-
Notifications
You must be signed in to change notification settings - Fork 127
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: Make maven publisher an action #2482
chore: Make maven publisher an action #2482
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @AdamKorcz Looking pretty good. Just a few nits and we should be ready to merge.
@AdamKorcz please ping when the comments are resolved. I don't always know when I should re-review. Thanks! |
@laurentsimon @ianlewis This one should be ready to review again. Note that this uses a plugin that hashes the artifacts and creates the json. Ideally this should be hosted at a slsa-framework-owned Maven Central repository account. |
f652d2d
to
6e4ee0e
Compare
Ready for another round of review except for #2482 (comment). |
...aven/publish/slsa-hashing-plugin/src/main/java/io/github/slsa-framework/JarfileHashMojo.java
Show resolved
Hide resolved
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
* Create JarfileHashMojo.java Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Create pom.xml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Delete JarfileHashMojo.java Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Delete pom.xml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update README.md Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update action.yml Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update README.md Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> * Update README.md Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> --------- Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Co-authored-by: Ian Lewis <ianlewis@google.com> Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: AdamKorcz <adam@adalogics.com>
@laurentsimon @ianlewis Please check again. |
SLSA_DIR: "${{ inputs.provenance-download-name }}" | ||
PROVENANCE_FILES: "${{ inputs.provenance-download-name }}" | ||
run: | | ||
cd __BUILDER_CHECKOUT_DIR__/actions/maven/publish/slsa-hashing-plugin && mvn clean install && cd - |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
better to mve this to ../
to keep the git tree clean (some tools check for that), but we can do that later.
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
uses: slsa-framework/slsa-github-generator/.github/actions/secure-builder-checkout@main | ||
with: | ||
repository: slsa-framework/slsa-github-generator | ||
ref: v1.8.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@AdamKorcz fyi I updated this to v1.8.0
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@laurentsimon is this expected to work right now?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
no its not. It will only work after the release. I'll work on #2508 to be sure we don't forget
Similar to #2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <adam@adalogics.com>
Closes slsa-framework#2369 --------- Signed-off-by: AdamKorcz <44787359+AdamKorcz@users.noreply.github.com> Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Co-authored-by: Ian Lewis <ianlewis@google.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Signed-off-by: Noah Elzner <elzner@google.com>
Similar to slsa-framework#2482 (comment) cc @laurentsimon Signed-off-by: AdamKorcz <adam@adalogics.com> Signed-off-by: Noah Elzner <elzner@google.com>
Closes #2369