Skip to content

Commit 7bf7e7e

Browse files
kriscolemankriscoleman
committed
chore: workflow to use reusable workflow
Refactors the pipeline workflows to use a reusable workflow for Witness jobs. This change improves the maintainability and reduces duplication in the workflow definitions. The `archivista-headers` is also adjusted to use the secrets context for authentication, which makes it more consistent.
1 parent 295f271 commit 7bf7e7e

File tree

3 files changed

+103
-34
lines changed

3 files changed

+103
-34
lines changed

‎.github/workflows/pipeline-prod.yml

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -14,33 +14,34 @@ on:
1414

1515
jobs:
1616
fmt:
17-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
17+
uses: ./.github/workflows/witness.yml
1818
with:
1919
pull_request: ${{ github.event_name == 'pull_request' }}
2020
step: fmt
2121
archivista-server: 'https://web.platform.testifysec.com'
22-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
2322
attestations: 'git github environment'
2423
command: go fmt ./...
24+
secrets:
25+
token: ${{ secrets.witness_api_token }}
2526

2627
vet:
27-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
28+
uses: ./.github/workflows/witness.yml
2829
with:
2930
pull_request: ${{ github.event_name == 'pull_request' }}
3031
step: vet
3132
archivista-server: 'https://web.platform.testifysec.com'
32-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
3333
attestations: 'git github environment'
3434
command: go vet ./...
35+
secrets:
36+
token: ${{ secrets.witness_api_token }}
3537

3638
# --ignore DL3002
3739
lint:
38-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
40+
uses: ./.github/workflows/witness.yml
3941
with:
4042
pull_request: ${{ github.event_name == 'pull_request' }}
4143
step: lint
4244
archivista-server: 'https://web.platform.testifysec.com'
43-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
4445
pre-command-attestations: 'git github environment'
4546
attestations: 'git github environment'
4647
pre-command: |
@@ -49,45 +50,50 @@ jobs:
4950
command: hadolint -f sarif Dockerfile > hadolint.sarif
5051
artifact-upload-name: hadolint.sarif
5152
artifact-upload-path: hadolint.sarif
53+
secrets:
54+
token: ${{ secrets.witness_api_token }}
5255

5356
unit-test:
5457
needs: [fmt, vet, lint]
55-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
58+
uses: ./.github/workflows/witness.yml
5659
with:
5760
pull_request: ${{ github.event_name == 'pull_request' }}
5861
step: unit-test
5962
archivista-server: 'https://web.platform.testifysec.com'
60-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
6163
attestations: 'git github environment'
6264
command: go test ./... -coverprofile cover.out
6365
artifact-upload-name: cover.out
6466
artifact-upload-path: cover.out
67+
secrets:
68+
token: ${{ secrets.witness_api_token }}
6569

6670
sast:
6771
needs: [fmt, vet, lint]
68-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
72+
uses: ./.github/workflows/witness.yml
6973
with:
7074
pull_request: ${{ github.event_name == 'pull_request' }}
7175
step: sast
7276
archivista-server: 'https://web.platform.testifysec.com'
73-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
7477
pre-command-attestations: 'git github environment'
7578
attestations: 'git github environment'
7679
pre-command: python3 -m pip install semgrep==1.45.0
7780
command: semgrep scan --config auto ./ --sarif -o semgrep.sarif
7881
artifact-upload-name: semgrep.sarif
7982
artifact-upload-path: semgrep.sarif
83+
secrets:
84+
token: ${{ secrets.witness_api_token }}
8085

8186
build:
8287
needs: [unit-test, sast]
83-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
88+
uses: ./.github/workflows/witness.yml
8489
with:
8590
pull_request: ${{ github.event_name == 'pull_request' }}
8691
step: build
8792
archivista-server: 'https://web.platform.testifysec.com'
88-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
8993
attestations: 'git github environment'
9094
command: go build -o bin/software main.go
95+
secrets:
96+
token: ${{ secrets.witness_api_token }}
9197

9298
build-image:
9399
needs: [unit-test, sast]
@@ -130,10 +136,10 @@ jobs:
130136
with:
131137
step: build-image
132138
archivista-server: 'https://web.platform.testifysec.com'
133-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
134139
attestations: 'git github environment oci slsa'
135140
command: |
136141
/bin/sh -c "docker buildx build -t ${{ steps.meta.outputs.tags }} -o type=docker,dest=image.tar --push ."
142+
archivista-headers: "${{ format('Authorization: Token {0}', secrets.witness_api_token) }}"
137143

138144
- name: Upload Artifact
139145
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
@@ -146,12 +152,11 @@ jobs:
146152

147153
generate-sbom:
148154
needs: build-image
149-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
155+
uses: ./.github/workflows/witness.yml
150156
with:
151157
pull_request: ${{ github.event_name == 'pull_request' }}
152158
step: generate-sbom
153159
archivista-server: 'https://web.platform.testifysec.com'
154-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
155160
pre-command-attestations: 'git github environment'
156161
attestations: 'git github environment sbom'
157162
artifact-download: image.tar
@@ -161,15 +166,16 @@ jobs:
161166
syft packages docker-archive:/tmp/image.tar --source-name=pkg:oci/testifysec/swf -o cyclonedx-json --file sbom.cdx.json
162167
artifact-upload-name: sbom.cdx.json
163168
artifact-upload-path: sbom.cdx.json
169+
secrets:
170+
token: ${{ secrets.witness_api_token }}
164171

165172
secret-scan:
166173
needs: build-image
167-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
174+
uses: ./.github/workflows/witness.yml
168175
with:
169176
pull_request: ${{ github.event_name == 'pull_request' }}
170177
step: secret-scan
171178
archivista-server: 'https://web.platform.testifysec.com'
172-
archivista-headers: "Authorization: Token ${{ secrets.witness_api_token }}"
173179
pre-command-attestations: 'git github environment'
174180
attestations: 'git github environment'
175181
artifact-download: image.tar
@@ -179,3 +185,5 @@ jobs:
179185
trufflehog docker --image=file:///tmp/image.tar -j > trufflehog.json
180186
artifact-upload-name: trufflehog.json
181187
artifact-upload-path: trufflehog.json
188+
secrets:
189+
token: ${{ secrets.witness_api_token }}

‎.github/workflows/pipeline-sandbox.yml

Lines changed: 25 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -14,33 +14,34 @@ on:
1414

1515
jobs:
1616
fmt:
17-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
17+
uses: ./.github/workflows/witness.yml
1818
with:
1919
pull_request: ${{ github.event_name == 'pull_request' }}
2020
step: fmt
2121
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
22-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
2322
attestations: 'git github environment'
2423
command: go fmt ./...
24+
secrets:
25+
token: ${{ secrets.sandbox_witness_api_token }}
2526

2627
vet:
27-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
28+
uses: ./.github/workflows/witness.yml
2829
with:
2930
pull_request: ${{ github.event_name == 'pull_request' }}
3031
step: vet
3132
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
32-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
3333
attestations: 'git github environment'
3434
command: go vet ./...
35+
secrets:
36+
token: ${{ secrets.sandbox_witness_api_token }}
3537

3638
# --ignore DL3002
3739
lint:
38-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
40+
uses: ./.github/workflows/witness.yml
3941
with:
4042
pull_request: ${{ github.event_name == 'pull_request' }}
4143
step: lint
4244
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
43-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
4445
pre-command-attestations: 'git github environment'
4546
attestations: 'git github environment'
4647
pre-command: |
@@ -49,45 +50,50 @@ jobs:
4950
command: hadolint -f sarif Dockerfile > hadolint.sarif
5051
artifact-upload-name: hadolint.sarif
5152
artifact-upload-path: hadolint.sarif
53+
secrets:
54+
token: ${{ secrets.sandbox_witness_api_token }}
5255

5356
unit-test:
5457
needs: [fmt, vet, lint]
55-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
58+
uses: ./.github/workflows/witness.yml
5659
with:
5760
pull_request: ${{ github.event_name == 'pull_request' }}
5861
step: unit-test
5962
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
60-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
6163
attestations: 'git github environment'
6264
command: go test ./... -coverprofile cover.out
6365
artifact-upload-name: cover.out
6466
artifact-upload-path: cover.out
67+
secrets:
68+
token: ${{ secrets.sandbox_witness_api_token }}
6569

6670
sast:
6771
needs: [fmt, vet, lint]
68-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
72+
uses: ./.github/workflows/witness.yml
6973
with:
7074
pull_request: ${{ github.event_name == 'pull_request' }}
7175
step: sast
7276
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
73-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
7477
pre-command-attestations: 'git github environment'
7578
attestations: 'git github environment'
7679
pre-command: python3 -m pip install semgrep==1.45.0
7780
command: semgrep scan --config auto ./ --sarif -o semgrep.sarif
7881
artifact-upload-name: semgrep.sarif
7982
artifact-upload-path: semgrep.sarif
83+
secrets:
84+
token: ${{ secrets.sandbox_witness_api_token }}
8085

8186
build:
8287
needs: [unit-test, sast]
83-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
88+
uses: ./.github/workflows/witness.yml
8489
with:
8590
pull_request: ${{ github.event_name == 'pull_request' }}
8691
step: build
8792
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
88-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
8993
attestations: 'git github environment'
9094
command: go build -o bin/software main.go
95+
secrets:
96+
token: ${{ secrets.sandbox_witness_api_token }}
9197

9298
build-image:
9399
needs: [unit-test, sast]
@@ -130,10 +136,10 @@ jobs:
130136
with:
131137
step: build-image
132138
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
133-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
134139
attestations: 'git github environment oci slsa'
135140
command: |
136141
/bin/sh -c "docker buildx build -t ${{ steps.meta.outputs.tags }} -o type=docker,dest=image.tar --push ."
142+
archivista-headers: "${{ format('Authorization: Token {0}', secrets.sandbox_witness_api_token) }}"
137143

138144
- name: Upload Artifact
139145
uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
@@ -146,12 +152,11 @@ jobs:
146152

147153
generate-sbom:
148154
needs: build-image
149-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
155+
uses: ./.github/workflows/witness.yml
150156
with:
151157
pull_request: ${{ github.event_name == 'pull_request' }}
152158
step: generate-sbom
153159
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
154-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
155160
pre-command-attestations: 'git github environment'
156161
attestations: 'git github environment sbom'
157162
artifact-download: image.tar
@@ -161,15 +166,16 @@ jobs:
161166
syft packages docker-archive:/tmp/image.tar --source-name=pkg:oci/testifysec/swf -o cyclonedx-json --file sbom.cdx.json
162167
artifact-upload-name: sbom.cdx.json
163168
artifact-upload-path: sbom.cdx.json
169+
secrets:
170+
token: ${{ secrets.sandbox_witness_api_token }}
164171

165172
secret-scan:
166173
needs: build-image
167-
uses: testifysec/witness-run-action/.github/workflows/witness.yml@v0.3.0
174+
uses: ./.github/workflows/witness.yml
168175
with:
169176
pull_request: ${{ github.event_name == 'pull_request' }}
170177
step: secret-scan
171178
archivista-server: 'https://judge.aws-sandbox-staging.testifysec.dev'
172-
archivista-headers: "Authorization: Token ${{ secrets.sandbox_witness_api_token }}"
173179
pre-command-attestations: 'git github environment'
174180
attestations: 'git github environment'
175181
artifact-download: image.tar
@@ -179,3 +185,5 @@ jobs:
179185
trufflehog docker --image=file:///tmp/image.tar -j > trufflehog.json
180186
artifact-upload-name: trufflehog.json
181187
artifact-upload-path: trufflehog.json
188+
secrets:
189+
token: ${{ secrets.sandbox_witness_api_token }}

‎.github/workflows/witness.yml

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
pull_request:
5+
required: true
6+
type: boolean
7+
artifact-download:
8+
required: false
9+
type: string
10+
artifact-upload-name:
11+
required: false
12+
type: string
13+
artifact-upload-path:
14+
required: false
15+
type: string
16+
pre-command:
17+
required: false
18+
type: string
19+
pre-command-attestations:
20+
default: 'environment git github'
21+
required: false
22+
type: string
23+
command:
24+
required: true
25+
type: string
26+
step:
27+
required: true
28+
type: string
29+
attestations:
30+
required: true
31+
type: string
32+
archivista-server:
33+
required: false
34+
type: string
35+
secrets:
36+
token:
37+
required: true
38+
39+
jobs:
40+
witness:
41+
uses: testifysec/witness-run-action/.github/workflows/[email protected]
42+
with:
43+
pull_request: ${{ inputs.pull_request }}
44+
artifact-download: ${{ inputs.artifact-download }}
45+
artifact-upload-name: ${{ inputs.artifact-upload-name }}
46+
artifact-upload-path: ${{ inputs.artifact-upload-path }}
47+
pre-command: ${{ inputs.pre-command }}
48+
pre-command-attestations: ${{ inputs.pre-command-attestations }}
49+
command: ${{ inputs.command }}
50+
step: ${{ inputs.step }}
51+
attestations: ${{ inputs.attestations }}
52+
archivista-server: ${{ inputs.archivista-server }}
53+
archivista-headers: "${{ format('Authorization: Token {0}', secrets.token) }}"

0 commit comments

Comments
 (0)