kind-cluster-image-policy-tsa.yaml

# Copyright 2022 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Test policy-controller with TSA

on:
  pull_request:
    branches: [ 'main', 'release-*' ]

defaults:
  run:
    shell: bash

permissions: read-all

jobs:
  cip-test-trustroot-bring-your-own-keys:
    name: ClusterImagePolicy e2e tests with TrustRoot - Bring Your Own Keys
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false # Keep running if one leg fails.
      matrix:
        k8s-version:
        - v1.23.x
        - v1.24.x
        - v1.25.x

    env:
      KO_DOCKER_REPO: "registry.local:5000/policy-controller"
      SCAFFOLDING_RELEASE_VERSION: "v0.5.4"
      GO111MODULE: on
      GOFLAGS: -ldflags=-s -ldflags=-w
      KOCACHE: ~/ko

    steps:
    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
    - uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
      with:
        go-version: '1.20'
        check-latest: true

    # will use the latest release available for ko
    - uses: imjasonh/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6

    - uses: imranismail/setup-kustomize@a76db1c6419124d51470b1e388c4b29476f495f1 # v1.6.1

    - name: Install yq
      uses: mikefarah/yq@5ef537f3fd1a9437aa3ee44c32c6459a126efdc4 # v4.34.1

    - name: Setup mirror
      uses: chainguard-dev/actions/setup-mirror@main
      with:
        mirror: mirror.gcr.io

    - uses: sigstore/cosign-installer@6e04d228eb30da1757ee4e1dd75a0ec73a653e06 # v2

    - name: Install cluster + sigstore
      uses: sigstore/scaffolding/actions/setup@v0.6.4
      env:
        INSTALL_TSA: true
      with:
        k8s-version: ${{ matrix.k8s-version}}
        version: ${{ env.SCAFFOLDING_RELEASE_VERSION }}

    # Install policy-controller that does not have TUF embedded or installed.
    - name: Install policy-controller
      env:
        GIT_HASH: ${{ github.sha }}
        GIT_VERSION: ci
        LDFLAGS: ""
        POLICY_CONTROLLER_YAML: test/kustomize-no-tuf/policy-controller-e2e.yaml
        KO_PREFIX: registry.local:5000/policy-controller
        POLICY_CONTROLLER_ARCHS: linux/amd64
      run: |
        make ko-policy-controller
        kustomize build test/kustomize-no-tuf | kubectl apply -f -

        # Wait for the webhook to come up and become Ready
        kubectl rollout status --timeout 5m --namespace cosign-system deployments/webhook
        echo "TUF_ROOT_FILE=./root.json" >> $GITHUB_ENV

    - name: Checkout TSA for testing.
      uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.0.2
      with:
        repository: sigstore/timestamp-authority
        path: ./src/github.com/sigstore/timestamp-authority

    - name: Build timestamp-cli
      working-directory: ./src/github.com/sigstore/timestamp-authority
      run: |
        go build -o ./timestamp-cli ./cmd/timestamp-cli

    - name: Exercise our local TSA
      working-directory: ./src/github.com/sigstore/timestamp-authority
      run: |
        TSA_URL=$(kubectl -n tsa-system get ksvc tsa -ojsonpath='{.status.url}')
        echo "TSA_URL=$TSA_URL" >> $GITHUB_ENV

        curl $TSA_URL/api/v1/timestamp/certchain > ts_chain.pem
        echo "myblob" > myblob
        if ! ./timestamp-cli --timestamp_server $TSA_URL timestamp --hash sha256 --artifact myblob --out response.tsr ; then
          echo "failed to timestamp artifact"
          exit -1
        fi
        if ! ./timestamp-cli verify --timestamp response.tsr --artifact "myblob" --certificate-chain ts_chain.pem ; then
          echo "failed to verify timestamp"
          exit -1
        fi
        if ! ./timestamp-cli inspect --timestamp response.tsr --format json ; then
          echo "failed to inspect the timestamp"
          exit -1
        fi

    - name: Run TSA Tests
      timeout-minutes: 5
      run: |
        ./test/e2e_test_cluster_image_policy_with_tsa.sh

    - name: Collect diagnostics
      if: ${{ failure() }}
      uses: chainguard-dev/actions/kind-diag@84c993eaf02da1c325854fb272a4df9184bd80fc # main