Skip to content

Commit b4f9917

Browse files
timbastintimbastin
committed
combines get and attest steps
1 parent 0f0c878 commit b4f9917

1 file changed

Lines changed: 16 additions & 34 deletions

File tree

‎.github/workflows/attest.yml‎

Lines changed: 16 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -85,62 +85,45 @@ jobs:
8585
echo "Encoded: $API_ARTIFACT_NAME"
8686
fi
8787
88-
- name: Get SBOM
89-
uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
90-
with:
91-
args: >
92-
sh -c "
93-
slug=$(devguard-scanner slug ${{ github.ref_name }}) && devguard-scanner curl '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/artifacts/${{ env.API_ARTIFACT_NAME }}/sbom.json/' --token='${{ secrets.devguard-token }}'> /tmp/sbom.json
94-
"
95-
env:
96-
API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
97-
- name: Get VeX
98-
uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
99-
with:
100-
args: >
101-
sh -c "
102-
slug=$(devguard-scanner slug ${{ github.ref_name }}) && devguard-scanner curl '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/artifacts/${{ env.API_ARTIFACT_NAME }}/vex.json/' --token='${{ secrets.devguard-token }}'> /tmp/vex.json
103-
"
104-
env:
105-
API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
106-
- name: Get SAST-Results
107-
uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
108-
with:
109-
args: >
110-
sh -c "
111-
slug=$(devguard-scanner slug ${{ github.ref_name }}) && devguard-scanner curl '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/sarif.json' --token='${{ secrets.devguard-token }}'> /tmp/sarif.json
112-
"
113-
- name: Attest SBOM
88+
- name: Get and Attest SBOM
11489
uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
11590
with:
11691
args: >
11792
sh -c "
93+
slug=$(devguard-scanner slug ${{ github.ref_name }}) &&
94+
devguard-scanner curl '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/artifacts/${{ env.API_ARTIFACT_NAME }}/sbom.json/' --token='${{ secrets.devguard-token }}' > /tmp/sbom.json &&
11895
if [ -f image-digest.txt ]; then
11996
devguard-scanner attest -u ${{ github.actor }} -r ghcr.io -p ${{ secrets.GITHUB_TOKEN }} /tmp/sbom.json --predicateType='https://cyclonedx.org/bom' \"$(cat image-tag.txt)@$(cat image-digest.txt)\" --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
12097
else
121-
devguard-scanner attest /tmp/sbom.json --predicateType='https://cyclonedx.org/bom' --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
98+
devguard-scanner attest /tmp/sbom.json --predicateType='https://cyclonedx.org/bom' --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
12299
fi
123100
"
124101
env:
125-
ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
126-
- name: Attest VeX
102+
API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
103+
ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
104+
- name: Get and Attest VeX
127105
uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
128106
with:
129107
args: >
130108
sh -c "
109+
slug=$(devguard-scanner slug ${{ github.ref_name }}) &&
110+
devguard-scanner curl '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/artifacts/${{ env.API_ARTIFACT_NAME }}/vex.json/' --token='${{ secrets.devguard-token }}' > /tmp/vex.json &&
131111
if [ -f image-digest.txt ]; then
132112
devguard-scanner attest -u ${{ github.actor }} -r ghcr.io -p ${{ secrets.GITHUB_TOKEN }} /tmp/vex.json \"$(cat image-tag.txt)@$(cat image-digest.txt)\" --token='${{ secrets.devguard-token }}' --predicateType='https://cyclonedx.org/vex' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
133113
else
134-
devguard-scanner attest /tmp/vex.json --predicateType='https://cyclonedx.org/vex' --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
114+
devguard-scanner attest /tmp/vex.json --predicateType='https://cyclonedx.org/vex' --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
135115
fi
136116
"
137117
env:
118+
API_ARTIFACT_NAME: ${{ env.API_ARTIFACT_NAME }}
138119
ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
139-
- name: Attest SAST-Results
120+
- name: Get and Attest SAST-Results
140121
uses: docker://ghcr.io/l3montree-dev/devguard/scanner:main
141122
with:
142123
args: >
143124
sh -c "
125+
slug=$(devguard-scanner slug ${{ github.ref_name }}) &&
126+
devguard-scanner curl '${{ inputs.api-url }}/api/v1/organizations/${{ inputs.asset-name }}/refs/'$slug'/sarif.json' --token='${{ secrets.devguard-token }}' > /tmp/sarif.json &&
144127
if [ -f image-digest.txt ]; then
145128
devguard-scanner attest -u ${{ github.actor }} -r ghcr.io -p ${{ secrets.GITHUB_TOKEN }} /tmp/sarif.json \"$(cat image-tag.txt)@$(cat image-digest.txt)\" --predicateType='https://www.schemastore.org/schemas/json/sarif-2.1.0.json' --token='${{ secrets.devguard-token }}' --apiUrl=${{ inputs.api-url }} --assetName=${{ inputs.asset-name }} --ref=${{ github.ref_name }} --artifactName=${{ env.ARTIFACT_NAME }}
146129
else
@@ -149,8 +132,7 @@ jobs:
149132
"
150133
env:
151134
ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
152-
# download build-provenance.json if it exists
153-
- name: Download build-provenance.json
135+
- name: Download and Attest build-provenance.json
154136
uses: actions/download-artifact@v4
155137
with:
156138
name: build${{ inputs.image-suffix }}.provenance.json
@@ -167,4 +149,4 @@ jobs:
167149
fi
168150
"
169151
env:
170-
ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}
152+
ARTIFACT_NAME: ${{ env.ARTIFACT_NAME }}

0 commit comments

Comments
 (0)