https://github.com/liatrio/gh-trusted-builds-workflows

https://github.com/liatrio/gh-trusted-builds-workflows

automated-governance

Last synced: 8 days ago
JSON representation

• Host: GitHub
• URL: https://github.com/liatrio/gh-trusted-builds-workflows
• Owner: liatrio
• Created: 2023-04-14T13:32:39.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2024-10-29T19:07:22.000Z (15 days ago)
• Last Synced: 2024-10-29T21:21:28.305Z (15 days ago)
• Topics: automated-governance
• Language: JavaScript
• Homepage:
• Size: 144 KB
• Stars: 20
• Watchers: 4
• Forks: 0
• Open Issues: 13
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# gh-builds-trusted-workflows

A collection of reusable GitHub Actions workflows used in a demo on automated governance.

See the [demo application README](https://github.com/liatrio/gh-trusted-builds-app#workflows) for more information.

## Testing

Integration tests for the reusable workflows exist under [test/](test).

### Setup

To run locally, you'll need to install:

- Sigstore [cosign](https://docs.sigstore.dev/cosign/installation/) cli

- Node.js. There is a [.nvmrc](.nvmrc) file to install with [nvm](https://github.com/nvm-sh/nvm).

⚠️ WARNING: The tests run cosign initialize, meaning that if you have a custom TUF root configured, it will be temporarily overwritten in place of the TUF root for Sigstore's staging environment. 

The tests will attempt to save the TUF root in ~/.sigstore-backup before running, and restore it after.

If the tests fail to restore the custom root, you can remove it by running rm -rf ~/.sigstore and mv ~/.sigstore-backup ~/.sigstore. 

If you're not using a custom TUF root, deleting the ~/.sigstore directory should suffice.

Fork https://github.com/liatrio/gh-trusted-builds-workflows-integration-tests to a personal account.

This is a fixture repository in which the workflows under test will run.

Create a GitHub personal access token. 

It's recommended to use the [GitHub cli](https://cli.github.com/),

as it will be easier to create a token with the proper scopes, 

and securely provide the token to the tests.

`gh auth login -s read:packages`

Install npm dependencies, `npm i`.

### Run

`GITHUB_TOKEN=$(gh auth token) npm test`