Skip to content

Commit 06b8c6a

Browse files
kriscolemankriscoleman
committed
chore: workflow to use reusable workflow
Refactors the pipeline workflows to use a reusable workflow for Witness jobs. This change improves the maintainability and reduces duplication in the workflow definitions. The `archivista-headers` is also adjusted to use the secrets context for authentication, which makes it more consistent.
1 parent 295f271 commit 06b8c6a

File tree

3 files changed

+130
-36
lines changed

3 files changed

+130
-36
lines changed

‎.github/workflows/pipeline-prod.yml‎

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,33 +14,34 @@ on:
1414

1515
jobs:
1616
fmt:
17-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
17+
uses: ./.github/workflows/witness.yml
1818
with:
1919
pull_request: ${{ github.event_name == 'pull_request' }}
2020
step: fmt
2121
archivista-server: 'https://web.platform.testifysec.com'
22-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
2322
attestations: 'git github environment'
2423
command: go fmt ./...
24+
secrets:
25+
token: ${{ secrets.witness_api_token }}
2526

2627
vet:
27-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
28+
uses: ./.github/workflows/witness.yml
2829
with:
2930
pull_request: ${{ github.event_name == 'pull_request' }}
3031
step: vet
3132
archivista-server: 'https://web.platform.testifysec.com'
32-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
3333
attestations: 'git github environment'
3434
command: go vet ./...
35+
secrets:
36+
token: ${{ secrets.witness_api_token }}
3537

3638
# --ignore DL3002
3739
lint:
38-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
40+
uses: ./.github/workflows/witness.yml
3941
with:
4042
pull_request: ${{ github.event_name == 'pull_request' }}
4143
step: lint
4244
archivista-server: 'https://web.platform.testifysec.com'
43-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
4445
pre-command-attestations: 'git github environment'
4546
attestations: 'git github environment'
4647
pre-command: |
@@ -49,45 +50,50 @@ jobs:
4950
command: hadolint -f sarif Dockerfile > hadolint.sarif
5051
artifact-upload-name: hadolint.sarif
5152
artifact-upload-path: hadolint.sarif
53+
secrets:
54+
token: ${{ secrets.witness_api_token }}
5255

5356
unit-test:
5457
needs: [fmt, vet, lint]
55-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
58+
uses: ./.github/workflows/witness.yml
5659
with:
5760
pull_request: ${{ github.event_name == 'pull_request' }}
5861
step: unit-test
5962
archivista-server: 'https://web.platform.testifysec.com'
60-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
6163
attestations: 'git github environment'
6264
command: go test ./... -coverprofile cover.out
6365
artifact-upload-name: cover.out
6466
artifact-upload-path: cover.out
67+
secrets:
68+
token: ${{ secrets.witness_api_token }}
6569

6670
sast:
6771
needs: [fmt, vet, lint]
68-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
72+
uses: ./.github/workflows/witness.yml
6973
with:
7074
pull_request: ${{ github.event_name == 'pull_request' }}
7175
step: sast
7276
archivista-server: 'https://web.platform.testifysec.com'
73-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
7477
pre-command-attestations: 'git github environment'
7578
attestations: 'git github environment'
7679
pre-command: python3 -m pip install semgrep==1.45.0
7780
command: semgrep scan --config auto ./ --sarif -o semgrep.sarif
7881
artifact-upload-name: semgrep.sarif
7982
artifact-upload-path: semgrep.sarif
83+
secrets:
84+
token: ${{ secrets.witness_api_token }}
8085

8186
build:
8287
needs: [unit-test, sast]
83-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
88+
uses: ./.github/workflows/witness.yml
8489
with:
8590
pull_request: ${{ github.event_name == 'pull_request' }}
8691
step: build
8792
archivista-server: 'https://web.platform.testifysec.com'
88-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
8993
attestations: 'git github environment'
9094
command: go build -o bin/software main.go
95+
secrets:
96+
token: ${{ secrets.witness_api_token }}
9197

9298
build-image:
9399
needs: [unit-test, sast]
@@ -130,11 +136,10 @@ jobs:
130136
with:
131137
step: build-image
132138
archivista-server: 'https://web.platform.testifysec.com'
133-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
134139
attestations: 'git github environment oci slsa'
135140
command: |
136141
/bin/sh -c "docker buildx build -t ${{ steps.meta.outputs.tags }} -o type=docker,dest=image.tar --push ."
137-
142+
138143
- name: Upload Artifact
139144
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
140145
with:
@@ -146,12 +151,11 @@ jobs:
146151

147152
generate-sbom:
148153
needs: build-image
149-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
154+
uses: ./.github/workflows/witness.yml
150155
with:
151156
pull_request: ${{ github.event_name == 'pull_request' }}
152157
step: generate-sbom
153158
archivista-server: 'https://web.platform.testifysec.com'
154-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
155159
pre-command-attestations: 'git github environment'
156160
attestations: 'git github environment sbom'
157161
artifact-download: image.tar
@@ -161,15 +165,16 @@ jobs:
161165
syft packages docker-archive:/tmp/image.tar --source-name=pkg:oci/testifysec/swf -o cyclonedx-json --file sbom.cdx.json
162166
artifact-upload-name: sbom.cdx.json
163167
artifact-upload-path: sbom.cdx.json
168+
secrets:
169+
token: ${{ secrets.witness_api_token }}
164170

165171
secret-scan:
166172
needs: build-image
167-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
173+
uses: ./.github/workflows/witness.yml
168174
with:
169175
pull_request: ${{ github.event_name == 'pull_request' }}
170176
step: secret-scan
171177
archivista-server: 'https://web.platform.testifysec.com'
172-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
173178
pre-command-attestations: 'git github environment'
174179
attestations: 'git github environment'
175180
artifact-download: image.tar
@@ -179,3 +184,5 @@ jobs:
179184
trufflehog docker --image=file:///tmp/image.tar -j > trufflehog.json
180185
artifact-upload-name: trufflehog.json
181186
artifact-upload-path: trufflehog.json
187+
secrets:
188+
token: ${{ secrets.witness_api_token }}

‎.github/workflows/pipeline-sandbox.yml‎

Lines changed: 25 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,33 +14,34 @@ on:
1414

1515
jobs:
1616
fmt:
17-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
17+
uses: ./.github/workflows/witness.yml
1818
with:
1919
pull_request: ${{ github.event_name == 'pull_request' }}
2020
step: fmt
2121
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
22-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
2322
attestations: 'git github environment'
2423
command: go fmt ./...
24+
secrets:
25+
token: ${{ secrets.sandbox_witness_api_token }}
2526

2627
vet:
27-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
28+
uses: ./.github/workflows/witness.yml
2829
with:
2930
pull_request: ${{ github.event_name == 'pull_request' }}
3031
step: vet
3132
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
32-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
3333
attestations: 'git github environment'
3434
command: go vet ./...
35+
secrets:
36+
token: ${{ secrets.sandbox_witness_api_token }}
3537

3638
# --ignore DL3002
3739
lint:
38-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
40+
uses: ./.github/workflows/witness.yml
3941
with:
4042
pull_request: ${{ github.event_name == 'pull_request' }}
4143
step: lint
4244
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
43-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
4445
pre-command-attestations: 'git github environment'
4546
attestations: 'git github environment'
4647
pre-command: |
@@ -49,45 +50,50 @@ jobs:
4950
command: hadolint -f sarif Dockerfile > hadolint.sarif
5051
artifact-upload-name: hadolint.sarif
5152
artifact-upload-path: hadolint.sarif
53+
secrets:
54+
token: ${{ secrets.sandbox_witness_api_token }}
5255

5356
unit-test:
5457
needs: [fmt, vet, lint]
55-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
58+
uses: ./.github/workflows/witness.yml
5659
with:
5760
pull_request: ${{ github.event_name == 'pull_request' }}
5861
step: unit-test
5962
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
60-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
6163
attestations: 'git github environment'
6264
command: go test ./... -coverprofile cover.out
6365
artifact-upload-name: cover.out
6466
artifact-upload-path: cover.out
67+
secrets:
68+
token: ${{ secrets.sandbox_witness_api_token }}
6569

6670
sast:
6771
needs: [fmt, vet, lint]
68-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
72+
uses: ./.github/workflows/witness.yml
6973
with:
7074
pull_request: ${{ github.event_name == 'pull_request' }}
7175
step: sast
7276
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
73-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
7477
pre-command-attestations: 'git github environment'
7578
attestations: 'git github environment'
7679
pre-command: python3 -m pip install semgrep==1.45.0
7780
command: semgrep scan --config auto ./ --sarif -o semgrep.sarif
7881
artifact-upload-name: semgrep.sarif
7982
artifact-upload-path: semgrep.sarif
83+
secrets:
84+
token: ${{ secrets.sandbox_witness_api_token }}
8085

8186
build:
8287
needs: [unit-test, sast]
83-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
88+
uses: ./.github/workflows/witness.yml
8489
with:
8590
pull_request: ${{ github.event_name == 'pull_request' }}
8691
step: build
8792
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
88-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
8993
attestations: 'git github environment'
9094
command: go build -o bin/software main.go
95+
secrets:
96+
token: ${{ secrets.sandbox_witness_api_token }}
9197

9298
build-image:
9399
needs: [unit-test, sast]
@@ -130,11 +136,10 @@ jobs:
130136
with:
131137
step: build-image
132138
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
133-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
134139
attestations: 'git github environment oci slsa'
135140
command: |
136141
/bin/sh -c "docker buildx build -t ${{ steps.meta.outputs.tags }} -o type=docker,dest=image.tar --push ."
137-
142+
138143
- name: Upload Artifact
139144
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
140145
with:
@@ -146,12 +151,11 @@ jobs:
146151

147152
generate-sbom:
148153
needs: build-image
149-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
154+
uses: ./.github/workflows/witness.yml
150155
with:
151156
pull_request: ${{ github.event_name == 'pull_request' }}
152157
step: generate-sbom
153158
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
154-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
155159
pre-command-attestations: 'git github environment'
156160
attestations: 'git github environment sbom'
157161
artifact-download: image.tar
@@ -161,15 +165,16 @@ jobs:
161165
syft packages docker-archive:/tmp/image.tar --source-name=pkg:oci/testifysec/swf -o cyclonedx-json --file sbom.cdx.json
162166
artifact-upload-name: sbom.cdx.json
163167
artifact-upload-path: sbom.cdx.json
168+
secrets:
169+
token: ${{ secrets.sandbox_witness_api_token }}
164170

165171
secret-scan:
166172
needs: build-image
167-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
173+
uses: ./.github/workflows/witness.yml
168174
with:
169175
pull_request: ${{ github.event_name == 'pull_request' }}
170176
step: secret-scan
171177
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
172-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
173178
pre-command-attestations: 'git github environment'
174179
attestations: 'git github environment'
175180
artifact-download: image.tar
@@ -179,3 +184,5 @@ jobs:
179184
trufflehog docker --image=file:///tmp/image.tar -j > trufflehog.json
180185
artifact-upload-name: trufflehog.json
181186
artifact-upload-path: trufflehog.json
187+
secrets:
188+
token: ${{ secrets.sandbox_witness_api_token }}

‎.github/workflows/witness.yml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
pull_request:
5+
required: true
6+
type: boolean
7+
artifact-download:
8+
required: false
9+
type: string
10+
artifact-upload-name:
11+
required: false
12+
type: string
13+
artifact-upload-path:
14+
required: false
15+
type: string
16+
pre-command:
17+
required: false
18+
type: string
19+
pre-command-attestations:
20+
default: 'environment git github'
21+
required: false
22+
type: string
23+
command:
24+
required: true
25+
type: string
26+
step:
27+
required: true
28+
type: string
29+
attestations:
30+
required: true
31+
type: string
32+
archivista-server:
33+
required: false
34+
type: string
35+
secrets:
36+
token:
37+
required: true
38+
39+
jobs:
40+
witness:
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
44+
- uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
45+
with:
46+
go-version: 1.21.x
47+
48+
- if: ${{ inputs.artifact-download != '' }}
49+
uses: actions/download-artifact@6b208ae046db98c579e8a3aa621ab581ff575935 # v4.1.1
50+
with:
51+
name: ${{ inputs.artifact-download }}
52+
path: /tmp
53+
54+
- if: ${{ inputs.pre-command != '' && inputs.pull_request == false }}
55+
uses: testifysec/witness-run-action@v0.3.0
56+
with:
57+
archivista-server: ${{ inputs.archivista-server }}
58+
archivista-headers: "Authorization: Token ${{ secrets.token }}"
59+
step: pre-${{ inputs.step }}
60+
attestations: ${{ inputs.pre-command-attestations }}
61+
command: /bin/sh -c "${{ inputs.pre-command }}"
62+
- if: ${{ inputs.pre-command != '' && inputs.pull_request == true }}
63+
run: ${{ inputs.pre-command }}
64+
65+
- if: ${{ inputs.pull_request == false }}
66+
uses: testifysec/witness-run-action@v0.3.0
67+
with:
68+
archivista-server: ${{ inputs.archivista-server }}
69+
archivista-headers: "Authorization: Token ${{ secrets.token }}"
70+
step: ${{ inputs.step }}
71+
attestations: ${{ inputs.attestations }}
72+
command: /bin/sh -c "${{ inputs.command }}"
73+
- if: ${{ inputs.pull_request == true }}
74+
run: ${{ inputs.command }}
75+
76+
- if: ${{ inputs.artifact-upload-path != '' && inputs.artifact-upload-name != ''}}
77+
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
78+
with:
79+
name: ${{ inputs.artifact-upload-name }}
80+
path: ${{ inputs.artifact-upload-path }}

0 commit comments

Comments
 (0)