Skip to content

ci: fix attest job for multi-arch rock, drop SBOM/scan #85

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tonyandrewmeyer wants to merge 7 commits into
base: master
Choose a base branch
from
Open

ci: fix attest job for multi-arch rock, drop SBOM/scan #85

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
f8f8f9b
test: attest-and-scan per-arch fix + drop fork-only secret
tonyandrewmeyer Jul 16, 2026
cf984de
test: glob per-arch rock and resolve filename dynamically
tonyandrewmeyer Jul 16, 2026
64fd773
test: dump grype findings as table
tonyandrewmeyer Jul 16, 2026
38870c3
test: pin grype distro to ubuntu:24.04 (rock is chiselled)
tonyandrewmeyer Jul 16, 2026
25078c8
test: checkout repo so .grype.yaml is picked up; only fail on fixed CVEs
tonyandrewmeyer Jul 16, 2026
ea7be3b
test: drop syft/grype/SBOM attestation; keep only build-provenance
tonyandrewmeyer Jul 16, 2026
3402e08
Merge branch 'master' into test-attest-fix
tonyandrewmeyer Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 12 additions & 29 deletions .github/workflows/publish.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,8 +47,6 @@ jobs:
# so use GitHub's runners instead of Canonical's self-hosted runners.
arch-map: '{"amd64":["ubuntu-24.04"],"arm64":["ubuntu-24.04-arm"]}'
rockcraft-test: ${{ matrix.run-tests }}
secrets:
source-github-token: ${{ secrets.REPO_CLONER_TOKEN }}

test:
needs: [prepare, build]
Expand All @@ -59,53 +57,38 @@ jobs:
with:
oci-archive-name: ${{ matrix.artifact-name }}

attest-and-scan:
attest:
needs: [prepare, test]
runs-on: ubuntu-latest
strategy:
matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
fail-fast: false
matrix:
include: ${{ fromJSON(needs.prepare.outputs.build-matrix).include }}
arch: [amd64, arm64]
permissions:
contents: read
id-token: write
attestations: write
artifact-metadata: write
steps:
- name: Download rock artifact
- name: Download per-arch rock artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ${{ matrix.artifact-name }}
pattern: ${{ matrix.artifact-name }}-${{ matrix.name }}_*_${{ matrix.arch }}.rock
path: ./rock
merge-multiple: true

- name: Generate SBOM (Syft)
uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
with:
image: oci-archive:./rock/${{ matrix.artifact-name }}
format: spdx-json
output-file: ./sbom.spdx.json
upload-artifact: false
upload-release-assets: false
- name: Locate rock file
id: rock
run: echo "path=$(ls ./rock/${{ matrix.name }}_*_${{ matrix.arch }}.rock)" >> "$GITHUB_OUTPUT"

- name: Attest build provenance
uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
with:
subject-path: ./rock/${{ matrix.artifact-name }}

- name: Attest SBOM
uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763 # v4.1.1
with:
subject-path: ./rock/${{ matrix.artifact-name }}
sbom-path: ./sbom.spdx.json

- name: Scan rock (Grype)
uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
with:
sbom: ./sbom.spdx.json
fail-build: true
severity-cutoff: high
subject-path: ${{ steps.rock.outputs.path }}

upload-ghcr:
needs: [prepare, attest-and-scan]
needs: [prepare, attest]
runs-on: ubuntu-latest
strategy:
matrix: ${{ fromJSON(needs.prepare.outputs.build-matrix) }}
Expand Down
Loading