action.yml

# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: "Generate the builder"
description: "Build or fetch the builder binary"
inputs:
  ref:
    description: "A fully formed ref (refs/...) or SHA to checkout for the action code."
    required: true
  builder-ref:
    description: "A fully formed ref (refs/...) or SHA to generate the builder. If not provided, defaults to inputs.ref"
    required: false
  repository:
    description: "Repository of the builder."
    required: true
  binary:
    description: "Name of the compiled binary. (Note: just the filename, not the path)"
    required: true
  compile-builder:
    description: "Whether to compile the builder or not."
    required: true
  directory:
    description: "Directory of the source code of the builder. (Note: expect no trailing `/`)"
    required: true
  go-version:
    description: "The Go version to use, as expected by https://github.com/actions/setup-go."
    required: true
  allow-private-repository:
    description: "If set to true, allows the action to complete successfully even if the repo is private."
    type: boolean
    required: false
    default: false
  # NOTE: Used for adversarial tests during release. See RELEASE.md.
  testing:
    description: "Temporary flag used to support pre-submit testing. DO NOT USE"
    type: boolean
    required: false
    default: false

  token:
    description: "GitHub token"
    required: false
    default: ${{ github.token }}

outputs:
  sha256:
    description: "SHA256 of the builder binary."
    value: ${{ steps.compute.outputs.sha256 }}

runs:
  using: "composite"
  steps:
    - name: Checkout builder repository
      uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@v1.9.0
      with:
        repository: ${{ inputs.repository }}
        ref: ${{ inputs.ref }}
        path: __BUILDER_CHECKOUT_DIR__

    - name: Check private repos
      uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/privacy-check
      with:
        error_message: "Repository is private. The workflow has halted in order to keep the repository name from being exposed in the public transparency log. Set 'private-repository' to override."
        override: ${{ inputs.allow-private-repository }}
        token: ${{ inputs.token }}

    - name: Set up Go environment
      uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        go-version: ${{ inputs.go-version }}

    - name: Generate builder
      shell: bash
      env:
        # Builder.
        BUILDER_REPOSITORY: slsa-framework/slsa-github-generator # The repository to download the pre-built builder binary from.
        BUILDER_RELEASE_BINARY: "${{ inputs.binary }}" # The name of the pre-built binary in the release assets. This is also used as the final binary name when compiling the builder from source.
        # Verifier
        # NOTE: These VERIFIER_* variables are used in the builder-fetch.sh script for verification of builder
        # release binaries when the compile-builder input is false.
        VERIFIER_REPOSITORY: slsa-framework/slsa-verifier # The repository to download the pre-built verifier binary from.
        VERIFIER_RELEASE_BINARY: slsa-verifier-linux-amd64 # The name of the verifier binary in the release assets.
        VERIFIER_RELEASE_BINARY_SHA256: ea687149d658efecda64d69da999efb84bb695a3212f29548d4897994027172d # The expected hash of the verifier binary.
        VERIFIER_RELEASE: v2.3.0 # The version of the verifier to download.

        COMPILE_BUILDER: "${{ inputs.compile-builder }}"
        # NOTE: If a builder reference is specified, then we will download this version of the builder.
        # Otherwise, we use the same tag reference as the detected workflow source reference. This allows
        # pinning the builder binary version at the same as the reuseable workflow reference, and avoids
        # dynamically fetching a builder binary.
        # The builder-ref option can be used to test the scripts at main to download a builder binary at
        # a previous tag.
        BUILDER_REF: "${{ inputs.builder-ref || inputs.ref }}" # The version of the builder to retrieve.
        BUILDER_DIR: "./__BUILDER_CHECKOUT_DIR__/${{ inputs.directory }}"
        # Needed for the gh CLI used in builder-fetch.sh.
        GH_TOKEN: "${{ inputs.token }}"
        # TODO(#2056): Remove testing input.
        SLSA_VERIFIER_TESTING: "${{ inputs.testing }}"
      run: ./__BUILDER_CHECKOUT_DIR__/.github/actions/generate-builder/generate-builder.sh

    - name: Compute sha256 of builder
      uses: ./__BUILDER_CHECKOUT_DIR__/.github/actions/compute-sha256
      id: compute
      with:
        path: "${{ inputs.binary }}"