test-sigstore-integration.yml

name: Test Sigstore integration
on:
  # Want to trigger these tests whenever the Sigstore command
  # is modified and PR is closed and merged.
  # Reason: OIDC token access constraints in PRs
  pull_request:
    paths:
      - "scai-gen/cmd/sigstore.go"
    types:
      - closed

jobs:
  sigstore:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-22.04
    permissions:
      id-token: write # Needed for signing
    steps:
      - name: Install Go
        uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a
        with:
          go-version: 1.20.x

      - name: Checkout updated scai-gen CLI tools
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683

      - name: Setup Env
        run: |
          echo "$(go env GOPATH)/bin" >> $GITHUB_PATH

      - name: Install scai-gen CLI tools
        shell: bash
        run: |
          go install ./scai-gen

      - name: Sign and upload SCAI report (Sigstore)
        id: sign-report
        uses: ./.github/actions/scai-gen-sigstore
        with:
          statement-name: examples/sbom+slsa/metadata/evidence-collection.scai.json
          attestation-name: evidence-collection.scai.sig.json