code-review-demo/.github/workflows/main.yml at main · kosli-dev/code-review-demo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: Build

on:
  push:
    branches:
      - '*-main'
      - '*-release'

env:
  KOSLI_ORG: kosli-public
  KOSLI_FLOW: code-review-demo
  KOSLI_API_TOKEN: '${{ secrets.KOSLI_PUBLIC_API_TOKEN }}'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}

jobs:
  setup:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Kosli cli
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}


      - name: Create Kosli Custom Attestation Type
        run: kosli create attestation-type code-review
          --schema code-review-custom-type-schema.json
          --jq "all(.[]; .pass == true)"


      - name: Create Kosli Flow
        run: kosli create flow ${{ env.KOSLI_FLOW }}
          --template-file build-template.yml
          --description "Code Review Demo"

      - name: Begin Kosli Trail
        run: kosli begin trail "${{ github.sha }}"
          --flow ${{ env.KOSLI_FLOW }}


  pull-request:
    needs: [setup]
    runs-on: ubuntu-24.04
    permissions:
      id-token: write
      contents: write
      pull-requests: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          fetch-tags: true

      - name: Setup Kosli cli
        uses: kosli-dev/setup-cli-action@v2
        with:
          version: ${{ vars.KOSLI_CLI_VERSION }}

      - name: Attest pull-request evidence to Kosli
        run: kosli attest pullrequest github
          --name pull-request
          --flow ${{ env.KOSLI_FLOW }}
          --trail ${{ github.sha }}
          --github-token ${{ secrets.GITHUB_TOKEN }}


  code-review:
    needs: [pull-request]
    uses: ./.github/workflows/code-review.yml
    with:
      kosli-org: 'kosli-public'
      kosli-build-flow: 'code-review-demo'
      kosli-release-flow: 'code-review-demo'
      kosli-trail: ${{ github.sha }}
      base-tag: '1.0.0'
    secrets:
      kosli-api-token: ${{ secrets.KOSLI_PUBLIC_API_TOKEN }}