e2e.yaml

name: E2E

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  workflow_dispatch:

jobs:
  e2e:
    runs-on: ubuntu-latest
    permissions:
      # The rest of these are sanity-check settings, since I'm not sure if the
      # org default is permissive or restricted.
      # See https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token
      # for more details.
      actions: none
      checks: none
      contents: read
      deployments: none
      id-token: none
      issues: none
      packages: none
      pages: none
      pull-requests: none
      repository-projects: none
      security-events: none
      statuses: none

    steps:
      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1

      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version: "1.23"
          check-latest: true

      - name: Get test OIDC token
        uses: sigstore-conformance/extremely-dangerous-public-oidc-beacon@main

      - name: export OIDC token
        run: |
          echo "SIGSTORE_ID_TOKEN=$(cat ./oidc-token.txt)" >> $GITHUB_ENV

      - name: e2e unit tests
        run: |
          set -e
          make e2e-test

      - name: Install Gitsign
        run: |
          set -e

          # Setup repo + tool
          make install-gitsign
          export PATH="$PATH:$GOPATH/bin"
          echo "PATH=${PATH}"
          whereis gitsign
          mkdir /tmp/git
          cd /tmp/git
          git init -b main .
          git config --global user.email "test@example.com"
          git config --global user.name "gitsign"
          git config --global gpg.x509.program gitsign
          git config --global gpg.format x509
          git config --global commit.gpgsign true

          # Verify tool is on our path
          gitsign -h
      - name: Test Sign and Verify commit
        run: |
          set -e

          # Sign commit
          git commit --allow-empty -S --message="Signed commit"

          # Verify commit
          echo "========== git verify-commit =========="
          git verify-commit HEAD

          echo "========== gitsign verify =========="
          gitsign verify \
            --certificate-github-workflow-repository="sigstore-conformance/extremely-dangerous-public-oidc-beacon" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            --certificate-identity="https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main"

          # Extra debug info
          git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text
      - name: Test Sign and Verify commit - offline verification
        env:
          GITSIGN_REKOR_MODE: "offline"
        run: |
          set -e

          # Sign commit
          git commit --allow-empty -S --message="Signed commit"

          # Verify commit
          echo "========== git verify-commit =========="
          git verify-commit HEAD

          echo "========== gitsign verify =========="
          gitsign verify \
            --certificate-github-workflow-repository="sigstore-conformance/extremely-dangerous-public-oidc-beacon" \
            --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
            --certificate-identity="https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon/.github/workflows/extremely-dangerous-oidc-beacon.yml@refs/heads/main"

          # Extra debug info
          git cat-file commit HEAD | sed -n '/-BEGIN/, /-END/p' | sed 's/^ //g' | sed 's/gpgsig //g' | sed 's/SIGNED MESSAGE/PKCS7/g' | openssl pkcs7 -print -print_certs -text

      - name: Debug log
        if: failure()
        run: cat "${GITSIGN_LOG}"