Bump sigstore/sigstore-conformance from d93d46c0e864084fbb78015a5b7d4f5b1d7e641d to da09d434d4d8a8da0ade1abbe2ce89117d0c02d4 in the actions group #659
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| schedule: | |
| - cron: "0 12 * * *" | |
| permissions: {} | |
| jobs: | |
| ruby-versions: | |
| uses: ruby/actions/.github/workflows/ruby_versions.yml@3fbf038d6f0d8043b914f923764c61bc2a114a77 | |
| with: | |
| engine: cruby-truffleruby | |
| min_version: 3.1 | |
| test: | |
| needs: ruby-versions | |
| runs-on: ${{ matrix.os }} | |
| name: Test Ruby ${{ matrix.ruby }} / ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }} | |
| os: [ubuntu-latest] | |
| # os: [ ubuntu-latest, macos-latest, windows-latest ] | |
| # include: | |
| # - { os: windows-latest, ruby: ucrt } | |
| # - { os: windows-latest, ruby: mingw } | |
| # - { os: windows-latest, ruby: mswin } | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc # v1.202.0 | |
| with: | |
| ruby-version: ${{ matrix.ruby }} | |
| bundler-cache: true | |
| - name: Run the tests | |
| run: bin/rake test | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7 | |
| if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always() | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: sigstore/sigstore-ruby | |
| sigstore-conformance: | |
| needs: ruby-versions | |
| runs-on: ${{ matrix.os }} | |
| name: Sigstore Ruby ${{ matrix.ruby }} / ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }} | |
| os: [ubuntu-latest] | |
| # os: [ ubuntu-latest, macos-latest, windows-latest ] | |
| # include: | |
| # - { os: windows-latest, ruby: ucrt } | |
| # - { os: windows-latest, ruby: mingw } | |
| # - { os: windows-latest, ruby: mswin } | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc # v1.202.0 | |
| with: | |
| ruby-version: ${{ matrix.ruby }} | |
| bundler-cache: true | |
| - name: Run the conformance tests | |
| uses: sigstore/sigstore-conformance@da09d434d4d8a8da0ade1abbe2ce89117d0c02d4 | |
| with: | |
| entrypoint: ${{ github.workspace }}/bin/conformance-entrypoint | |
| xfail: "${{ matrix.ruby != 'head' && 'test_verify_rejects_bad_tsa_timestamp' }}" | |
| if: ${{ matrix.os }} == "ubuntu-latest" | |
| - name: Run the conformance tests against staging | |
| uses: sigstore/sigstore-conformance@da09d434d4d8a8da0ade1abbe2ce89117d0c02d4 | |
| with: | |
| entrypoint: ${{ github.workspace }}/bin/conformance-entrypoint | |
| xfail: "${{ matrix.ruby != 'head' && 'test_verify_rejects_bad_tsa_timestamp' }}" | |
| environment: staging | |
| if: ${{ matrix.os }} == "ubuntu-latest" | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7 | |
| if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always() | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: sigstore/sigstore-ruby | |
| tuf-conformance: | |
| needs: ruby-versions | |
| runs-on: ${{ matrix.os }} | |
| name: TUF Ruby ${{ matrix.ruby }} / ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }} | |
| os: [ubuntu-latest] | |
| # os: [ ubuntu-latest, macos-latest, windows-latest ] | |
| # include: | |
| # - { os: windows-latest, ruby: ucrt } | |
| # - { os: windows-latest, ruby: mingw } | |
| # - { os: windows-latest, ruby: mswin } | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc # v1.202.0 | |
| with: | |
| ruby-version: ${{ matrix.ruby }} | |
| bundler-cache: true | |
| - name: Touch requirements.txt | |
| run: touch requirements.txt | |
| - name: Run the TUF conformance tests | |
| uses: theupdateframework/tuf-conformance@ad0e8bef1a9a1c7af993c3d56376ce624a0f10f2 | |
| with: | |
| entrypoint: ${{ github.workspace }}/bin/tuf-conformance-entrypoint | |
| artifact-name: "test repositories ${{ matrix.ruby }} ${{ matrix.os }}" | |
| if: | | |
| ${{ matrix.os }} == "ubuntu-latest" | |
| - name: Upload coverage reports to Codecov | |
| uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7 | |
| if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always() | |
| with: | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| slug: sigstore/sigstore-ruby | |
| smoketest: | |
| needs: ruby-versions | |
| runs-on: ubuntu-latest | |
| name: Smoketest | |
| permissions: | |
| id-token: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }} | |
| os: [ubuntu-latest] | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc # v1.202.0 | |
| with: | |
| ruby-version: ${{ fromJson(needs.ruby-versions.outputs.latest) }} | |
| bundler-cache: true | |
| - name: Build the gem | |
| run: bin/rake build | |
| - name: List built gems | |
| id: list-gems | |
| run: | | |
| echo "gems=$(find pkg -type f -name '*.gem' -print0 | xargs -0 jq --compact-output --null-input --args '[$ARGS.positional[]]')" >> $GITHUB_OUTPUT | |
| - name: Run the smoketest | |
| run: | | |
| ./bin/smoketest ${BUILT_GEMS} | |
| env: | |
| BUILT_GEMS: ${{ join(fromJson(steps.list-gems.outputs.gems), ' ') }} | |
| WORKFLOW_NAME: ci | |
| all-tests-pass: | |
| if: always() | |
| needs: | |
| - test | |
| - sigstore-conformance | |
| - tuf-conformance | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - name: check test jobs | |
| uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2 | |
| with: | |
| jobs: ${{ toJSON(needs) }} | |
| lint: | |
| needs: ruby-versions | |
| runs-on: ubuntu-latest | |
| name: Lint | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Set up Ruby | |
| uses: ruby/setup-ruby@a2bbe5b1b236842c1cb7dd11e8e3b51e0a616acc # v1.202.0 | |
| with: | |
| ruby-version: ${{ fromJson(needs.ruby-versions.outputs.latest) }} | |
| bundler-cache: true | |
| - name: Run the linter | |
| run: bin/rubocop |