stat = await fs.stat(predicatePath)
|
||||
|
||||
/* istanbul ignore next */
|
||||
if (stat.size > MAX_PREDICATE_SIZE_BYTES) {
|
||||
if (fs.statSync(predicatePath).size > MAX_PREDICATE_SIZE_BYTES) {
|
||||
throw new Error(
|
||||
`predicate file exceeds maximum allowed size: ${MAX_PREDICATE_SIZE_BYTES} bytes`
|
||||
)
|
||||
}
|
||||
|
||||
params = await fs.readFile(predicatePath, 'utf-8')
|
||||
params = fs.readFileSync(predicatePath, 'utf-8')
|
||||
} else {
|
||||
if (predicate.length > MAX_PREDICATE_SIZE_BYTES) {
|
||||
throw new Error(
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
import { buildSLSAProvenancePredicate } from '@actions/attest'
|
||||
|
||||
import type { Predicate } from '@actions/attest'
|
||||
|
||||
export const generateProvenancePredicate = async (): Promise<Predicate> => {
|
||||
return buildSLSAProvenancePredicate()
|
||||
}
|
||||
-87
@@ -1,87 +0,0 @@
|
||||
import fs from 'fs/promises'
|
||||
|
||||
import type { Predicate } from '@actions/attest'
|
||||
|
||||
export type SBOM = {
|
||||
type: 'spdx' | 'cyclonedx'
|
||||
object: object
|
||||
}
|
||||
|
||||
// SBOMs cannot exceed 16MB.
|
||||
const MAX_SBOM_SIZE_BYTES = 16 * 1024 * 1024
|
||||
|
||||
export const parseSBOMFromPath = async (filePath: string): Promise<SBOM> => {
|
||||
const fileContent = await fs.readFile(filePath, 'utf8')
|
||||
|
||||
const stats = await fs.stat(filePath)
|
||||
if (stats.size > MAX_SBOM_SIZE_BYTES) {
|
||||
throw new Error(
|
||||
`SBOM file exceeds maximum allowed size: ${MAX_SBOM_SIZE_BYTES} bytes`
|
||||
)
|
||||
}
|
||||
|
||||
const sbom = JSON.parse(fileContent) as object
|
||||
|
||||
if (checkIsSPDX(sbom)) {
|
||||
return { type: 'spdx', object: sbom }
|
||||
} else if (checkIsCycloneDX(sbom)) {
|
||||
return { type: 'cyclonedx', object: sbom }
|
||||
}
|
||||
|
||||
throw new Error(
|
||||
'Unsupported SBOM format. Must be valid SPDX or CycloneDX JSON.'
|
||||
)
|
||||
}
|
||||
|
||||
const checkIsSPDX = (sbomObject: {
|
||||
spdxVersion?: string
|
||||
SPDXID?: string
|
||||
}): boolean => {
|
||||
return !!(sbomObject?.spdxVersion && sbomObject?.SPDXID)
|
||||
}
|
||||
|
||||
const checkIsCycloneDX = (sbomObject: {
|
||||
bomFormat?: string
|
||||
serialNumber?: string
|
||||
specVersion?: string
|
||||
}): boolean => {
|
||||
return !!(
|
||||
sbomObject?.bomFormat &&
|
||||
sbomObject?.serialNumber &&
|
||||
sbomObject?.specVersion
|
||||
)
|
||||
}
|
||||
|
||||
export const generateSBOMPredicate = (sbom: SBOM): Predicate => {
|
||||
switch (sbom.type) {
|
||||
case 'spdx':
|
||||
return generateSPDXPredicate(sbom.object)
|
||||
case 'cyclonedx':
|
||||
return generateCycloneDXPredicate(sbom.object)
|
||||
default:
|
||||
throw new Error('Unsupported SBOM format')
|
||||
}
|
||||
}
|
||||
|
||||
// ref: https://github.com/in-toto/attestation/blob/main/spec/predicates/spdx.md
|
||||
const generateSPDXPredicate = (sbom: object): Predicate => {
|
||||
const spdxVersion = (sbom as { spdxVersion?: string })?.['spdxVersion']
|
||||
if (!spdxVersion) {
|
||||
throw new Error('Cannot find spdxVersion in the SBOM')
|
||||
}
|
||||
|
||||
const version = spdxVersion.split('-')[1]
|
||||
|
||||
return {
|
||||
type: `https://spdx.dev/Document/v${version}`,
|
||||
params: sbom
|
||||
}
|
||||
}
|
||||
|
||||
// ref: https://github.com/in-toto/attestation/blob/main/spec/predicates/cyclonedx.md
|
||||
const generateCycloneDXPredicate = (sbom: object): Predicate => {
|
||||
return {
|
||||
type: 'https://cyclonedx.org/bom',
|
||||
params: sbom
|
||||
}
|
||||
}
|
||||
+22
-44
@@ -2,8 +2,7 @@ import * as glob from '@actions/glob'
|
||||
import assert from 'assert'
|
||||
import crypto from 'crypto'
|
||||
import { parse } from 'csv-parse/sync'
|
||||
import { createReadStream } from 'fs'
|
||||
import fs from 'fs/promises'
|
||||
import fs from 'fs'
|
||||
import os from 'os'
|
||||
import path from 'path'
|
||||
|
||||
@@ -65,7 +64,7 @@ export const subjectFromInputs = async (
|
||||
case !!subjectDigest:
|
||||
return [getSubjectFromDigest(subjectDigest, name)]
|
||||
case !!subjectChecksums:
|
||||
return await getSubjectFromChecksums(subjectChecksums)
|
||||
return getSubjectFromChecksums(subjectChecksums)
|
||||
/* istanbul ignore next */
|
||||
default:
|
||||
// This should be unreachable, but TS requires a default case
|
||||
@@ -94,18 +93,13 @@ const getSubjectFromPath = async (
|
||||
// Expand the globbed paths to a list of actual paths
|
||||
const paths = await glob.create(subjectPaths).then(async g => g.glob())
|
||||
|
||||
// Filter path list to just the files (not directories), enforcing the maximum
|
||||
const files: string[] = []
|
||||
for (const p of paths) {
|
||||
const stat = await fs.stat(p)
|
||||
if (stat.isFile()) {
|
||||
if (files.length >= MAX_SUBJECT_COUNT) {
|
||||
throw new Error(
|
||||
`Too many subjects specified (>${MAX_SUBJECT_COUNT}). The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
|
||||
)
|
||||
}
|
||||
files.push(p)
|
||||
}
|
||||
// Filter path list to just the files (not directories)
|
||||
const files = paths.filter(p => fs.statSync(p).isFile())
|
||||
|
||||
if (files.length > MAX_SUBJECT_COUNT) {
|
||||
throw new Error(
|
||||
`Too many subjects specified. The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
|
||||
)
|
||||
}
|
||||
|
||||
for (const file of files) {
|
||||
@@ -148,21 +142,16 @@ const getSubjectFromDigest = (
|
||||
}
|
||||
}
|
||||
|
||||
const getSubjectFromChecksums = async (
|
||||
subjectChecksums: string
|
||||
): Promise<Subject[]> => {
|
||||
try {
|
||||
await fs.access(subjectChecksums)
|
||||
const getSubjectFromChecksums = (subjectChecksums: string): Subject[] => {
|
||||
if (fs.existsSync(subjectChecksums)) {
|
||||
return getSubjectFromChecksumsFile(subjectChecksums)
|
||||
} catch {
|
||||
} else {
|
||||
return getSubjectFromChecksumsString(subjectChecksums)
|
||||
}
|
||||
}
|
||||
|
||||
const getSubjectFromChecksumsFile = async (
|
||||
checksumsPath: string
|
||||
): Promise<Subject[]> => {
|
||||
const stats = await fs.stat(checksumsPath)
|
||||
const getSubjectFromChecksumsFile = (checksumsPath: string): Subject[] => {
|
||||
const stats = fs.statSync(checksumsPath)
|
||||
if (!stats.isFile()) {
|
||||
throw new Error(`subject checksums file not found: ${checksumsPath}`)
|
||||
}
|
||||
@@ -174,7 +163,7 @@ const getSubjectFromChecksumsFile = async (
|
||||
)
|
||||
}
|
||||
|
||||
const checksums = await fs.readFile(checksumsPath, 'utf-8')
|
||||
const checksums = fs.readFileSync(checksumsPath, 'utf-8')
|
||||
return getSubjectFromChecksumsString(checksums)
|
||||
}
|
||||
|
||||
@@ -192,29 +181,18 @@ const getSubjectFromChecksumsString = (checksums: string): Subject[] => {
|
||||
continue
|
||||
}
|
||||
|
||||
// It's common for checksum records to have a leading flag character before
|
||||
// the artifact name. It will be either a '*' or a space.
|
||||
const flag_and_name = record.slice(delimIndex + 1)
|
||||
const name =
|
||||
flag_and_name.startsWith('*') || flag_and_name.startsWith(' ')
|
||||
? flag_and_name.slice(1)
|
||||
: flag_and_name
|
||||
|
||||
// Swallow the type identifier character at the beginning of the name
|
||||
const name = record.slice(delimIndex + 2)
|
||||
const digest = record.slice(0, delimIndex)
|
||||
|
||||
if (!HEX_STRING_RE.test(digest)) {
|
||||
throw new Error(`Invalid digest: ${digest}`)
|
||||
}
|
||||
|
||||
const alg = digestAlgorithm(digest)
|
||||
|
||||
// Only add the subject if it is not already in the list (deduplicate by name & digest)
|
||||
if (!subjects.some(s => s.name === name && s.digest[alg] === digest)) {
|
||||
subjects.push({
|
||||
name,
|
||||
digest: { [alg]: digest }
|
||||
})
|
||||
}
|
||||
subjects.push({
|
||||
name,
|
||||
digest: { [digestAlgorithm(digest)]: digest }
|
||||
})
|
||||
}
|
||||
|
||||
return subjects
|
||||
@@ -229,7 +207,7 @@ const digestFile = async (
|
||||
): Promise<string> => {
|
||||
return new Promise((resolve, reject) => {
|
||||
const hash = crypto.createHash(algorithm).setEncoding('hex')
|
||||
createReadStream(filePath)
|
||||
fs.createReadStream(filePath)
|
||||
.once('error', reject)
|
||||
.pipe(hash)
|
||||
.once('finish', () => resolve(hash.read()))
|
||||
|
||||
+2
-3
@@ -2,10 +2,9 @@
|
||||
"$schema": "https://json.schemastore.org/tsconfig",
|
||||
"compilerOptions": {
|
||||
"target": "ES2022",
|
||||
"module": "ESNext",
|
||||
"module": "NodeNext",
|
||||
"rootDir": "./src",
|
||||
"moduleResolution": "Bundler",
|
||||
"isolatedModules": true,
|
||||
"moduleResolution": "NodeNext",
|
||||
"baseUrl": "./",
|
||||
"sourceMap": true,
|
||||
"outDir": "./dist",
|
||||
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
"$schema": "https://json.schemastore.org/tsconfig",
|
||||
"extends": "./tsconfig.json",
|
||||
"compilerOptions": {
|
||||
"noEmit": true
|
||||
},
|
||||
"include": ["./__tests__/**/*", "./src/**/*"],
|
||||
"exclude": ["./dist", "./node_modules", "./coverage", "*.json"]
|
||||
}
|
||||
Reference in New Issue
Block a user