chore: Make maven publisher an action #2482

AdamKorcz · 2023-07-26T21:41:11Z

Closes #2369

laurentsimon

Thanks @AdamKorcz Looking pretty good. Just a few nits and we should be ready to merge.

actions/maven/publish/action.yml

internal/builders/maven/README.md

actions/maven/publish/action.yml

internal/builders/maven/README.md

laurentsimon · 2023-07-26T22:30:13Z

@AdamKorcz please ping when the comments are resolved. I don't always know when I should re-review. Thanks!

AdamKorcz · 2023-07-28T20:02:33Z

@laurentsimon @ianlewis This one should be ready to review again. Note that this uses a plugin that hashes the artifacts and creates the json. Ideally this should be hosted at a slsa-framework-owned Maven Central repository account.

actions/maven/publish/action.yml

internal/builders/maven/README.md

actions/maven/publish/action.yml

internal/builders/maven/README.md

actions/maven/publish/action.yml

internal/builders/maven/README.md

AdamKorcz · 2023-07-31T23:06:59Z

Ready for another round of review except for #2482 (comment).

actions/maven/publish/action.yml

...aven/publish/slsa-hashing-plugin/src/main/java/io/github/slsa-framework/JarfileHashMojo.java

internal/builders/maven/action.yml

Signed-off-by: AdamKorcz <[email protected]>

* Create JarfileHashMojo.java Signed-off-by: AdamKorcz <[email protected]> * Create pom.xml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Delete JarfileHashMojo.java Signed-off-by: AdamKorcz <[email protected]> * Delete pom.xml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update README.md Signed-off-by: AdamKorcz <[email protected]> * Update action.yml Signed-off-by: AdamKorcz <[email protected]> * Update README.md Signed-off-by: AdamKorcz <[email protected]> * Update README.md Signed-off-by: AdamKorcz <[email protected]> --------- Signed-off-by: AdamKorcz <[email protected]>

Signed-off-by: AdamKorcz <[email protected]>

Co-authored-by: Ian Lewis <[email protected]> Signed-off-by: AdamKorcz <[email protected]>

Signed-off-by: AdamKorcz <[email protected]>

actions/maven/publish/README.md

actions/maven/publish/action.yml

internal/builders/maven/action.yml

Signed-off-by: AdamKorcz <[email protected]>

AdamKorcz · 2023-08-01T21:01:38Z

@laurentsimon @ianlewis Please check again.

laurentsimon · 2023-08-01T21:52:35Z

actions/maven/publish/action.yml

+        SLSA_DIR: "${{ inputs.provenance-download-name }}"
+        PROVENANCE_FILES: "${{ inputs.provenance-download-name }}"
+      run: |
+        cd __BUILDER_CHECKOUT_DIR__/actions/maven/publish/slsa-hashing-plugin && mvn clean install && cd -


better to mve this to ../ to keep the git tree clean (some tools check for that), but we can do that later.

Signed-off-by: laurentsimon <[email protected]>

laurentsimon · 2023-08-01T21:56:30Z

actions/maven/publish/action.yml

+      uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
+      with:
+        repository: slsa-framework/slsa-github-generator
+        ref: v1.8.0


@AdamKorcz fyi I updated this to v1.8.0

@laurentsimon is this expected to work right now?

no its not. It will only work after the release. I'll work on #2508 to be sure we don't forget

@laurentsimon

Similar to #2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <[email protected]>

Closes slsa-framework#2369 --------- Signed-off-by: AdamKorcz <[email protected]> Signed-off-by: AdamKorcz <[email protected]> Signed-off-by: laurentsimon <[email protected]> Co-authored-by: Ian Lewis <[email protected]> Co-authored-by: laurentsimon <[email protected]> Signed-off-by: Noah Elzner <[email protected]>

@laurentsimon

Similar to slsa-framework#2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <[email protected]> Signed-off-by: Noah Elzner <[email protected]>

AdamKorcz requested review from asraa, ianlewis, joshuagl and laurentsimon as code owners July 26, 2023 21:41

laurentsimon reviewed Jul 26, 2023

View reviewed changes

ianlewis reviewed Jul 26, 2023

View reviewed changes

laurentsimon reviewed Jul 28, 2023

View reviewed changes

laurentsimon reviewed Jul 30, 2023

View reviewed changes

actions/maven/publish/action.yml Show resolved Hide resolved

internal/builders/maven/README.md Outdated Show resolved Hide resolved

internal/builders/maven/README.md Show resolved Hide resolved

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

ianlewis reviewed Jul 31, 2023

View reviewed changes

actions/maven/publish/action.yml Show resolved Hide resolved

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

internal/builders/maven/README.md Outdated Show resolved Hide resolved

AdamKorcz force-pushed the maven-publisher-to-action branch 2 times, most recently from f652d2d to 6e4ee0e Compare July 31, 2023 23:02

ianlewis reviewed Aug 1, 2023

View reviewed changes

AdamKorcz and others added 15 commits August 1, 2023 12:06

chore: Make maven publisher an action

614721d

Signed-off-by: AdamKorcz <[email protected]>

fix nits

a7778a8

Signed-off-by: AdamKorcz <[email protected]>

lowercase more variables

eb64e50

Signed-off-by: AdamKorcz <[email protected]>

remove '@'

3e04e30

Signed-off-by: AdamKorcz <[email protected]>

use secure-project-checkout at main

d2cacb8

Signed-off-by: AdamKorcz <[email protected]>

Update README.md

0bf054b

Signed-off-by: AdamKorcz <[email protected]>

Update README.md

e8023f3

Signed-off-by: AdamKorcz <[email protected]>

remove .intoto

2581ef9

Signed-off-by: AdamKorcz <[email protected]>

remove two more cases of .intoto

9b2cae9

Signed-off-by: AdamKorcz <[email protected]>

Update README.md

e23e88e

Signed-off-by: AdamKorcz <[email protected]>

Update README.md

45afa78

Signed-off-by: AdamKorcz <[email protected]>

Update actions/maven/publish/action.yml

8cb0d99

Co-authored-by: Ian Lewis <[email protected]> Signed-off-by: AdamKorcz <[email protected]>

Update actions/maven/publish/action.yml

aa0ab47

Co-authored-by: Ian Lewis <[email protected]> Signed-off-by: AdamKorcz <[email protected]>

Install hashing plugin from tool dir (#2)

b12e9f3

Signed-off-by: AdamKorcz <[email protected]>

AdamKorcz added 7 commits August 1, 2023 20:24

rename __TOOL_CHECKOUT_DIR__ to __BUILDER_CHECKOUT_DIR__

9bee2f4

Signed-off-by: AdamKorcz <[email protected]>

debug

20fa4a7

Signed-off-by: AdamKorcz <[email protected]>

Update action.yml

6dae016

Signed-off-by: AdamKorcz <[email protected]>

Update action.yml

4c021a1

Signed-off-by: AdamKorcz <[email protected]>

Update action.yml

7081556

Signed-off-by: AdamKorcz <[email protected]>

Update action.yml

46897c8

Signed-off-by: AdamKorcz <[email protected]>

Update action.yml

fcb67a5

Signed-off-by: AdamKorcz <[email protected]>

laurentsimon reviewed Aug 1, 2023

View reviewed changes

actions/maven/publish/README.md Outdated Show resolved Hide resolved

laurentsimon reviewed Aug 1, 2023

View reviewed changes

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

laurentsimon reviewed Aug 1, 2023

View reviewed changes

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

laurentsimon reviewed Aug 1, 2023

View reviewed changes

internal/builders/maven/action.yml Outdated Show resolved Hide resolved

AdamKorcz added 6 commits August 1, 2023 21:28

rename Mojo

5838ba5

Signed-off-by: AdamKorcz <[email protected]>

rename tool dir to builder dir in maven builder

459f39f

Signed-off-by: AdamKorcz <[email protected]>

remove packages: read

f141f56

Signed-off-by: AdamKorcz <[email protected]>

test

0ca0fa3

Signed-off-by: AdamKorcz <[email protected]>

remove hyphen in java package name

d08ce2b

Signed-off-by: AdamKorcz <[email protected]>

revert debugging helpers

72c5617

Signed-off-by: AdamKorcz <[email protected]>

laurentsimon reviewed Aug 1, 2023

View reviewed changes

laurentsimon added 2 commits August 1, 2023 14:53

Update action.yml

f7fa441

Signed-off-by: laurentsimon <[email protected]>

Use v1.8.0 as ref

78a5806

Signed-off-by: laurentsimon <[email protected]>

laurentsimon approved these changes Aug 1, 2023

View reviewed changes

laurentsimon reviewed Aug 1, 2023

View reviewed changes

laurentsimon enabled auto-merge (squash) August 1, 2023 21:57

laurentsimon merged commit a594a20 into slsa-framework:main Aug 1, 2023

AdamKorcz mentioned this pull request Aug 1, 2023

chore: ref v1.8.0 instead of main #2509

Merged

laurentsimon pushed a commit that referenced this pull request Aug 1, 2023

chore: ref v1.8.0 instead of main (#2509)

9c94c20

Similar to #2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <[email protected]>

AdamKorcz deleted the maven-publisher-to-action branch August 4, 2023 11:25

chore: Make maven publisher an action #2482

chore: Make maven publisher an action #2482

Uh oh!

Conversation

AdamKorcz commented Jul 26, 2023

Uh oh!

laurentsimon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

laurentsimon commented Jul 26, 2023

Uh oh!

AdamKorcz commented Jul 28, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AdamKorcz commented Jul 31, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AdamKorcz commented Aug 1, 2023

Uh oh!

laurentsimon Aug 1, 2023

Choose a reason for hiding this comment

Uh oh!

laurentsimon Aug 1, 2023

Choose a reason for hiding this comment

Uh oh!

AdamKorcz Aug 1, 2023

Choose a reason for hiding this comment

Uh oh!

laurentsimon Aug 1, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants