witness.yml

# Copyright 2023 The Archivista Contributors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

on:
    workflow_call:
        inputs:
            pull_request:
                required: true
                type: boolean
            command:
                required: true
                type: string
            step:
                required: true
                type: string
            attestations:
                required: true
                type: string

permissions:
  contents: read

jobs:
    witness:
        runs-on: ubuntu-22.04
        permissions:
          contents: read
          id-token: write
        steps:
          - name: Harden Runner
            uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
            with:
              egress-policy: audit

          - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
          - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5.1.0
            with:
              go-version: 1.22.x

          - if: ${{ inputs.pull_request == false }}
            uses: testifysec/witness-run-action@79320a907f611f2fb40ced8e13c66af988b2d9db
            with:
              witness-install-dir: /opt/witness
              step: ${{ inputs.step }}
              attestations: ${{ inputs.attestations }}
              command: /bin/sh -c "${{ inputs.command }}"

          - if: ${{ inputs.pull_request == true }}
            run: ${{ inputs.command }}

          - if: ${{ inputs.step == 'tests' }}
            uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a