test-action-tuf.yaml

name: Test github action with TUF

on:
  pull_request:
    branches: [ main ]
    paths-ignore:
      - 'terraform/**'

defaults:
  run:
    shell: bash
    working-directory: ./

concurrency:
  group: test-github-action-with-tuf${{ github.head_ref }}
  cancel-in-progress: true

jobs:
  test-github-action:
    name: Test github action with TUF
    runs-on: ubuntu-24.04
    strategy:
      fail-fast: false # Keep running if one leg fails.
      matrix:
        k8s-version:
          - v1.27.x
          - v1.28.x
          - v1.29.x
          - v1.30.x
        release-version:
          - "main" # Test explicitly with latest
        go-version:
          - 1.23.x
        leg:
          - test github action with TUF
    env:
      KO_DOCKER_REPO: registry.local:5000/knative

    steps:
    - name: Checkout the current action
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Test running the action
      uses: ./actions/setup
      with:
        k8s-version: ${{ matrix.k8s-version }}
        version: ${{ matrix.release-version }}

    # Install cosign
    - name: Install cosign
      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0

    - name: Set up Go
      uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
      with:
        go-version: ${{ matrix.go-version }}
        check-latest: true

    - uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7

    - name: Create sample image
      run: |
        pushd $(mktemp -d)
        go mod init example.com/demo-action-with-tuf
        cat <<EOF > main.go
        package main
        import "fmt"
        func main() {
          fmt.Println("hello world")
        }
        EOF
        demoimage=$(ko publish -B example.com/demo-action-with-tuf)
        echo "demoimage=$demoimage" >> $GITHUB_ENV
        echo Created image $demoimage
        popd

    - name: Initialize cosign with TUF root
      run: cosign initialize --mirror ${{ env.TUF_MIRROR }} --root ./root.json

    - name: Sign with cosign from the action using k8s token
      run: |
        cosign sign --yes --rekor-url ${{ env.REKOR_URL }} --fulcio-url ${{ env.FULCIO_URL }} --allow-insecure-registry ${{ env.demoimage }} --identity-token ${{ env.OIDC_TOKEN }}

    - name: Verify with cosign from the action using k8s token
      run: |
        cosign verify --rekor-url "${{ env.REKOR_URL }}" \
        --allow-insecure-registry "${{ env.demoimage }}" \
        --certificate-identity "https://kubernetes.io/namespaces/default/serviceaccounts/default" \
        --certificate-oidc-issuer "https://kubernetes.default.svc.cluster.local"

    - name: Checkout TSA for testing.
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        repository: sigstore/timestamp-authority
        path: ./src/github.com/sigstore/timestamp-authority
    - name: Build timestamp-cli
      working-directory: ./src/github.com/sigstore/timestamp-authority
      run: |
        go build -o ./timestamp-cli ./cmd/timestamp-cli
    - name: Exercise TSA
      working-directory: ./src/github.com/sigstore/timestamp-authority
      run: |
        curl ${{ env.TSA_URL }}/api/v1/timestamp/certchain > ts_chain.pem
        echo "myblob" > myblob
        if ! ./timestamp-cli --timestamp_server ${{ env.TSA_URL }} timestamp --hash sha256 --artifact myblob --out response.tsr ; then
          echo "failed to timestamp artifact"
          exit -1
        fi
        if ! ./timestamp-cli verify --timestamp response.tsr --artifact "myblob" --certificate-chain ts_chain.pem ; then
          echo "failed to verify timestamp"
          exit -1
        fi
        if ! ./timestamp-cli inspect --timestamp response.tsr --format json ; then
          echo "failed to inspect the timestamp"
          exit -1
        fi

    - name: Collect diagnostics
      if: ${{ failure() }}
      uses: chainguard-dev/actions/kind-diag@main