chore: Make maven publisher an action #2482

AdamKorcz · 2023-07-26T21:41:11Z

Closes #2369

laurentsimon

Thanks @AdamKorcz Looking pretty good. Just a few nits and we should be ready to merge.

actions/maven/publish/action.yml

internal/builders/maven/README.md

actions/maven/publish/action.yml

internal/builders/maven/README.md

laurentsimon · 2023-07-26T22:30:13Z

@AdamKorcz please ping when the comments are resolved. I don't always know when I should re-review. Thanks!

AdamKorcz · 2023-07-28T20:02:33Z

@laurentsimon @ianlewis This one should be ready to review again. Note that this uses a plugin that hashes the artifacts and creates the json. Ideally this should be hosted at a slsa-framework-owned Maven Central repository account.

actions/maven/publish/action.yml

internal/builders/maven/README.md

actions/maven/publish/action.yml

internal/builders/maven/README.md

actions/maven/publish/action.yml

internal/builders/maven/README.md

AdamKorcz · 2023-07-31T23:06:59Z

Ready for another round of review except for #2482 (comment).

actions/maven/publish/action.yml

...aven/publish/slsa-hashing-plugin/src/main/java/io/github/slsa-framework/JarfileHashMojo.java

internal/builders/maven/action.yml

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Create JarfileHashMojo.java Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Create pom.xml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Delete JarfileHashMojo.java Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Delete pom.xml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update README.md Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update README.md Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update README.md Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> --------- Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

actions/maven/publish/README.md

actions/maven/publish/action.yml

internal/builders/maven/action.yml

Signed-off-by: AdamKorcz <adam@adalogics.com>

AdamKorcz · 2023-08-01T21:01:38Z

@laurentsimon @ianlewis Please check again.

laurentsimon · 2023-08-01T21:52:35Z

actions/maven/publish/action.yml

+        SLSA_DIR: "${{ inputs.provenance-download-name }}"
+        PROVENANCE_FILES: "${{ inputs.provenance-download-name }}"
+      run: |
+        cd __BUILDER_CHECKOUT_DIR__/actions/maven/publish/slsa-hashing-plugin && mvn clean install && cd -


better to mve this to ../ to keep the git tree clean (some tools check for that), but we can do that later.

Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

laurentsimon · 2023-08-01T21:56:30Z

actions/maven/publish/action.yml

+      uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main
+      with:
+        repository: slsa-framework/slsa-github-generator
+        ref: v1.8.0


@AdamKorcz fyi I updated this to v1.8.0

@laurentsimon is this expected to work right now?

no its not. It will only work after the release. I'll work on #2508 to be sure we don't forget

@laurentsimon

Similar to #2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <adam@adalogics.com>

Closes slsa-framework#2369 --------- Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Co-authored-by: Ian Lewis <ianlewis@google.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Signed-off-by: Noah Elzner <elzner@google.com>

@laurentsimon

Similar to slsa-framework#2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: Noah Elzner <elzner@google.com>

AdamKorcz requested review from asraa, ianlewis, laurentsimon and joshuagl as code owners July 26, 2023 21:41

laurentsimon reviewed Jul 26, 2023

View reviewed changes

ianlewis reviewed Jul 26, 2023

View reviewed changes

laurentsimon reviewed Jul 28, 2023

View reviewed changes

laurentsimon reviewed Jul 30, 2023

View reviewed changes

actions/maven/publish/action.yml Show resolved Hide resolved

internal/builders/maven/README.md Outdated Show resolved Hide resolved

internal/builders/maven/README.md Show resolved Hide resolved

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

ianlewis reviewed Jul 31, 2023

View reviewed changes

actions/maven/publish/action.yml Show resolved Hide resolved

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

internal/builders/maven/README.md Outdated Show resolved Hide resolved

AdamKorcz force-pushed the maven-publisher-to-action branch 2 times, most recently from f652d2d to 6e4ee0e Compare July 31, 2023 23:02

ianlewis reviewed Aug 1, 2023

View reviewed changes

AdamKorcz and others added 15 commits August 1, 2023 12:06

chore: Make maven publisher an action

614721d

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

fix nits

a7778a8

Signed-off-by: AdamKorcz <adam@adalogics.com>

lowercase more variables

eb64e50

Signed-off-by: AdamKorcz <adam@adalogics.com>

remove '@'

3e04e30

Signed-off-by: AdamKorcz <adam@adalogics.com>

use secure-project-checkout at main

d2cacb8

Signed-off-by: AdamKorcz <adam@adalogics.com>

Update README.md

0bf054b

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update README.md

e8023f3

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

remove .intoto

2581ef9

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

remove two more cases of .intoto

9b2cae9

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update README.md

e23e88e

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update README.md

45afa78

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update actions/maven/publish/action.yml

8cb0d99

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update actions/maven/publish/action.yml

aa0ab47

Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Install hashing plugin from tool dir (#2)

b12e9f3

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

AdamKorcz added 7 commits August 1, 2023 20:24

rename __TOOL_CHECKOUT_DIR__ to __BUILDER_CHECKOUT_DIR__

9bee2f4

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

debug

20fa4a7

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update action.yml

6dae016

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update action.yml

4c021a1

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update action.yml

7081556

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update action.yml

46897c8

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

Update action.yml

fcb67a5

Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>

laurentsimon reviewed Aug 1, 2023

View reviewed changes

actions/maven/publish/README.md Outdated Show resolved Hide resolved

laurentsimon reviewed Aug 1, 2023

View reviewed changes

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

laurentsimon reviewed Aug 1, 2023

View reviewed changes

actions/maven/publish/action.yml Outdated Show resolved Hide resolved

laurentsimon reviewed Aug 1, 2023

View reviewed changes

internal/builders/maven/action.yml Outdated Show resolved Hide resolved

AdamKorcz added 6 commits August 1, 2023 21:28

rename Mojo

5838ba5

Signed-off-by: AdamKorcz <adam@adalogics.com>

rename tool dir to builder dir in maven builder

459f39f

Signed-off-by: AdamKorcz <adam@adalogics.com>

remove packages: read

f141f56

Signed-off-by: AdamKorcz <adam@adalogics.com>

test

0ca0fa3

Signed-off-by: AdamKorcz <adam@adalogics.com>

remove hyphen in java package name

d08ce2b

Signed-off-by: AdamKorcz <adam@adalogics.com>

revert debugging helpers

72c5617

Signed-off-by: AdamKorcz <adam@adalogics.com>

laurentsimon reviewed Aug 1, 2023

View reviewed changes

laurentsimon added 2 commits August 1, 2023 14:53

Update action.yml

f7fa441

Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

Use v1.8.0 as ref

78a5806

Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

laurentsimon approved these changes Aug 1, 2023

View reviewed changes

laurentsimon reviewed Aug 1, 2023

View reviewed changes

laurentsimon enabled auto-merge (squash) August 1, 2023 21:57

laurentsimon merged commit a594a20 into slsa-framework:main Aug 1, 2023
74 checks passed

AdamKorcz mentioned this pull request Aug 1, 2023

chore: ref v1.8.0 instead of main #2509

Merged

laurentsimon pushed a commit that referenced this pull request Aug 1, 2023

chore: ref v1.8.0 instead of main (#2509)

9c94c20

Similar to #2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <adam@adalogics.com>

AdamKorcz deleted the maven-publisher-to-action branch August 4, 2023 11:25

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Make maven publisher an action #2482

chore: Make maven publisher an action #2482

AdamKorcz commented Jul 26, 2023

laurentsimon left a comment

laurentsimon commented Jul 26, 2023

AdamKorcz commented Jul 28, 2023

AdamKorcz commented Jul 31, 2023

AdamKorcz commented Aug 1, 2023

laurentsimon Aug 1, 2023

laurentsimon Aug 1, 2023

AdamKorcz Aug 1, 2023

laurentsimon Aug 1, 2023

chore: Make maven publisher an action #2482

chore: Make maven publisher an action #2482

Conversation

AdamKorcz commented Jul 26, 2023

laurentsimon left a comment

Choose a reason for hiding this comment

laurentsimon commented Jul 26, 2023

AdamKorcz commented Jul 28, 2023

AdamKorcz commented Jul 31, 2023

AdamKorcz commented Aug 1, 2023

laurentsimon Aug 1, 2023

Choose a reason for hiding this comment

laurentsimon Aug 1, 2023

Choose a reason for hiding this comment

AdamKorcz Aug 1, 2023

Choose a reason for hiding this comment

laurentsimon Aug 1, 2023

Choose a reason for hiding this comment