Consolidate attestation actions (#346)
* consolidate attestation actions Signed-off-by: Brian DeHamer <bdehamer@github.com> * better errors Signed-off-by: Brian DeHamer <bdehamer@github.com> * Update src/sbom.ts Co-authored-by: Austin Beattie <ajbeattie@github.com> * clarify dedupe comment Signed-off-by: Brian DeHamer <bdehamer@github.com> --------- Signed-off-by: Brian DeHamer <bdehamer@github.com> Co-authored-by: Austin Beattie <ajbeattie@github.com>
This commit is contained in:
Brian DeHamer
219
__tests__/attest.test.ts
Normal file
219
__tests__/attest.test.ts
Normal file
@@ -0,0 +1,219 @@
|
||||
import * as attest from '@actions/attest'
|
||||
import * as github from '@actions/github'
|
||||
import * as oci from '@sigstore/oci'
|
||||
import * as localAttest from '../src/attest'
|
||||
import { createAttestation, repoOwnerIsOrg } from '../src/attest'
|
||||
|
||||
const subjectName = 'ghcr.io/foo/bar'
|
||||
const subjectDigest =
|
||||
'sha256:7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
|
||||
|
||||
const predicate = {
|
||||
type: 'https://in-toto.io/attestation/release/v0.1',
|
||||
params: {}
|
||||
}
|
||||
|
||||
describe('repoOwnerIsOrg', () => {
|
||||
const originalContext = { ...github.context }
|
||||
|
||||
afterEach(() => {
|
||||
setGHContext(originalContext)
|
||||
jest.restoreAllMocks()
|
||||
})
|
||||
|
||||
it('returns true when repo owner is an organization', async () => {
|
||||
setGHContext({
|
||||
repo: { owner: 'my-org', repo: 'my-repo' }
|
||||
})
|
||||
|
||||
jest.spyOn(github, 'getOctokit').mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
get: jest.fn().mockResolvedValue({
|
||||
data: { owner: { type: 'Organization' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
} as unknown as ReturnType<typeof github.getOctokit>)
|
||||
|
||||
const result = await repoOwnerIsOrg('gh-token')
|
||||
expect(result).toBe(true)
|
||||
})
|
||||
|
||||
it('returns false when repo owner is a user', async () => {
|
||||
setGHContext({
|
||||
repo: { owner: 'my-user', repo: 'my-repo' }
|
||||
})
|
||||
|
||||
jest.spyOn(github, 'getOctokit').mockReturnValue({
|
||||
rest: {
|
||||
repos: {
|
||||
get: jest.fn().mockResolvedValue({
|
||||
data: { owner: { type: 'User' } }
|
||||
})
|
||||
}
|
||||
}
|
||||
} as unknown as ReturnType<typeof github.getOctokit>)
|
||||
|
||||
const result = await repoOwnerIsOrg('gh-token')
|
||||
expect(result).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
describe('createAttestation', () => {
|
||||
const originalEnv = process.env
|
||||
const originalContext = { ...github.context }
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
})
|
||||
|
||||
afterEach(() => {
|
||||
process.env = originalEnv
|
||||
setGHContext(originalContext)
|
||||
})
|
||||
|
||||
describe('when createStorageRecord is false', () => {
|
||||
beforeEach(() => {
|
||||
// Mock the core attest function
|
||||
jest.spyOn(attest, 'attest').mockResolvedValue({
|
||||
bundle: {
|
||||
mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json'
|
||||
},
|
||||
certificate: 'cert',
|
||||
tlogID: 'tlog-123',
|
||||
attestationID: 'att-123'
|
||||
} as attest.Attestation)
|
||||
|
||||
// Mock OCI functions
|
||||
jest.spyOn(oci, 'getRegistryCredentials').mockReturnValue({
|
||||
username: 'user',
|
||||
password: 'pass'
|
||||
})
|
||||
jest.spyOn(oci, 'attachArtifactToImage').mockResolvedValue({
|
||||
digest: 'sha256:abc123',
|
||||
mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
|
||||
size: 100
|
||||
})
|
||||
})
|
||||
|
||||
it('skips storage record creation', async () => {
|
||||
const createStorageRecordSpy = jest.spyOn(attest, 'createStorageRecord')
|
||||
const subjects = [
|
||||
{
|
||||
name: subjectName,
|
||||
digest: { sha256: subjectDigest.replace('sha256:', '') }
|
||||
}
|
||||
]
|
||||
|
||||
const result = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance: 'github',
|
||||
pushToRegistry: true,
|
||||
createStorageRecord: false,
|
||||
githubToken: 'gh-token'
|
||||
})
|
||||
|
||||
expect(result.attestationDigest).toBe('sha256:abc123')
|
||||
expect(createStorageRecordSpy).not.toHaveBeenCalled()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when storage records are empty', () => {
|
||||
beforeEach(() => {
|
||||
jest.spyOn(attest, 'attest').mockResolvedValue({
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' },
|
||||
certificate: 'cert',
|
||||
tlogID: 'tlog-123',
|
||||
attestationID: 'att-123'
|
||||
} as attest.Attestation)
|
||||
|
||||
jest.spyOn(oci, 'getRegistryCredentials').mockReturnValue({
|
||||
username: 'user',
|
||||
password: 'pass'
|
||||
})
|
||||
jest.spyOn(oci, 'attachArtifactToImage').mockResolvedValue({
|
||||
digest: 'sha256:abc123',
|
||||
mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
|
||||
size: 100
|
||||
})
|
||||
|
||||
// Mock repoOwnerIsOrg
|
||||
jest.spyOn(localAttest, 'repoOwnerIsOrg').mockResolvedValue(true)
|
||||
|
||||
// Mock createStorageRecord to return empty array
|
||||
jest.spyOn(attest, 'createStorageRecord').mockResolvedValue([])
|
||||
})
|
||||
|
||||
it('handles empty storage records gracefully', async () => {
|
||||
const subjects = [
|
||||
{
|
||||
name: subjectName,
|
||||
digest: { sha256: subjectDigest.replace('sha256:', '') }
|
||||
}
|
||||
]
|
||||
|
||||
// This exercises the empty records code path for coverage
|
||||
const result = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance: 'github',
|
||||
pushToRegistry: true,
|
||||
createStorageRecord: true,
|
||||
githubToken: 'gh-token'
|
||||
})
|
||||
|
||||
expect(result.attestationDigest).toBe('sha256:abc123')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when subject has unsupported protocol', () => {
|
||||
beforeEach(() => {
|
||||
jest.spyOn(attest, 'attest').mockResolvedValue({
|
||||
bundle: { mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json' },
|
||||
certificate: 'cert',
|
||||
tlogID: 'tlog-123',
|
||||
attestationID: 'att-123'
|
||||
} as attest.Attestation)
|
||||
|
||||
jest.spyOn(oci, 'getRegistryCredentials').mockReturnValue({
|
||||
username: 'user',
|
||||
password: 'pass'
|
||||
})
|
||||
jest.spyOn(oci, 'attachArtifactToImage').mockResolvedValue({
|
||||
digest: 'sha256:abc123',
|
||||
mediaType: 'application/vnd.dev.sigstore.bundle.v0.3+json',
|
||||
size: 100
|
||||
})
|
||||
|
||||
// Mock repoOwnerIsOrg
|
||||
jest.spyOn(localAttest, 'repoOwnerIsOrg').mockResolvedValue(true)
|
||||
})
|
||||
|
||||
it('handles unsupported protocol gracefully', async () => {
|
||||
const subjects = [
|
||||
{
|
||||
name: 'http://registry.example.com/foo/bar',
|
||||
digest: { sha256: subjectDigest.replace('sha256:', '') }
|
||||
}
|
||||
]
|
||||
|
||||
// This exercises the unsupported protocol code path for coverage
|
||||
const result = await createAttestation(subjects, predicate, {
|
||||
sigstoreInstance: 'github',
|
||||
pushToRegistry: true,
|
||||
createStorageRecord: true,
|
||||
githubToken: 'gh-token'
|
||||
})
|
||||
|
||||
// Should complete without throwing (error is caught and logged as warning)
|
||||
expect(result.attestationDigest).toBe('sha256:abc123')
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
function setGHContext(context: object): void {
|
||||
Object.defineProperty(github, 'context', { value: context })
|
||||
}
|
||||
190
__tests__/detect.test.ts
Normal file
190
__tests__/detect.test.ts
Normal file
@@ -0,0 +1,190 @@
|
||||
import {
|
||||
detectAttestationType,
|
||||
validateAttestationInputs,
|
||||
DetectionInputs
|
||||
} from '../src/detect'
|
||||
|
||||
describe('detectAttestationType', () => {
|
||||
const blankInputs: DetectionInputs = {
|
||||
sbomPath: '',
|
||||
predicateType: '',
|
||||
predicate: '',
|
||||
predicatePath: ''
|
||||
}
|
||||
|
||||
describe('when no inputs are provided', () => {
|
||||
it('returns provenance', () => {
|
||||
expect(detectAttestationType(blankInputs)).toBe('provenance')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is provided', () => {
|
||||
it('returns sbom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('sbom')
|
||||
})
|
||||
|
||||
it('returns sbom even when predicate inputs are also provided', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('sbom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type is provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate is provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-path is provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type and predicate are provided', () => {
|
||||
it('returns custom', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(detectAttestationType(inputs)).toBe('custom')
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('validateAttestationInputs', () => {
|
||||
const blankInputs: DetectionInputs = {
|
||||
sbomPath: '',
|
||||
predicateType: '',
|
||||
predicate: '',
|
||||
predicatePath: ''
|
||||
}
|
||||
|
||||
describe('when no inputs are provided', () => {
|
||||
it('does not throw', () => {
|
||||
expect(() => validateAttestationInputs(blankInputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is provided alone', () => {
|
||||
it('does not throw', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is combined with predicate-type', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicateType: 'https://example.com/predicate'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/Cannot specify sbom-path together with/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is combined with predicate', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/Cannot specify sbom-path together with/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom-path is combined with predicate-path', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/Cannot specify sbom-path together with/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate is provided without predicate-type', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/predicate-type is required/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-path is provided without predicate-type', () => {
|
||||
it('throws an error', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).toThrow(
|
||||
/predicate-type is required/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type and predicate are provided', () => {
|
||||
it('does not throw', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicate: '{}'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate-type and predicate-path are provided', () => {
|
||||
it('does not throw', () => {
|
||||
const inputs: DetectionInputs = {
|
||||
...blankInputs,
|
||||
predicateType: 'https://example.com/predicate',
|
||||
predicatePath: '/path/to/predicate.json'
|
||||
}
|
||||
expect(() => validateAttestationInputs(inputs)).not.toThrow()
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -5,19 +5,20 @@
|
||||
* Specifically, the inputs listed in `action.yml` should be set as environment
|
||||
* variables following the pattern `INPUT_<INPUT_NAME>`.
|
||||
*/
|
||||
import * as attest from '@actions/attest'
|
||||
import * as core from '@actions/core'
|
||||
import * as github from '@actions/github'
|
||||
import { mockFulcio, mockRekor, mockTSA } from '@sigstore/mock'
|
||||
import * as oci from '@sigstore/oci'
|
||||
import * as attest from '@actions/attest'
|
||||
import * as localAttest from '../src/attest'
|
||||
import fs from 'fs/promises'
|
||||
import nock from 'nock'
|
||||
import os from 'os'
|
||||
import path from 'path'
|
||||
import { MockAgent, setGlobalDispatcher } from 'undici'
|
||||
import * as localAttest from '../src/attest'
|
||||
import { SEARCH_PUBLIC_GOOD_URL } from '../src/endpoints'
|
||||
import * as main from '../src/main'
|
||||
import * as provenance from '../src/provenance'
|
||||
|
||||
// Mock the GitHub Actions core library
|
||||
const infoMock = jest.spyOn(core, 'info')
|
||||
@@ -43,6 +44,7 @@ const defaultInputs: main.RunInputs = {
|
||||
predicate: '',
|
||||
predicateType: '',
|
||||
predicatePath: '',
|
||||
sbomPath: '',
|
||||
subjectName: '',
|
||||
subjectDigest: '',
|
||||
subjectPath: '',
|
||||
@@ -187,8 +189,9 @@ describe('action', () => {
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalledWith()
|
||||
expect(infoMock).toHaveBeenNthCalledWith(1, 'Attestation type: Custom')
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
2,
|
||||
expect.stringMatching(
|
||||
`Attestation created for ${subjectName}@${subjectDigest}`
|
||||
)
|
||||
@@ -198,15 +201,15 @@ describe('action', () => {
|
||||
expect.stringMatching('GitHub Sigstore')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
3,
|
||||
expect.stringMatching('-----BEGIN CERTIFICATE-----')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
3,
|
||||
4,
|
||||
expect.stringMatching(/attestation uploaded/i)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
4,
|
||||
5,
|
||||
expect.stringMatching(attestationID)
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
@@ -281,8 +284,9 @@ describe('action', () => {
|
||||
expect(repoOwnerIsOrgSpy).toHaveBeenCalled()
|
||||
expect(createStorageRecordSpy).toHaveBeenCalled()
|
||||
expect(warningMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenNthCalledWith(1, 'Attestation type: Custom')
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
2,
|
||||
expect.stringMatching(
|
||||
`Attestation created for ${subjectName}@${subjectDigest}`
|
||||
)
|
||||
@@ -292,31 +296,31 @@ describe('action', () => {
|
||||
expect.stringMatching('Public Good Sigstore')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
2,
|
||||
3,
|
||||
expect.stringMatching('-----BEGIN CERTIFICATE-----')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
3,
|
||||
4,
|
||||
expect.stringMatching(/signature uploaded/i)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
4,
|
||||
5,
|
||||
expect.stringMatching(SEARCH_PUBLIC_GOOD_URL)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
5,
|
||||
6,
|
||||
expect.stringMatching(/attestation uploaded/i)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
6,
|
||||
7,
|
||||
expect.stringMatching(attestationID)
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
9,
|
||||
10,
|
||||
expect.stringMatching('Storage record created')
|
||||
)
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
10,
|
||||
11,
|
||||
expect.stringMatching('Storage record IDs: 987654321')
|
||||
)
|
||||
expect(setOutputMock).toHaveBeenNthCalledWith(
|
||||
@@ -447,8 +451,9 @@ describe('action', () => {
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenNthCalledWith(1, 'Attestation type: Custom')
|
||||
expect(infoMock).toHaveBeenNthCalledWith(
|
||||
1,
|
||||
2,
|
||||
expect.stringMatching('Attestation created for 5 subjects')
|
||||
)
|
||||
})
|
||||
@@ -496,11 +501,178 @@ describe('action', () => {
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'Too many subjects specified. The maximum number of subjects is 1024.'
|
||||
'Too many subjects specified (1025). The maximum number of subjects is 1024.'
|
||||
)
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('attestation type detection', () => {
|
||||
describe('when sbom-path is provided with predicate inputs', () => {
|
||||
it('sets a failed status for conflicting inputs', async () => {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
sbomPath: '/path/to/sbom.json',
|
||||
predicateType: 'https://example.com/predicate',
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'Cannot specify sbom-path together with predicate-type, predicate, or predicate-path'
|
||||
)
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when predicate is provided without predicate-type', () => {
|
||||
it('sets a failed status for missing predicate-type', async () => {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
predicate: '{}',
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).toHaveBeenCalledWith(
|
||||
new Error(
|
||||
'predicate-type is required when using predicate or predicate-path'
|
||||
)
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when custom attestation inputs are provided', () => {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
predicateType,
|
||||
predicate,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
beforeEach(async () => {
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
})
|
||||
await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
|
||||
})
|
||||
|
||||
it('logs the attestation type as Custom', async () => {
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith('Attestation type: Custom')
|
||||
})
|
||||
})
|
||||
|
||||
describe('when provenance attestation is detected', () => {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
const mockProvPredicate = {
|
||||
type: 'https://slsa.dev/provenance/v1',
|
||||
params: { buildDefinition: {}, runDetails: {} }
|
||||
}
|
||||
|
||||
beforeEach(async () => {
|
||||
jest
|
||||
.spyOn(provenance, 'generateProvenancePredicate')
|
||||
.mockResolvedValue(mockProvPredicate)
|
||||
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
})
|
||||
await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
|
||||
})
|
||||
|
||||
it('logs the attestation type as Build Provenance and generates predicate', async () => {
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith(
|
||||
'Attestation type: Build Provenance'
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when sbom attestation is detected', () => {
|
||||
let tmpDir: string
|
||||
let sbomFilePath: string
|
||||
|
||||
const spdxSBOM = {
|
||||
spdxVersion: 'SPDX-2.3',
|
||||
SPDXID: 'SPDXRef-DOCUMENT',
|
||||
name: 'test-package',
|
||||
packages: []
|
||||
}
|
||||
|
||||
beforeEach(async () => {
|
||||
tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'main-test-'))
|
||||
sbomFilePath = path.join(tmpDir, 'sbom.spdx.json')
|
||||
await fs.writeFile(sbomFilePath, JSON.stringify(spdxSBOM))
|
||||
|
||||
setGHContext({
|
||||
payload: { repository: { visibility: 'private' } },
|
||||
repo: { owner: 'foo', repo: 'bar' }
|
||||
})
|
||||
|
||||
await mockFulcio({
|
||||
baseURL: 'https://fulcio.githubapp.com',
|
||||
strict: false
|
||||
})
|
||||
await mockTSA({ baseURL: 'https://timestamp.githubapp.com' })
|
||||
})
|
||||
|
||||
afterEach(async () => {
|
||||
await fs.rm(tmpDir, { recursive: true })
|
||||
})
|
||||
|
||||
it('logs the attestation type as SBOM and generates predicate', async () => {
|
||||
const inputs: main.RunInputs = {
|
||||
...defaultInputs,
|
||||
subjectDigest,
|
||||
subjectName,
|
||||
sbomPath: sbomFilePath,
|
||||
githubToken: 'gh-token'
|
||||
}
|
||||
|
||||
await main.run(inputs)
|
||||
|
||||
expect(runMock).toHaveReturned()
|
||||
expect(setFailedMock).not.toHaveBeenCalled()
|
||||
expect(infoMock).toHaveBeenCalledWith('Attestation type: SBOM')
|
||||
})
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
// Stubbing the GitHub context is a bit tricky. We need to use
|
||||
|
||||
43
__tests__/provenance.test.ts
Normal file
43
__tests__/provenance.test.ts
Normal file
@@ -0,0 +1,43 @@
|
||||
import { generateProvenancePredicate } from '../src/provenance'
|
||||
import { buildSLSAProvenancePredicate } from '@actions/attest'
|
||||
|
||||
jest.mock('@actions/attest', () => ({
|
||||
buildSLSAProvenancePredicate: jest.fn()
|
||||
}))
|
||||
|
||||
describe('generateProvenancePredicate', () => {
|
||||
const mockPredicate = {
|
||||
type: 'https://slsa.dev/provenance/v1',
|
||||
params: {
|
||||
buildDefinition: {
|
||||
buildType: 'https://actions.github.io/buildtypes/workflow/v1'
|
||||
},
|
||||
runDetails: {
|
||||
builder: { id: 'https://github.com/actions/runner' }
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
jest.clearAllMocks()
|
||||
;(buildSLSAProvenancePredicate as jest.Mock).mockResolvedValue(
|
||||
mockPredicate
|
||||
)
|
||||
})
|
||||
|
||||
it('returns the SLSA provenance predicate', async () => {
|
||||
const result = await generateProvenancePredicate()
|
||||
|
||||
expect(buildSLSAProvenancePredicate).toHaveBeenCalledTimes(1)
|
||||
expect(result).toEqual(mockPredicate)
|
||||
})
|
||||
|
||||
it('propagates errors from buildSLSAProvenancePredicate', async () => {
|
||||
const error = new Error('Failed to build provenance')
|
||||
;(buildSLSAProvenancePredicate as jest.Mock).mockRejectedValue(error)
|
||||
|
||||
await expect(generateProvenancePredicate()).rejects.toThrow(
|
||||
'Failed to build provenance'
|
||||
)
|
||||
})
|
||||
})
|
||||
161
__tests__/sbom.test.ts
Normal file
161
__tests__/sbom.test.ts
Normal file
@@ -0,0 +1,161 @@
|
||||
import fs from 'fs/promises'
|
||||
import os from 'os'
|
||||
import path from 'path'
|
||||
import { parseSBOMFromPath, generateSBOMPredicate, SBOM } from '../src/sbom'
|
||||
|
||||
describe('parseSBOMFromPath', () => {
|
||||
let tmpDir: string
|
||||
|
||||
beforeEach(async () => {
|
||||
tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sbom-test-'))
|
||||
})
|
||||
|
||||
afterEach(async () => {
|
||||
await fs.rm(tmpDir, { recursive: true })
|
||||
})
|
||||
|
||||
describe('when file does not exist', () => {
|
||||
it('throws an error', async () => {
|
||||
await expect(parseSBOMFromPath('/nonexistent/file.json')).rejects.toThrow(
|
||||
/SBOM file not found/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains valid SPDX SBOM', () => {
|
||||
const spdxSBOM = {
|
||||
spdxVersion: 'SPDX-2.3',
|
||||
SPDXID: 'SPDXRef-DOCUMENT',
|
||||
name: 'test-package',
|
||||
packages: []
|
||||
}
|
||||
|
||||
it('returns SBOM with type spdx', async () => {
|
||||
const filePath = path.join(tmpDir, 'sbom.spdx.json')
|
||||
await fs.writeFile(filePath, JSON.stringify(spdxSBOM))
|
||||
|
||||
const result = await parseSBOMFromPath(filePath)
|
||||
|
||||
expect(result.type).toBe('spdx')
|
||||
expect(result.object).toEqual(spdxSBOM)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains valid CycloneDX SBOM', () => {
|
||||
const cyclonedxSBOM = {
|
||||
bomFormat: 'CycloneDX',
|
||||
specVersion: '1.4',
|
||||
serialNumber: 'urn:uuid:12345',
|
||||
components: []
|
||||
}
|
||||
|
||||
it('returns SBOM with type cyclonedx', async () => {
|
||||
const filePath = path.join(tmpDir, 'sbom.cdx.json')
|
||||
await fs.writeFile(filePath, JSON.stringify(cyclonedxSBOM))
|
||||
|
||||
const result = await parseSBOMFromPath(filePath)
|
||||
|
||||
expect(result.type).toBe('cyclonedx')
|
||||
expect(result.object).toEqual(cyclonedxSBOM)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains invalid SBOM format', () => {
|
||||
it('throws an error', async () => {
|
||||
const filePath = path.join(tmpDir, 'invalid.json')
|
||||
await fs.writeFile(filePath, JSON.stringify({ random: 'data' }))
|
||||
|
||||
await expect(parseSBOMFromPath(filePath)).rejects.toThrow(
|
||||
/Unsupported SBOM format/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file contains invalid JSON', () => {
|
||||
it('throws an error', async () => {
|
||||
const filePath = path.join(tmpDir, 'invalid.json')
|
||||
await fs.writeFile(filePath, 'not valid json')
|
||||
|
||||
await expect(parseSBOMFromPath(filePath)).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
describe('when file exceeds maximum size', () => {
|
||||
it('throws an error', async () => {
|
||||
const filePath = path.join(tmpDir, 'large.json')
|
||||
// Create a file larger than 16MB
|
||||
const largeContent = 'x'.repeat(17 * 1024 * 1024)
|
||||
await fs.writeFile(filePath, largeContent)
|
||||
|
||||
await expect(parseSBOMFromPath(filePath)).rejects.toThrow(
|
||||
/SBOM file exceeds maximum allowed size/
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('generateSBOMPredicate', () => {
|
||||
describe('for SPDX SBOM', () => {
|
||||
const spdxSBOM: SBOM = {
|
||||
type: 'spdx',
|
||||
object: {
|
||||
spdxVersion: 'SPDX-2.3',
|
||||
SPDXID: 'SPDXRef-DOCUMENT',
|
||||
name: 'test-package'
|
||||
}
|
||||
}
|
||||
|
||||
it('returns predicate with correct SPDX type', () => {
|
||||
const predicate = generateSBOMPredicate(spdxSBOM)
|
||||
|
||||
expect(predicate.type).toBe('https://spdx.dev/Document/v2.3')
|
||||
expect(predicate.params).toEqual(spdxSBOM.object)
|
||||
})
|
||||
})
|
||||
|
||||
describe('for CycloneDX SBOM', () => {
|
||||
const cyclonedxSBOM: SBOM = {
|
||||
type: 'cyclonedx',
|
||||
object: {
|
||||
bomFormat: 'CycloneDX',
|
||||
specVersion: '1.4',
|
||||
serialNumber: 'urn:uuid:12345'
|
||||
}
|
||||
}
|
||||
|
||||
it('returns predicate with correct CycloneDX type', () => {
|
||||
const predicate = generateSBOMPredicate(cyclonedxSBOM)
|
||||
|
||||
expect(predicate.type).toBe('https://cyclonedx.org/bom')
|
||||
expect(predicate.params).toEqual(cyclonedxSBOM.object)
|
||||
})
|
||||
})
|
||||
|
||||
describe('for SPDX without version', () => {
|
||||
const invalidSBOM: SBOM = {
|
||||
type: 'spdx',
|
||||
object: {
|
||||
SPDXID: 'SPDXRef-DOCUMENT'
|
||||
}
|
||||
}
|
||||
|
||||
it('throws an error', () => {
|
||||
expect(() => generateSBOMPredicate(invalidSBOM)).toThrow(
|
||||
/Cannot find spdxVersion/
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('for unsupported SBOM type', () => {
|
||||
const unsupportedSBOM = {
|
||||
type: 'unknown' as SBOM['type'],
|
||||
object: { foo: 'bar' }
|
||||
}
|
||||
|
||||
it('throws an error', () => {
|
||||
expect(() => generateSBOMPredicate(unsupportedSBOM)).toThrow(
|
||||
/Unsupported SBOM format/
|
||||
)
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -524,6 +524,39 @@ f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_lin
|
||||
})
|
||||
})
|
||||
|
||||
describe('when specifying a subject checksums string with duplicates', () => {
|
||||
const checksums = `
|
||||
f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_linux_386
|
||||
f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e demo_0.0.1_linux_386
|
||||
187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d *demo_0.0.1_linux_amd64`
|
||||
|
||||
it('returns de-duplicated subjects', async () => {
|
||||
const inputs: SubjectInputs = {
|
||||
...blankInputs,
|
||||
subjectChecksums: checksums
|
||||
}
|
||||
const subjects = await subjectFromInputs(inputs)
|
||||
|
||||
expect(subjects).toBeDefined()
|
||||
expect(subjects).toHaveLength(2)
|
||||
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_linux_386',
|
||||
digest: {
|
||||
sha256:
|
||||
'f861e68a080799ca83104630b56abb90d8dbcc5f8b5a8639cb691e269838f29e'
|
||||
}
|
||||
})
|
||||
expect(subjects).toContainEqual({
|
||||
name: 'demo_0.0.1_linux_amd64',
|
||||
digest: {
|
||||
sha256:
|
||||
'187dcd1506a170337415589ff00c8743f19d41cc31fca246c2739dfd450d0b9d'
|
||||
}
|
||||
})
|
||||
})
|
||||
})
|
||||
|
||||
describe('when specifying a subject checksums string with an unrecognized digest', () => {
|
||||
const checksums = `f861e demo_0.0.1_linux_386`
|
||||
|
||||
|
||||
Reference in New Issue
Block a user