Skip to content

Commit a8ccd42

Browse files
tstellartstellar
authored
workflows: Factor out artifact attestation and upload into a composite action (#169621)
Also, switch the release-sources workflow over to use this new action. As a result of this change, the attestation file for the sources will be renamed from attestation.jsonl to $TAG-sources-attestation.jsonl.
1 parent 2221f4a commit a8ccd42

File tree

2 files changed

+142
-20
lines changed

2 files changed

+142
-20
lines changed

‎.github/workflows/release-sources.yml‎

Lines changed: 37 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -64,11 +64,11 @@ jobs:
6464
name: Package Release Sources
6565
if: github.repository_owner == 'llvm'
6666
runs-on: ubuntu-24.04
67+
outputs:
68+
digest: ${{ steps.digest.outputs.digest }}
69+
artifact-id: ${{ steps.artifact-upload.outputs.artifact-id }}
6770
needs:
6871
- inputs
69-
permissions:
70-
id-token: write
71-
attestations: write
7272
steps:
7373
- name: Checkout LLVM
7474
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
@@ -79,30 +79,47 @@ jobs:
7979
run: |
8080
pip install --require-hashes -r ./llvm/utils/git/requirements.txt
8181
82-
- name: Check Permissions
83-
if: github.event_name != 'pull_request'
84-
env:
85-
GITHUB_TOKEN: ${{ github.token }}
86-
USER_TOKEN: ${{ secrets.RELEASE_TASKS_USER_TOKEN }}
87-
run: |
88-
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user ${{ github.actor }} --user-token "$USER_TOKEN" check-permissions
8982
- name: Create Tarballs
9083
run: |
9184
./llvm/utils/release/export.sh ${{ needs.inputs.outputs.export-args }}
92-
- name: Attest Build Provenance
93-
if: github.event_name != 'pull_request'
94-
id: provenance
95-
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
96-
with:
97-
subject-path: "*.xz"
98-
- if: github.event_name != 'pull_request'
85+
86+
- name: Generate sha256 digest for sources
87+
id: digest
9988
run: |
100-
mv ${{ steps.provenance.outputs.bundle-path }} .
101-
- name: Create Tarball Artifacts
89+
echo "digest=$(cat *.xz | sha256sum | cut -d ' ' -f 1)" >> $GITHUB_OUTPUT
90+
91+
- name: Release Sources Artifact
92+
id: artifact-upload
10293
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
10394
with:
95+
name: ${{ needs.inputs.outputs.ref }}-sources
10496
path: |
10597
*.xz
106-
attestation.jsonl
10798
99+
attest-release-sources:
100+
name: Attest Release Sources
101+
runs-on: ubuntu-24.04
102+
if: github.event_name != 'pull_request'
103+
needs:
104+
- inputs
105+
- release-sources
106+
permissions:
107+
id-token: write
108+
attestations: write
109+
steps:
110+
- name: Checkout Release Scripts
111+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
112+
with:
113+
sparse-checkout: |
114+
.github/workflows/upload-release-artifact
115+
llvm/utils/release/github-upload-release.py
116+
llvm/utils/git/requirements.txt
117+
sparse-checkout-cone-mode: false
108118

119+
- name: Upload Artifacts
120+
uses: ./.github/workflows/upload-release-artifact
121+
with:
122+
artifact-id: ${{ needs.release-sources.outputs.artifact-id }}
123+
attestation-name: ${{ needs.inputs.outputs.ref }}-sources-attestation
124+
digest: ${{ needs.release-sources.outputs.digest }}
125+
upload: false

‎.github/workflows/upload-release-artifact/action.yml‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
name: Upload Release Artifact
2+
description: >-
3+
Upload release artifact along with an attestation. The action assumes that
4+
the llvm-project repository has already been checked out.
5+
inputs:
6+
release-version:
7+
description: >-
8+
The release where the artifact will be attached.
9+
required: true
10+
upload:
11+
description: >-
12+
Whether or not to upload the file and attestation to the release. If this
13+
is set to false, then the file will be uploaded to the job as an artifact,
14+
but no atteastion will be generated and the artifact won't be uploaded
15+
to the release.
16+
default: true
17+
user-token:
18+
description: >-
19+
Token with premissions to read llvm teams that is used to ensure that
20+
the person who triggred the action has permission to upload artifacts.
21+
This is required if upload is true.
22+
requred: false
23+
attestation-name:
24+
description: >-
25+
This will be used for the artifact name that is attached to the workflow and
26+
will be used as the basename for the attestation file which will be called
27+
$attestation-name.jsonl. If this is not set, it will default
28+
to the falue of `files`.
29+
required: false
30+
artifact-id:
31+
description: >-
32+
Artifact id of the artifact with the files to upload.
33+
required: true
34+
digest:
35+
description: >-
36+
sha256 digest to verify the authenticity of the files being uploaded.
37+
required: true
38+
39+
runs:
40+
using: "composite"
41+
steps:
42+
- name: Download Artifact
43+
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
44+
id: download-artifact
45+
with:
46+
artifact-ids: ${{ inputs.artifact-id }}
47+
path: downloads
48+
49+
# In theory github artifacts are immutable so we could just rely on using
50+
# the artifact-id to download it, but just to be extra safe we want to
51+
# generated a digest for the files we are uploading so we can verify it
52+
# when downloading.
53+
# See also: https://irsl.medium.com/github-artifact-immutability-is-a-lie-9b6244095694
54+
- name: Verify Files
55+
shell: bash
56+
env:
57+
INPUTS_DIGEST: ${{ inputs.digest }}
58+
run: |
59+
digest_file="sha256"
60+
echo "$INPUTS_DIGEST -" > $digest_file
61+
cat ${{ steps.download-artifact.outputs.download-path }}/* | sha256sum -c $digest_file
62+
63+
- name: Attest Build Provenance
64+
id: provenance
65+
uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
66+
with:
67+
subject-path: ${{ steps.download-artifact.outputs.download-path }}/*
68+
69+
- name: Rename attestation file
70+
shell: bash
71+
env:
72+
INPUTS_ATTESTATION_NAME: ${{ inputs.attestation-name }}
73+
run: |
74+
mv ${{ steps.provenance.outputs.bundle-path }} "$INPUTS_ATTESTATION_NAME".jsonl
75+
76+
- name: Upload Build Provenance
77+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
78+
with:
79+
name: ${{ inputs.attestation-name }}
80+
path: |
81+
${{ inputs.attestation-name }}.jsonl
82+
83+
- name: Install Python Requirements
84+
if: inputs.upload == 'true'
85+
shell: bash
86+
run: |
87+
pip install --require-hashes -r ./llvm/utils/git/requirements.txt
88+
89+
- name: Check Permissions
90+
if: inputs.upload == 'true'
91+
env:
92+
GITHUB_TOKEN: ${{ github.token }}
93+
USER_TOKEN: ${{ inputs.user-token }}
94+
shell: bash
95+
run: |
96+
./llvm/utils/release/./github-upload-release.py --token "$GITHUB_TOKEN" --user "$GITHUB_ACTOR" --user-token "$USER_TOKEN" check-permissions
97+
- name: Upload Release
98+
shell: bash
99+
if: inputs.upload == 'true'
100+
run: |
101+
./llvm/utils/release/github-upload-release.py \
102+
--token ${{ github.token }} \
103+
--release ${{ inputs.release-version }} \
104+
upload \
105+
--files ${{ steps.download-artifact.outputs.download-path }}/* ${{ steps.vars.outputs.attestation-name}}.jsonl

0 commit comments

Comments
 (0)