feat: align action with Verification Context v1.0 (#8) #13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Smoke Test | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test-secrets: | |
| name: scan-secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run QWED secret scan | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: scan-secrets | |
| paths: "action.yml,.github/**" | |
| fail_on_findings: "false" | |
| - name: Verify outputs | |
| env: | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then | |
| echo "verdict: $VERDICT" | |
| case "$VERDICT" in | |
| VERIFIED|UNVERIFIABLE|BLOCKED) ;; | |
| *) echo "Invalid verdict: $VERDICT" >&2; exit 1 ;; | |
| esac | |
| fi | |
| if [ -n "$ADMISSION" ]; then | |
| echo "admission: $ADMISSION" | |
| case "$ADMISSION" in | |
| ADMIT|DENY) ;; | |
| *) echo "Invalid admission: $ADMISSION" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then | |
| if [ "$VERDICT" = "UNVERIFIABLE" ] || [ "$VERDICT" = "BLOCKED" ]; then | |
| [ "$ADMISSION" = "DENY" ] || { echo "Fail-closed violation: $VERDICT must produce DENY" >&2; exit 1; } | |
| fi | |
| if [ "$VERDICT" = "VERIFIED" ] && [ "$ADMISSION" = "ADMIT" ]; then | |
| [ "$VERIFIED" = "true" ] || { echo "Consistency violation: VERIFIED+ADMIT must have verified=true" >&2; exit 1; } | |
| fi | |
| if [ "$VERIFIED" = "true" ]; then | |
| [ "$VERDICT" = "VERIFIED" ] || { echo "Consistency violation: verified=true requires verdict=VERIFIED" >&2; exit 1; } | |
| [ "$ADMISSION" = "ADMIT" ] || { echo "Consistency violation: verified=true requires admission=ADMIT" >&2; exit 1; } | |
| fi | |
| fi | |
| fi | |
| test-code: | |
| name: scan-code | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run QWED code scan | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: scan-code | |
| paths: "**/*.yml" | |
| fail_on_findings: "false" | |
| - name: Verify outputs | |
| env: | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then echo "verdict: $VERDICT"; fi | |
| if [ -n "$ADMISSION" ]; then echo "admission: $ADMISSION"; fi | |
| test-shell: | |
| name: verify-shell | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run QWED shell verify | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: verify-shell | |
| paths: "**/*.sh" | |
| fail_on_findings: "false" | |
| - name: Verify outputs | |
| env: | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -n "$VERDICT" ]; then echo "verdict: $VERDICT"; fi | |
| if [ -n "$ADMISSION" ]; then echo "admission: $ADMISSION"; fi | |
| test-verification-context: | |
| name: verification-context output | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run with VC output format | |
| id: scan | |
| uses: ./ | |
| with: | |
| action: scan-secrets | |
| paths: "action.yml" | |
| output_format: verification-context | |
| fail_on_findings: "false" | |
| - name: Verify VC document | |
| env: | |
| VERIFICATION_CONTEXT: ${{ steps.scan.outputs.verification_context }} | |
| VERDICT: ${{ steps.scan.outputs.verdict }} | |
| ADMISSION: ${{ steps.scan.outputs.admission }} | |
| VERIFIED: ${{ steps.scan.outputs.verified }} | |
| PROOF_REF: ${{ steps.scan.outputs.proof_ref }} | |
| run: | | |
| case "$VERIFIED" in | |
| true|false) echo "verified: $VERIFIED" ;; | |
| *) echo "Invalid or missing verified output: '$VERIFIED'" >&2; exit 1 ;; | |
| esac | |
| if [ -z "$VERIFICATION_CONTEXT" ]; then | |
| echo "FAIL: verification_context is empty but output_format=verification-context was requested" >&2 | |
| echo "The Docker image does not yet support VC v1.0 outputs (tracked in #9)" >&2 | |
| exit 1 | |
| fi | |
| echo "VC document emitted — validating full contract" | |
| printf '%s' "$VERIFICATION_CONTEXT" | jq -e . >/dev/null | |
| printf '%s' "$VERIFICATION_CONTEXT" | jq -e '.spec_version == "1.0"' >/dev/null | |
| VC_VERDICT=$(printf '%s' "$VERIFICATION_CONTEXT" | jq -r '.verdict') | |
| VC_ADMISSION=$(printf '%s' "$VERIFICATION_CONTEXT" | jq -r '.context.decision.admission') | |
| VC_PROOF_REF=$(printf '%s' "$VERIFICATION_CONTEXT" | jq -r '.context.evidence.proof_ref // empty') | |
| echo "VC verdict: $VC_VERDICT" | |
| echo "VC admission: $VC_ADMISSION" | |
| case "$VC_VERDICT" in | |
| VERIFIED|UNVERIFIABLE|BLOCKED) ;; | |
| *) echo "Invalid VC verdict: $VC_VERDICT" >&2; exit 1 ;; | |
| esac | |
| case "$VC_ADMISSION" in | |
| ADMIT|DENY) ;; | |
| *) echo "Invalid VC admission: $VC_ADMISSION" >&2; exit 1 ;; | |
| esac | |
| if [ "$VC_VERDICT" = "UNVERIFIABLE" ] || [ "$VC_VERDICT" = "BLOCKED" ]; then | |
| [ "$VC_ADMISSION" = "DENY" ] || { echo "Fail-closed violation: $VC_VERDICT must have admission=DENY" >&2; exit 1; } | |
| fi | |
| if [ "$VC_VERDICT" = "VERIFIED" ]; then | |
| [ -n "$VC_PROOF_REF" ] || { echo "VERIFIED must have proof_ref" >&2; exit 1; } | |
| if [[ ! "$VC_PROOF_REF" =~ ^sha256:[a-f0-9]{64}$ ]]; then | |
| echo "Invalid proof_ref format: $VC_PROOF_REF" >&2; exit 1 | |
| fi | |
| else | |
| [ -z "$VC_PROOF_REF" ] || { echo "$VC_VERDICT must have an empty proof_ref" >&2; exit 1; } | |
| fi | |
| EXPECTED_VERIFIED="false" | |
| if [ "$VC_VERDICT" = "VERIFIED" ] && [ "$VC_ADMISSION" = "ADMIT" ]; then | |
| EXPECTED_VERIFIED="true" | |
| fi | |
| [ "$VERIFIED" = "$EXPECTED_VERIFIED" ] || { echo "Consistency violation: verified=$VERIFIED but expected $EXPECTED_VERIFIED for verdict=$VC_VERDICT admission=$VC_ADMISSION" >&2; exit 1; } | |
| [ -n "$VERDICT" ] || { echo "Missing scalar verdict when VC is present" >&2; exit 1; } | |
| [ -n "$ADMISSION" ] || { echo "Missing scalar admission when VC is present" >&2; exit 1; } | |
| [ "$VERDICT" = "$VC_VERDICT" ] || { echo "Scalar verdict ($VERDICT) != VC verdict ($VC_VERDICT)" >&2; exit 1; } | |
| [ "$ADMISSION" = "$VC_ADMISSION" ] || { echo "Scalar admission ($ADMISSION) != VC admission ($VC_ADMISSION)" >&2; exit 1; } | |
| [ "$PROOF_REF" = "$VC_PROOF_REF" ] || { echo "Scalar proof_ref ($PROOF_REF) != VC proof_ref ($VC_PROOF_REF)" >&2; exit 1; } | |
| echo "VC v1.0 contract validated — all checks passed" |