feat: align action with Verification Context v1.0 #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Smoke Test | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test-secrets: | |
| name: scan-secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run QWED secret scan | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: scan-secrets | |
| paths: "action.yml,.github/**" | |
| fail_on_findings: "false" | |
| - name: Verify outputs | |
| env: | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then | |
| echo "verdict: $VERDICT" | |
| case "$VERDICT" in | |
| VERIFIED|UNVERIFIABLE|BLOCKED) ;; | |
| *) echo "Invalid verdict: $VERDICT" >&2; exit 1 ;; | |
| esac | |
| fi | |
| if [ -n "$ADMISSION" ]; then | |
| echo "admission: $ADMISSION" | |
| case "$ADMISSION" in | |
| ADMIT|DENY) ;; | |
| *) echo "Invalid admission: $ADMISSION" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then | |
| if [ "$VERDICT" = "UNVERIFIABLE" ] || [ "$VERDICT" = "BLOCKED" ]; then | |
| [ "$ADMISSION" = "DENY" ] || { echo "Fail-closed violation: $VERDICT must produce DENY" >&2; exit 1; } | |
| fi | |
| if [ "$VERDICT" = "VERIFIED" ] && [ "$ADMISSION" = "ADMIT" ]; then | |
| [ "$VERIFIED" = "true" ] || { echo "Consistency violation: VERIFIED+ADMIT must have verified=true" >&2; exit 1; } | |
| fi | |
| fi | |
| fi | |
| test-code: | |
| name: scan-code | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run QWED code scan | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: scan-code | |
| paths: "**/*.yml" | |
| fail_on_findings: "false" | |
| - name: Verify outputs | |
| env: | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then echo "verdict: $VERDICT"; fi | |
| if [ -n "$ADMISSION" ]; then echo "admission: $ADMISSION"; fi | |
| test-shell: | |
| name: verify-shell | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run QWED shell verify | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: verify-shell | |
| paths: "**/*.sh" | |
| fail_on_findings: "false" | |
| - name: Verify outputs | |
| env: | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then echo "verdict: $VERDICT"; fi | |
| if [ -n "$ADMISSION" ]; then echo "admission: $ADMISSION"; fi | |
| test-verification-context: | |
| name: verification-context output | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run with VC output format | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: scan-secrets | |
| paths: "action.yml" | |
| output_format: verification-context | |
| fail_on_findings: "false" | |
| - name: Verify VC document | |
| env: | |
| VERIFICATION_CONTEXT: ${{ steps.scan.outputs.verification_context }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| PROOF_REF: ${{ steps.scan.outputs.proof_ref }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -z "$VERIFICATION_CONTEXT" ]; then | |
| echo "verification_context not yet emitted by image — VC v1.0 output support requires Docker image update (tracked separately)" | |
| echo "Skipping VC document validation (backward-compatible mode)" | |
| exit 0 | |
| fi | |
| echo "VC document emitted — validating full contract" | |
| printf '%s' "$VERIFICATION_CONTEXT" | jq -e . >/dev/null | |
| printf '%s' "$VERIFICATION_CONTEXT" | jq -e '.spec_version == "1.0"' >/dev/null | |
| VC_VERDICT=$(printf '%s' "$VERIFICATION_CONTEXT" | jq -r '.verdict') | |
| VC_ADMISSION=$(printf '%s' "$VERIFICATION_CONTEXT" | jq -r '.context.decision.admission') | |
| VC_PROOF_REF=$(printf '%s' "$VERIFICATION_CONTEXT" | jq -r '.context.evidence.proof_ref // empty') | |
| echo "VC verdict: $VC_VERDICT" | |
| echo "VC admission: $VC_ADMISSION" | |
| case "$VC_VERDICT" in | |
| VERIFIED|UNVERIFIABLE|BLOCKED) ;; | |
| *) echo "Invalid VC verdict: $VC_VERDICT" >&2; exit 1 ;; | |
| esac | |
| case "$VC_ADMISSION" in | |
| ADMIT|DENY) ;; | |
| *) echo "Invalid VC admission: $VC_ADMISSION" >&2; exit 1 ;; | |
| esac | |
| if [ "$VC_VERDICT" = "UNVERIFIABLE" ] || [ "$VC_VERDICT" = "BLOCKED" ]; then | |
| [ "$VC_ADMISSION" = "DENY" ] || { echo "Fail-closed violation: $VC_VERDICT must have admission=DENY" >&2; exit 1; } | |
| fi | |
| if [ "$VC_VERDICT" = "VERIFIED" ]; then | |
| [ -n "$VC_PROOF_REF" ] || { echo "VERIFIED must have proof_ref" >&2; exit 1; } | |
| if [[ ! "$VC_PROOF_REF" =~ ^sha256:[a-f0-9]{64}$ ]]; then | |
| echo "Invalid proof_ref format: $VC_PROOF_REF" >&2; exit 1 | |
| fi | |
| fi | |
| if [ -n "$VERDICT" ]; then | |
| [ "$VERDICT" = "$VC_VERDICT" ] || { echo "Scalar verdict ($VERDICT) != VC verdict ($VC_VERDICT)" >&2; exit 1; } | |
| fi | |
| if [ -n "$ADMISSION" ]; then | |
| [ "$ADMISSION" = "$VC_ADMISSION" ] || { echo "Scalar admission ($ADMISSION) != VC admission ($VC_ADMISSION)" >&2; exit 1; } | |
| fi | |
| if [ -n "$PROOF_REF" ]; then | |
| [ "$PROOF_REF" = "$VC_PROOF_REF" ] || { echo "Scalar proof_ref != VC proof_ref" >&2; exit 1; } | |
| fi | |
| echo "VC v1.0 contract validated — all checks passed" |