From b3e54bb3a5426ad947706dd219d8ae7d767876e8 Mon Sep 17 00:00:00 2001 From: Jocelyn Castellano Date: Fri, 12 Jan 2024 14:35:23 -0800 Subject: [PATCH 1/9] Add provenance to Github build --- .github/workflows/gradle.yml | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index bd0ff30..a68bba0 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -12,12 +12,12 @@ on: pull_request: workflow_dispatch: -permissions: - contents: read - jobs: build: - + permissions: + id-token: write + contents: read + actions: read runs-on: ubuntu-latest steps: @@ -51,7 +51,12 @@ jobs: run: gpg --detach-sign -a ./build/libs/*.jar env: GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }} - + + - name: Generate provenance information + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 + with: + artifact-list: ./build/libs/*.jar + - name: Upload a Build Artifact uses: actions/upload-artifact@v3.1.1 with: From 7f5b339cb12bd1b42bd88cedeb586bf0a8c37f8c Mon Sep 17 00:00:00 2001 From: PandaNinjas Date: Fri, 12 Jan 2024 14:39:20 -0800 Subject: [PATCH 2/9] Revert "Add provenance to Github build" This reverts commit b3e54bb3a5426ad947706dd219d8ae7d767876e8. --- .github/workflows/gradle.yml | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml index a68bba0..bd0ff30 100644 --- a/.github/workflows/gradle.yml +++ b/.github/workflows/gradle.yml @@ -12,12 +12,12 @@ on: pull_request: workflow_dispatch: +permissions: + contents: read + jobs: build: - permissions: - id-token: write - contents: read - actions: read + runs-on: ubuntu-latest steps: @@ -51,12 +51,7 @@ jobs: run: gpg --detach-sign -a ./build/libs/*.jar env: GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }} - - - name: Generate provenance information - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 - with: - artifact-list: ./build/libs/*.jar - + - name: Upload a Build Artifact uses: actions/upload-artifact@v3.1.1 with: From c19b883c6a2209f2e00009b799bec25a56407d16 Mon Sep 17 00:00:00 2001 From: Jocelyn Castellano Date: Fri, 12 Jan 2024 14:42:13 -0800 Subject: [PATCH 3/9] Add provenance builds in the right place --- .github/workflows/build-with-provenance.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 .github/workflows/build-with-provenance.yml diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml new file mode 100644 index 0000000..f9b2644 --- /dev/null +++ b/.github/workflows/build-with-provenance.yml @@ -0,0 +1,16 @@ +name: Build with SLSA provenance +on: + push: + workflow_dispatch: + +permissions: read-all + +jobs: + build: + permissions: + id-token: write + contents: read + actions: read + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 + with: + artifact-list: ./build/libs/*.jar From 73240fa52aa909bd79a2e8139d0977e58e5e3078 Mon Sep 17 00:00:00 2001 From: Jocelyn Castellano Date: Fri, 12 Jan 2024 14:46:01 -0800 Subject: [PATCH 4/9] Use java version 8 --- .github/workflows/build-with-provenance.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml index f9b2644..49f5288 100644 --- a/.github/workflows/build-with-provenance.yml +++ b/.github/workflows/build-with-provenance.yml @@ -14,3 +14,4 @@ jobs: uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 with: artifact-list: ./build/libs/*.jar + jdk-version: 8 From 702256480a3b48439099905002e611a8003c9581 Mon Sep 17 00:00:00 2001 From: Jocelyn Castellano Date: Fri, 12 Jan 2024 16:24:35 -0800 Subject: [PATCH 5/9] Add version --- .github/workflows/build-with-provenance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml index 49f5288..c08e1fa 100644 --- a/.github/workflows/build-with-provenance.yml +++ b/.github/workflows/build-with-provenance.yml @@ -13,5 +13,5 @@ jobs: actions: read uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 with: - artifact-list: ./build/libs/*.jar + artifact-list: ./build/libs/NoSession-GRADLE_VERSION.jar jdk-version: 8 From d99f5e3342b7ec19be5f8fe88a42d3b78a376bde Mon Sep 17 00:00:00 2001 From: Jocelyn Castellano Date: Fri, 12 Jan 2024 16:42:10 -0800 Subject: [PATCH 6/9] Update build-with-provenance.yml --- .github/workflows/build-with-provenance.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml index c08e1fa..699c976 100644 --- a/.github/workflows/build-with-provenance.yml +++ b/.github/workflows/build-with-provenance.yml @@ -15,3 +15,5 @@ jobs: with: artifact-list: ./build/libs/NoSession-GRADLE_VERSION.jar jdk-version: 8 + directory: . + From bd110cd2e5d849f8243df176575bd049b122bfe1 Mon Sep 17 00:00:00 2001 From: pandaninjas Date: Tue, 16 Jan 2024 09:30:37 -0800 Subject: [PATCH 7/9] Update to new SLSA version --- .github/workflows/build-with-provenance.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml index 699c976..6f33fe3 100644 --- a/.github/workflows/build-with-provenance.yml +++ b/.github/workflows/build-with-provenance.yml @@ -1,6 +1,6 @@ name: Build with SLSA provenance on: - push: + push: workflow_dispatch: permissions: read-all @@ -11,7 +11,7 @@ jobs: id-token: write contents: read actions: read - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@v1.9.0 + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@b54dfc3dabee98538a5bdaf1f6707856d43ca4ba with: artifact-list: ./build/libs/NoSession-GRADLE_VERSION.jar jdk-version: 8 From 7df7a9c4fb78cced83de7fe5282a5788fbbec15a Mon Sep 17 00:00:00 2001 From: pandaninjas Date: Thu, 18 Jan 2024 09:58:09 -0800 Subject: [PATCH 8/9] Update build-with-provenance.yml --- .github/workflows/build-with-provenance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml index 6f33fe3..75b4d50 100644 --- a/.github/workflows/build-with-provenance.yml +++ b/.github/workflows/build-with-provenance.yml @@ -11,7 +11,7 @@ jobs: id-token: write contents: read actions: read - uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@b54dfc3dabee98538a5bdaf1f6707856d43ca4ba + uses: pandaninjas/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@patch-2-test with: artifact-list: ./build/libs/NoSession-GRADLE_VERSION.jar jdk-version: 8 From 7dbbf1c36abba57c6ae9650c9ba166d39f047d8a Mon Sep 17 00:00:00 2001 From: pandaninjas Date: Fri, 16 Feb 2024 09:19:28 -0800 Subject: [PATCH 9/9] Update build-with-provenance.yml --- .github/workflows/build-with-provenance.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/build-with-provenance.yml b/.github/workflows/build-with-provenance.yml index 75b4d50..2bfe243 100644 --- a/.github/workflows/build-with-provenance.yml +++ b/.github/workflows/build-with-provenance.yml @@ -11,7 +11,7 @@ jobs: id-token: write contents: read actions: read - uses: pandaninjas/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@patch-2-test + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_gradle_slsa3.yml@main with: artifact-list: ./build/libs/NoSession-GRADLE_VERSION.jar jdk-version: 8