|
| 1 | +"use strict"; |
| 2 | +var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) { |
| 3 | + if (k2 === undefined) k2 = k; |
| 4 | + var desc = Object.getOwnPropertyDescriptor(m, k); |
| 5 | + if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) { |
| 6 | + desc = { enumerable: true, get: function() { return m[k]; } }; |
| 7 | + } |
| 8 | + Object.defineProperty(o, k2, desc); |
| 9 | +}) : (function(o, m, k, k2) { |
| 10 | + if (k2 === undefined) k2 = k; |
| 11 | + o[k2] = m[k]; |
| 12 | +})); |
| 13 | +var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) { |
| 14 | + Object.defineProperty(o, "default", { enumerable: true, value: v }); |
| 15 | +}) : function(o, v) { |
| 16 | + o["default"] = v; |
| 17 | +}); |
| 18 | +var __importStar = (this && this.__importStar) || function (mod) { |
| 19 | + if (mod && mod.__esModule) return mod; |
| 20 | + var result = {}; |
| 21 | + if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k); |
| 22 | + __setModuleDefault(result, mod); |
| 23 | + return result; |
| 24 | +}; |
| 25 | +var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) { |
| 26 | + function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); } |
| 27 | + return new (P || (P = Promise))(function (resolve, reject) { |
| 28 | + function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } } |
| 29 | + function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } } |
| 30 | + function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); } |
| 31 | + step((generator = generator.apply(thisArg, _arguments || [])).next()); |
| 32 | + }); |
| 33 | +}; |
| 34 | +Object.defineProperty(exports, "__esModule", { value: true }); |
| 35 | +exports.collectEvidences = collectEvidences; |
| 36 | +const core = __importStar(require("@actions/core")); |
| 37 | +const utils_1 = require("./utils"); |
| 38 | +const http_client_1 = require("@actions/http-client"); |
| 39 | +const fs_1 = require("fs"); |
| 40 | +const path = __importStar(require("path")); |
| 41 | +/** |
| 42 | + * Collects evidences from the current workflow. |
| 43 | + * This function first checks if evidence collection is supported by the Artifactory server. |
| 44 | + */ |
| 45 | +function collectEvidences() { |
| 46 | + return __awaiter(this, void 0, void 0, function* () { |
| 47 | + try { |
| 48 | + core.startGroup('Collecting evidences'); |
| 49 | + // Check if evidence collection is supported by the server |
| 50 | + const evidenceConfig = yield getEvidenceConfiguration(); |
| 51 | + if (!evidenceConfig.external_evidence_collection_supported) { |
| 52 | + core.info('Evidence collection is not supported by this Artifactory server. Skipping evidence collection.'); |
| 53 | + return; |
| 54 | + } |
| 55 | + core.info(`Evidence collection is supported. Maximum file size: ${evidenceConfig.max_evidence_file_size_mb} MB`); |
| 56 | + // Read sigstore bundle file paths and create evidence for each |
| 57 | + yield createEvidenceFromSigstoreBundles(evidenceConfig.max_evidence_file_size_mb); |
| 58 | + } |
| 59 | + catch (error) { |
| 60 | + core.warning('Failed while attempting to collect evidences: ' + error); |
| 61 | + } |
| 62 | + finally { |
| 63 | + core.endGroup(); |
| 64 | + } |
| 65 | + }); |
| 66 | +} |
| 67 | +/** |
| 68 | + * Checks if evidence collection is supported by the Artifactory server. |
| 69 | + * @returns EvidenceConfigResponse with support status and max file size |
| 70 | + */ |
| 71 | +function getEvidenceConfiguration() { |
| 72 | + return __awaiter(this, void 0, void 0, function* () { |
| 73 | + const credentials = utils_1.Utils.collectJfrogCredentialsFromEnvVars(); |
| 74 | + if (!credentials.jfrogUrl) { |
| 75 | + throw new Error('JF_URL is required to check evidence support'); |
| 76 | + } |
| 77 | + // Get access token for authentication |
| 78 | + let accessToken = credentials.accessToken; |
| 79 | + if (!accessToken && credentials.oidcProviderName) { |
| 80 | + // Import OidcUtils dynamically to avoid circular dependency |
| 81 | + const { OidcUtils } = yield Promise.resolve().then(() => __importStar(require('./oidc-utils'))); |
| 82 | + accessToken = yield OidcUtils.exchangeOidcToken(credentials); |
| 83 | + } |
| 84 | + if (!accessToken) { |
| 85 | + throw new Error('No access token available for authentication'); |
| 86 | + } |
| 87 | + // Remove trailing slash from jfrogUrl to avoid double slashes when appending the API path |
| 88 | + const url = `${credentials.jfrogUrl.replace(/\/$/, '')}/evidence/api/v1/config/`; |
| 89 | + const httpClient = new http_client_1.HttpClient(); |
| 90 | + const headers = { |
| 91 | + 'Authorization': `Bearer ${accessToken}`, |
| 92 | + }; |
| 93 | + core.debug(`Getting evidence configuration at: ${url}`); |
| 94 | + let response; |
| 95 | + let body; |
| 96 | + try { |
| 97 | + response = yield httpClient.get(url, headers); |
| 98 | + body = yield response.readBody(); |
| 99 | + } |
| 100 | + catch (error) { |
| 101 | + core.warning(`Failed to get evidence configuration (network error or server unavailable): ${error}`); |
| 102 | + return { external_evidence_collection_supported: false, max_evidence_file_size_mb: 0 }; |
| 103 | + } |
| 104 | + if (response.message.statusCode !== 200) { |
| 105 | + core.warning(`Failed to get evidence configuration. Status: ${response.message.statusCode}, Response: ${body}`); |
| 106 | + return { external_evidence_collection_supported: false, max_evidence_file_size_mb: 0 }; |
| 107 | + } |
| 108 | + try { |
| 109 | + const config = JSON.parse(body); |
| 110 | + return config; |
| 111 | + } |
| 112 | + catch (error) { |
| 113 | + core.warning(`Failed to parse evidence config response: ${error}`); |
| 114 | + return { external_evidence_collection_supported: false, max_evidence_file_size_mb: 0 }; |
| 115 | + } |
| 116 | + }); |
| 117 | +} |
| 118 | +/** |
| 119 | + * Reads sigstore bundle file paths and creates evidence for each file. |
| 120 | + * Reads from ${RUNNER_TEMP}/created_attestation_paths.txt |
| 121 | + * @param maxFileSizeMB Maximum allowed file size in MB |
| 122 | + */ |
| 123 | +function createEvidenceFromSigstoreBundles(maxFileSizeMB) { |
| 124 | + return __awaiter(this, void 0, void 0, function* () { |
| 125 | + const runnerTemp = process.env.RUNNER_TEMP; |
| 126 | + if (!runnerTemp) { |
| 127 | + core.warning('RUNNER_TEMP environment variable is not set. Skipping evidence creation.'); |
| 128 | + return; |
| 129 | + } |
| 130 | + const attestationPathsFile = path.join(runnerTemp, 'created_attestation_paths.txt'); |
| 131 | + try { |
| 132 | + // Check if the file exists |
| 133 | + yield fs_1.promises.access(attestationPathsFile); |
| 134 | + } |
| 135 | + catch (error) { |
| 136 | + core.info(`No attestation paths file found. Skipping evidence creation. Searched for: ${attestationPathsFile}. Error: ${error}`); |
| 137 | + return; |
| 138 | + } |
| 139 | + // Read the file content |
| 140 | + core.info(`Reading attestation paths file: ${attestationPathsFile}`); |
| 141 | + const fileContent = yield fs_1.promises.readFile(attestationPathsFile, 'utf8'); |
| 142 | + const filePaths = fileContent.split('\n').filter(line => line.trim() !== ''); |
| 143 | + if (filePaths.length === 0) { |
| 144 | + core.info('No sigstore bundle files found in attestation paths file.'); |
| 145 | + return; |
| 146 | + } |
| 147 | + core.info(`Found ${filePaths.length} sigstore bundle file(s) to process.`); |
| 148 | + for (const filePath of filePaths) { |
| 149 | + try { |
| 150 | + const fileStats = yield fs_1.promises.stat(filePath); |
| 151 | + const fileSizeMB = fileStats.size / (1024 * 1024); // Convert bytes to MB |
| 152 | + if (fileSizeMB > maxFileSizeMB) { |
| 153 | + core.warning(`Skipping ${filePath}: File size (${fileSizeMB.toFixed(2)} MB) exceeds maximum allowed size (${maxFileSizeMB} MB)`); |
| 154 | + continue; |
| 155 | + } |
| 156 | + core.info(`Creating evidence for: ${filePath}`); |
| 157 | + const output = yield utils_1.Utils.runCliAndGetOutput(['evd', 'create', '--sigstore-bundle', filePath]); |
| 158 | + core.info(`Evidence created successfully for ${filePath}: ${output}`); |
| 159 | + } |
| 160 | + catch (error) { |
| 161 | + core.warning(`Failed to create evidence for ${filePath}: ${error}`); |
| 162 | + } |
| 163 | + } |
| 164 | + }); |
| 165 | +} |
0 commit comments