Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 58 additions & 0 deletions .github/actions/emit-receipt/action.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
name: Emit pipeline receipt
description: Generate one target-scoped unsigned receipt and upload it for fan-in.
inputs:
manifest:
required: true
artifact-name:
required: true
outcome:
required: true
receipt-id:
required: true
runs:
using: composite
steps:
- name: Generate receipt
if: always()
shell: bash
env:
RECEIPT_STATUS: ${{ inputs.outcome }}
RECEIPT_REPOSITORY: ${{ github.repository }}
RECEIPT_SHA: ${{ github.sha }}
RECEIPT_EVENT: ${{ github.event_name }}
RECEIPT_REF: ${{ github.ref }}
RECEIPT_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
RECEIPT_HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
RECEIPT_RUN_ID: ${{ github.run_id }}
RECEIPT_RUNNER_OS: ${{ runner.os }}
RECEIPT_RUNNER_ARCH: ${{ runner.arch }}
RECEIPT_MANIFEST: ${{ inputs.manifest }}
RECEIPT_ID: ${{ inputs.receipt-id }}
run: |
set -euo pipefail
[[ "$RECEIPT_ID" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || { echo "invalid receipt-id" >&2; exit 2; }
runner_temp="$RUNNER_TEMP"
if command -v cygpath >/dev/null 2>&1; then
runner_temp=$(cygpath -u "$RUNNER_TEMP")
fi
target="$runner_temp/sbom-receipt-source"
test ! -e "$target"
mkdir -p "$target"
# Keep the source snapshot identical on GitHub-hosted Windows and Unix
# runners; checkout autocrlf settings must not alter receipt digests.
git -c core.autocrlf=false -c core.eol=lf archive "$RECEIPT_SHA" | tar -x -C "$target"
mkdir -p "$runner_temp/sbom-receipts"
target="$runner_temp/sbom-receipts/$RECEIPT_ID.json"
bin=target/debug/sbom-tools; [[ -x "$bin.exe" ]] && bin="$bin.exe"
context="$runner_temp/sbom-receipt-context.json"
"$bin" verify receipt-context --repository "$RECEIPT_REPOSITORY" --commit-sha "$RECEIPT_SHA" --event-name "$RECEIPT_EVENT" --ref-name "$RECEIPT_REF" --default-branch "$RECEIPT_DEFAULT_BRANCH" --head-repository "${RECEIPT_HEAD_REPOSITORY:-}" --output "$context"
args=(verify receipt-job --manifest "$RECEIPT_MANIFEST" --context "$context" --output "$target" --outcome "producer=$RECEIPT_STATUS" --runner-os "$RECEIPT_RUNNER_OS" --runner-arch "$RECEIPT_RUNNER_ARCH")
"$bin" "${args[@]}"
- name: Upload receipt
if: always()
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ inputs.artifact-name }}
path: ${{ runner.temp }}/sbom-receipts/
if-no-files-found: error
retention-days: 7
131 changes: 131 additions & 0 deletions .github/receipts/bindings-policy-manifest.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,131 @@
{
"schema": "aggregate-policy-manifest/v1",
"workflow": "Bindings",
"source_root": "$RUNNER_TEMP/sbom-receipt-source",
"lock_paths": [
"Cargo.lock",
"rust-toolchain.toml",
"dagger/rust-sdk/Cargo.lock",
"bindings/go/go.mod",
"bindings/python/pyproject.toml",
"bindings/nodejs/package-lock.json",
"bindings/swift/Package.swift"
],
"artifact_root": "$RUNNER_TEMP/sbom-receipt-source",
"expected_targets": [
{
"verification_scope": "constant-parity",
"os": "linux",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": null
},
{
"verification_scope": "dagger-rust-sdk",
"os": "linux",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "dagger-rust-sdk"
},
{
"verification_scope": "rust-ffi",
"os": "linux",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [
"ffi"
],
"binding_runtime": null
},
{
"verification_scope": "go-bindings-ubuntu",
"os": "linux",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "go"
},
{
"verification_scope": "go-bindings-macos",
"os": "macos",
"architecture": "arm64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "go"
},
{
"verification_scope": "python-bindings-ubuntu",
"os": "linux",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "python"
},
{
"verification_scope": "python-bindings-macos",
"os": "macos",
"architecture": "arm64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "python"
},
{
"verification_scope": "python-bindings-windows",
"os": "windows",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "python"
},
{
"verification_scope": "swift-bindings",
"os": "macos",
"architecture": "arm64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "swift"
},
{
"verification_scope": "nodejs-bindings-ubuntu",
"os": "linux",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "nodejs"
},
{
"verification_scope": "nodejs-bindings-macos",
"os": "macos",
"architecture": "arm64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "nodejs"
},
{
"verification_scope": "nodejs-bindings-windows",
"os": "windows",
"architecture": "x86_64",
"toolchain": "stable",
"profile": "debug",
"features": [],
"binding_runtime": "nodejs"
}
],
"required_checks": [
"producer"
],
"artifacts": []
}
1 change: 1 addition & 0 deletions .github/receipts/jobs/constant-parity.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"constant-parity","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/dagger-rust-sdk.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"dagger-rust-sdk","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"dagger-rust-sdk"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/go-bindings-macos.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"go-bindings-macos","os":"macos","architecture":"arm64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"go"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/go-bindings-ubuntu.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"go-bindings-ubuntu","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"go"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/nodejs-bindings-macos.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"nodejs-bindings-macos","os":"macos","architecture":"arm64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"nodejs"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/nodejs-bindings-ubuntu.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"nodejs-bindings-ubuntu","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"nodejs"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/nodejs-bindings-windows.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"nodejs-bindings-windows","os":"windows","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"nodejs"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/python-bindings-macos.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"python-bindings-macos","os":"macos","architecture":"arm64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"python"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/python-bindings-ubuntu.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"python-bindings-ubuntu","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"python"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/python-bindings-windows.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"python-bindings-windows","os":"windows","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"python"},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-audit.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-audit","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-deny-licenses-sources.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-deny-licenses-sources","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-ffi.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-ffi","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":["ffi"],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-lint.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-lint","os":"linux","architecture":"x86_64","toolchain":"1.88","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-msrv.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-msrv","os":"linux","architecture":"x86_64","toolchain":"1.88","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-test-macos-stable.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-test-macos-stable","os":"macos","architecture":"arm64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-test-ubuntu-beta.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-test-ubuntu-beta","os":"linux","architecture":"x86_64","toolchain":"beta","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-test-ubuntu-stable.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-test-ubuntu-stable","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/rust-test-windows-stable.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"CI","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"rust-test-windows-stable","os":"windows","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},"checks":["producer"]}
1 change: 1 addition & 0 deletions .github/receipts/jobs/swift-bindings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
{"schema":"pipeline-shard-job-manifest/v1","workflow":"Bindings","source_root":"$RUNNER_TEMP/sbom-receipt-source","lock_paths":["Cargo.lock","rust-toolchain.toml","dagger/rust-sdk/Cargo.lock","bindings/go/go.mod","bindings/python/pyproject.toml","bindings/nodejs/package-lock.json","bindings/swift/Package.swift"],"artifact_root":"$RUNNER_TEMP/sbom-receipt-source","artifacts":[],"target":{"verification_scope":"swift-bindings","os":"macos","architecture":"arm64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":"swift"},"checks":["producer"]}
19 changes: 19 additions & 0 deletions .github/receipts/rust-policy-manifest.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
{
"schema": "aggregate-policy-manifest/v1",
"workflow": "CI",
"source_root": "$RUNNER_TEMP/sbom-receipt-source",
"lock_paths": ["Cargo.lock", "rust-toolchain.toml"],
"artifact_root": "$RUNNER_TEMP/sbom-receipt-source",
"expected_targets": [
{"verification_scope":"rust-lint","os":"linux","architecture":"x86_64","toolchain":"1.88","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-msrv","os":"linux","architecture":"x86_64","toolchain":"1.88","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-test-ubuntu-stable","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-test-macos-stable","os":"macos","architecture":"arm64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-test-windows-stable","os":"windows","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-test-ubuntu-beta","os":"linux","architecture":"x86_64","toolchain":"beta","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-deny-licenses-sources","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null},
{"verification_scope":"rust-audit","os":"linux","architecture":"x86_64","toolchain":"stable","profile":"debug","features":[],"binding_runtime":null}
],
"required_checks": ["producer"],
"artifacts": []
}
Loading
Loading