sigstore-scaffolding-e2e.yaml

# Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES.  All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Private Sigstore E2E — keyless sign -> log round-trip against a self-hosted
# Sigstore stack deployed from the sigstore HELM charts (the `scaffold` umbrella
# chart: Fulcio + Rekor + CTLog + Trillian). The chart deploys plain Deployment
# + ClusterIP Services, so the stack is reached via `kubectl port-forward` to
# localhost on both Linux CI and macOS (Colima) — no Knative, MetalLB, or
# sslip.io. The setup lives in run.sh so local and CI runs are identical; this
# workflow only builds + attests the binary and then invokes that harness.
#
# Keyless OIDC uses the in-cluster Kubernetes ServiceAccount issuer: Fulcio is
# configured to trust it (scaffold-values.yaml) and the identity token is minted
# with `kubectl create token`. `aicr bundle` requires https:// signing
# endpoints, so a small TLS proxy (tlsproxy/) fronts the port-forwards with an
# mkcert certificate the runner trust store accepts.
#
# Trust-root verification (#1153): the suite also runs `aicr verify --trust-root`
# against a trusted_root.json built (with cosign trusted-root create) from the
# local Fulcio chain, Rekor key, and CTLog key, asserting the bundle attestation
# validates against the private stack. cosign is installed below.

name: Private Sigstore E2E

on:
  workflow_dispatch: {}
  push:
    branches:
      - main
    paths: &trigger_paths
      - 'pkg/bundler/attestation/**'
      - 'pkg/bundler/verifier/**'
      - 'pkg/trust/**'
      - 'pkg/cli/**'
      - 'cmd/aicr/**'
      - 'go.mod'
      - 'go.sum'
      - 'vendor/**'
      - 'tests/chainsaw/signing/bundle-attestation-private-sigstore/**'
      - '.github/workflows/sigstore-scaffolding-e2e.yaml'
      - '.github/actions/load-versions/**'
      - '.github/actions/setup-build-tools/**'
      - '.github/actions/generate-slsa-predicate/**'
      - '.settings.yaml'
      - '.goreleaser.yaml'
      - '!**.md'
  # Validate on same-repo PRs (fork PRs lack the OIDC needed to attest the
  # binary; the job `if` below skips them rather than failing).
  pull_request:
    branches:
      - main
    paths: *trigger_paths

# Least privilege at the workflow level; id-token is granted only to the job
# that needs it (see the job-scoped permissions below).
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'push' }}

jobs:
  sigstore-scaffolding-e2e:
    name: Private Sigstore E2E
    runs-on: ubuntu-latest
    timeout-minutes: 25
    permissions:
      contents: read
      # id-token: write mints a GitHub Actions OIDC token for Sigstore keyless
      # signing. The "Build aicr binary" step runs goreleaser, whose cosign
      # attest-blob hook uses that OIDC identity to produce the binary's SLSA
      # provenance — the attestation `aicr bundle --attest` requires. The keyless
      # BUNDLE signing uses an in-cluster Kubernetes ServiceAccount token (minted
      # by run.sh), not GitHub OIDC.
      id-token: write
    # Skip on fork PRs: a read-only token cannot mint the OIDC needed to attest
    # the binary. push/workflow_dispatch always run.
    if: >-
      github.event_name != 'pull_request' ||
      github.event.pull_request.head.repo.full_name == github.repository

    steps:
      - name: Checkout Code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
        with:
          persist-credentials: false

      - name: Load versions
        id: versions
        uses: ./.github/actions/load-versions

      - name: Set up Go
        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
        with:
          go-version: ${{ steps.versions.outputs.go }}
          cache: false  # vendor/ provides deps

      - name: Install GoReleaser
        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94  # v7.2.3
        with:
          version: ${{ steps.versions.outputs.goreleaser }}
          install-only: true

      - name: Install Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6  # v4.1.2
        with:
          # Pin from .settings.yaml (>= v3.1.0) so cosign logs DSSE attestations
          # to Rekor v2 as hashedrekord/PAE. The installer default (v3.0.6) writes
          # the legacy dsse entry type, which sigstore-go cannot verify. See #1650.
          cosign-release: ${{ steps.versions.outputs.cosign }}

      # run.sh drives the stack: kind + helm install scaffold + port-forward +
      # TLS proxy + chainsaw, so it needs chainsaw, kind, kubectl, helm, and yq.
      - name: Install test tools
        uses: ./.github/actions/setup-build-tools
        with:
          install_chainsaw: 'true'
          chainsaw_version: '${{ steps.versions.outputs.chainsaw }}'
          chainsaw_sha256: '${{ steps.versions.outputs.chainsaw_sha256_linux_amd64 }}'
          install_kind: 'true'
          kind_version: '${{ steps.versions.outputs.kind }}'
          install_kubectl: 'true'
          kubectl_version: '${{ steps.versions.outputs.kubectl }}'
          install_helm: 'true'
          helm_version: '${{ steps.versions.outputs.helm }}'
          install_yq: 'true'

      # mkcert issues the localhost cert the TLS proxy serves and installs its CA
      # into the runner trust store so aicr's Go TLS client trusts it. The
      # version/checksum are wired through load-versions (shared with the KMS
      # MiniStack e2e). Ephemeral runner, so the trust-store change is safe.
      # Inline by design: a single-use pinned download for this workflow; a
      # Layer-2 composite action would add indirection without any reuse.
      - name: Install mkcert
        env:
          MKCERT_VERSION: ${{ steps.versions.outputs.mkcert }}
          MKCERT_SHA256: ${{ steps.versions.outputs.mkcert_sha256_linux_amd64 }}
        run: |
          set -euo pipefail
          tmp="$(mktemp)"
          curl -fsSL -o "$tmp" \
            "https://github.com/FiloSottile/mkcert/releases/download/${MKCERT_VERSION}/mkcert-${MKCERT_VERSION}-linux-amd64"
          echo "${MKCERT_SHA256}  ${tmp}" | sha256sum -c -
          sudo install -m 0755 "$tmp" /usr/local/bin/mkcert
          rm -f "$tmp"

      # Build + attest the binary BEFORE the e2e. The cosign attest-blob hook
      # signs against the PUBLIC Sigstore instance (the binary attestation is
      # verified against the public trust root); the local scaffold Fulcio is
      # used only for the keyless BUNDLE attestation, via --fulcio-url. Keeping
      # the two trust roots separate is why this runs first.
      - name: Generate SLSA predicate
        uses: ./.github/actions/generate-slsa-predicate
        with:
          workflow_file: sigstore-scaffolding-e2e.yaml

      # Inline by design: a one-line goreleaser invocation, not reusable plumbing.
      - name: Build aicr binary
        env:
          GOFLAGS: -mod=vendor
        run: |
          set -euo pipefail
          goreleaser build --clean --single-target --snapshot --timeout 10m

      # Inline by design: workflow-specific glue (find the dist/ binary, set the
      # attestation identity for this workflow); nothing reusable to extract.

      - name: Locate binary and detect attestation
        env:
          # Pass via env (not direct ${{ }} expansion in the script body) to
          # avoid template-injection into the shell.
          REPO: ${{ github.repository }}
        run: |
          set -euo pipefail
          AICR_BIN=""
          for pattern in dist/aicr_linux_amd64_v1/aicr dist/aicr_linux_amd64/aicr; do
            if [ -x "$pattern" ]; then
              AICR_BIN="$(pwd)/$pattern"
              break
            fi
          done
          if [ -z "$AICR_BIN" ]; then
            echo "::error::Built binary not found in dist/"
            exit 1
          fi
          echo "AICR_BIN=$AICR_BIN" >> "$GITHUB_ENV"

          # The binary attestation is required: `aicr bundle --attest` refuses to
          # run without it. The chainsaw bundle step pins this identity via
          # --certificate-identity-regexp.
          ATTEST_FILE="$(dirname "$AICR_BIN")/aicr-attestation.sigstore.json"
          if [ ! -f "$ATTEST_FILE" ]; then
            echo "::error::No binary attestation at $ATTEST_FILE; --attest will fail"
            exit 1
          fi
          echo "AICR_IDENTITY_REGEXP=https://github.com/${REPO}/.github/workflows/sigstore-scaffolding-e2e\\.yaml@.*" >> "$GITHUB_ENV"
          echo "Binary attestation found: $ATTEST_FILE"

      # Stand up the stack and run the suite. run.sh is the single source of
      # truth shared with local runs: it creates the Kind cluster, helm-installs
      # the scaffold chart, configures Fulcio OIDC trust, port-forwards + fronts
      # Fulcio/Rekor with TLS, mints the SA token, and runs chainsaw.
      # Inline by design: this step is a thin delegation to run.sh, which IS the
      # reusable harness (so the heavy logic already lives outside the workflow).
      - name: Run private-sigstore e2e
        env:
          SCAFFOLD_CHART_VERSION: ${{ steps.versions.outputs.scaffold_chart }}
          KIND_NODE_IMAGE: ${{ steps.versions.outputs.kind_node_image }}
        run: |
          set -euo pipefail
          bash tests/chainsaw/signing/bundle-attestation-private-sigstore/run.sh