wolfi-presubmit.yaml

name: ci

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]

permissions: {}

jobs:
  build-melange:
    name: Build melange and add to artifact cache
    runs-on: ubuntu-latest

    permissions:
      contents: read

    steps:
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            *.blob.core.windows.net:443
            *.githubapp.com:443
            api.github.com:443
            dl.google.com:443
            github.com:443
            go.dev:443
            objects.githubusercontent.com:443
            proxy.golang.org:443
            release-assets.githubusercontent.com:443
            storage.googleapis.com:443
            sum.golang.org:443

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          persist-credentials: false

      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "./go.mod"
          check-latest: true

      - name: build
        run: |
          make melange

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: melange-${{ github.run_id }}
          path: ${{ github.workspace }}/melange
          retention-days: 1

  build-packages:
    name: Build packages
    needs:
      - build-melange
    runs-on: ubuntu-latest-8-core

    permissions:
      contents: read

    # This is a list of packages which covers basic and exotic uses of
    # the built-in pipelines.  Goal is to balance efficiency while also
    # exercising Melange with real-world package builds.
    # Feel free to add additional packages to this matrix which exercise
    # Melange in new ways (e.g. new pipelines, etc.)
    strategy:
      fail-fast: false
      matrix:
        runner:
          - bubblewrap
          - qemu
        package:
          # - rust-1.86 # takes ~35-40 minutes to build; used for testing LICENSE file functionality
          #- gdk-pixbuf # Looks like this is broken again, see: https://gitlab.gnome.org/GNOME/gobject-introspection/-/issues/515
          #- glibc # takes ~35-40 minutes to build; not an all-encompassing signal of Melange functionality; TODO: replace with a smaller, related package
          #- xmlto # TODO: https://github.com/wolfi-dev/os/issues/26442
          - bubblewrap
          - dpkg
          - fixuid # uses a diff test user
          - fping # uses get/setcaps
          - gitsign
          - guac
          - lzo
          - ncurses
          - perl-yaml-syck
          - postfix
          - py3-pyelftools # Uses license-path
          - py3-supported-python
          - s3cmd
          - subversion
          - sudo
          - tini

    steps:
      - uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: block
          allowed-endpoints: >
            *.blob.core.windows.net:443
            *.githubapp.com:443
            9236a389bd48b984df91adc1bc924620.r2.cloudflarestorage.com:443
            _http._tcp.azure.archive.ubuntu.com:443
            _https._tcp.dl.google.com:443
            _https._tcp.esm.ubuntu.com:443
            _https._tcp.motd.ubuntu.com:443
            _https._tcp.packages.microsoft.com:443
            api.github.com:443
            api.ipify.org:443
            apk.cgr.dev:443
            archive.ubuntu.com:80
            azure.archive.ubuntu.com:80
            broker.actions.githubusercontent.com:443
            cgr.dev:443
            classic.yarnpkg.com:443
            cpan.metacpan.org:443
            de.postfix.org:443
            dl-cdn.alpinelinux.org:443
            dl.google.com:443
            doc-10-as-docs.googleusercontent.com:443
            download.docker.com:443
            drive.google.com:443
            esm.ubuntu.com:443
            files.pythonhosted.org:443
            ftp.de.debian.org:80
            ftp.fu-berlin.de:443
            ghcr.io:443
            git.dpkg.org:443
            github.com:443
            go.dev:443
            grype.anchore.io:443
            index.crates.io:443
            invisible-mirror.net:443
            motd.ubuntu.com:443
            objects.githubusercontent.com:443
            packages.microsoft.com:443
            packages.wolfi.dev:443
            pkg-containers.githubusercontent.com:443
            pkgs.alpinelinux.org:443
            proxy.golang.org:443
            pypi.org:443
            raw.githubusercontent.com:443
            registry.npmjs.org:443
            registry.yarnpkg.com:443
            release-assets.githubusercontent.com:443
            results-receiver.actions.githubusercontent.com:443
            security.ubuntu.com:80
            static.crates.io:443
            storage.googleapis.com:443
            sum.golang.org:443
            time1.google.com:123
            time2.google.com:123
            time2.google.com:443
            time3.google.com:123
            time3.google.com:443
            time4.google.com:123
            time4.google.com:443
            toolbox-data.anchore.io:443
            www.oberhumer.com:443
            www.sudo.ws:443
            yarnpkg.com:443

      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          repository: wolfi-dev/os
          persist-credentials: false

      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: melange-${{ github.run_id }}
          path: ${{ github.workspace }}/.melange-dir
          run-id: ${{ github.run_id }}

      - env:
          GITHUB_WORKSPACE: ${{ github.workspace }}
        run: |
          sudo mv "$GITHUB_WORKSPACE"/.melange-dir/melange /usr/bin/melange
          sudo chmod a+x /usr/bin/melange
          melange version

      # needed to run tests for Bubblewrap packages
      - uses: docker/setup-docker-action@0234bb73ccb40f0c430b795634f9247e2b5c2d23 # v5.2.0

      # this need to point to main to always get the latest action
      - uses: wolfi-dev/actions/install-wolfictl@d8faf0b2bf2a7c6eefc571567ef370faae5baed2 # last commit that had the scan command

      - env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          wolfictl bump "$MATRIX_PACKAGE"

      - if: matrix.runner == 'bubblewrap'
        run: |
          sudo apt-get -y install bubblewrap
      - if: matrix.runner == 'bubblewrap'
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
        with:
          path: melange-src
          persist-credentials: false
      - if: matrix.runner == 'bubblewrap'
        uses: ./melange-src/.github/actions/setup-bubblewrap
      - if: matrix.runner == 'bubblewrap'
        env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          make SHELL="/bin/bash" MELANGE="sudo melange" MELANGE_RUNNER="bubblewrap" MELANGE_EXTRA_OPTS="--generate-provenance" package/"$MATRIX_PACKAGE"
      - if: matrix.runner == 'bubblewrap'
        env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          make SHELL="/bin/bash" MELANGE="sudo melange" MELANGE_RUNNER="docker" test/"$MATRIX_PACKAGE"

      - name: Download kernel for VMs
        if: matrix.runner == 'qemu'
        run: |
          KERNEL_PKG="$(curl -sL https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | tar -Oxz APKINDEX | awk -F':' '$1 == "P" {printf "%s-", $2} $1 == "V" {printf "%s.apk\n", $2}' | grep "linux-virt" | grep -v dev)"
          curl -LSo linux-virt.apk "https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/$KERNEL_PKG"
          mkdir -p /tmp/kernel
          tar -xf ./linux-virt.apk -C /tmp/kernel/

      - name: Install QEMU/KVM
        if: matrix.runner == 'qemu'
        run: |
          sudo apt-get update
          sudo apt-get -y install qemu-system-x86-64 qemu-kvm

      - name: Enable KVM group perms
        if: matrix.runner == 'qemu'
        run: |
          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
          sudo udevadm control --reload-rules
          sudo udevadm trigger --name-match=kvm

      - name: Make package ${{ matrix.package }} with QEMU Runner
        if: matrix.runner == 'qemu'
        env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          make \
            SHELL="/bin/bash" \
            QEMU_KERNEL_IMAGE=/tmp/kernel/boot/vmlinuz-virt \
            QEMU_KERNEL_MODULES=/tmp/kernel/lib/modules/ \
            MELANGE="/usr/bin/melange" \
            MELANGE_EXTRA_OPTS="--runner qemu --generate-provenance" \
            package/"$MATRIX_PACKAGE"

      - name: Output SLSA provenance
        run: |
          for pkg in packages/x86_64/*.attest.tar.gz; do
            dir="$(basename "${pkg}" .attest.tar.gz)"
            sudo mkdir -p packages/x86_64/"${dir}"
            sudo tar --xattrs --xattrs-include='*.*' -xf "${pkg}" -C packages/x86_64/"${dir}"
            jq . packages/x86_64/"${dir}"/"${dir}.attestation"
          done

      - name: Run tests to verify xattrs with bubblewrap runner
        if: matrix.runner == 'bubblewrap' && matrix.package == 'fping'
        env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          make SHELL="/bin/bash" MELANGE="sudo melange" MELANGE_RUNNER="bubblewrap" test/"$MATRIX_PACKAGE"

      - name: Run tests with QEMU runner
        if: matrix.runner == 'qemu'
        env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          make \
            SHELL="/bin/bash" \
            QEMU_KERNEL_IMAGE=/tmp/kernel/boot/vmlinuz-virt \
            QEMU_KERNEL_MODULES=/tmp/kernel/lib/modules/ \
            MELANGE="/usr/bin/melange" \
            MELANGE_EXTRA_OPTS="--runner qemu" \
            test/"$MATRIX_PACKAGE"

      - name: Check package ${{ matrix.package }} xattrs for QEMU-built package
        if: matrix.runner == 'qemu' && matrix.package == 'fping'
        run: |
          for pkg in packages/x86_64/*.apk; do
            sudo tar --xattrs --xattrs-include='*.*' -xf "${pkg}" -C packages/x86_64/
          done
          getcap packages/x86_64/usr/sbin/fping

      - name: Check package ${{ matrix.package }} for mode bits
        if: matrix.package == 'sudo'
        run: |
          for pkg in packages/x86_64/*.apk; do
            sudo tar --xattrs --xattrs-include='*.*' -xf "${pkg}" -C packages/x86_64/
          done
          ls -hal packages/x86_64/usr/bin/sudo

      - name: Test installable and Scan for CVEs
        env:
          MATRIX_PACKAGE: ${{ matrix.package }}
        run: |
          if [[ "$MATRIX_PACKAGE" == "fping" ]]; then
            docker run --rm -v "$(pwd)":/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/$MATRIX_PACKAGE-*.apk; apk add libcap-utils; getcap /usr/sbin/fping"
          elif [[ "$MATRIX_PACKAGE" == "sudo" ]]; then
            docker run --rm -v "$(pwd)":/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/$MATRIX_PACKAGE-*.apk; ls -hal /usr/bin/sudo"
          elif [[ "$MATRIX_PACKAGE" == "postfix" ]]; then
            docker run --rm -v "$(pwd)":/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/$MATRIX_PACKAGE-*.apk; ls -hal /var/spool/postfix; ls -hal /var/lib/postfix"
          else
            docker run --rm -v "$(pwd)":/work --workdir /work cgr.dev/chainguard/wolfi-base /bin/sh -c "sed 's|=.*||' -i /etc/apk/world; apk add --allow-untrusted -X ./packages/ packages/x86_64/$MATRIX_PACKAGE-*.apk"
          fi
          # There is a huge fixed cost for every wolfictl scan invocation for grype DB init.
          # Do this outside of the loop in one invocation with every package.
          wolfictl scan \
          packages/x86_64/"$MATRIX_PACKAGE"-*.apk \
          2> /dev/null # The error message renders strangely on GitHub Actions, and the important information is already being sent to stdout.