Skip to content

Commit 7f33042

Browse files
GrantBirkiGrantBirki
authored
Merge pull request #94 from github/deps/sigstore-ruby
vendor sigstore ruby directly
2 parents 0fa85ac + b938dd1 commit 7f33042

File tree

101 files changed

+8890
-5
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

101 files changed

+8890
-5
lines changed

‎Gemfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ group :development do
1414
gem "rubocop-performance", "~> 1"
1515
gem "rubocop-rspec", "~> 3"
1616
gem "rubygems-await", "~> 0.5.4"
17-
gem "sigstore-cli", "~> 0.2.1"
17+
gem "sigstore-cli", git: "https://github.com/sigstore/sigstore-ruby", ref: "ce93acf7fa7e26ba81ff21820848d7df2273a557"
1818
gem "simplecov", "~> 0.22"
1919
gem "simplecov-erb", "~> 1"
2020
gem "vcr", "~> 6.3", ">= 6.3.1"

‎Gemfile.lock‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,12 @@
1+
GIT
2+
remote: https://github.com/sigstore/sigstore-ruby
3+
revision: ce93acf7fa7e26ba81ff21820848d7df2273a557
4+
ref: ce93acf7fa7e26ba81ff21820848d7df2273a557
5+
specs:
6+
sigstore-cli (0.2.1)
7+
sigstore (= 0.2.1)
8+
thor
9+
110
PATH
211
remote: .
312
specs:
@@ -189,9 +198,6 @@ GEM
189198
net-http
190199
protobug_sigstore_protos (~> 0.1.0)
191200
uri
192-
sigstore-cli (0.2.1)
193-
sigstore (= 0.2.1)
194-
thor
195201
simplecov (0.22.0)
196202
docile (~> 1.1)
197203
simplecov-html (~> 0.11)
@@ -232,7 +238,7 @@ DEPENDENCIES
232238
rubocop-performance (~> 1)
233239
rubocop-rspec (~> 3)
234240
rubygems-await (~> 0.5.4)
235-
sigstore-cli (~> 0.2.1)
241+
sigstore-cli!
236242
simplecov (~> 0.22)
237243
simplecov-erb (~> 1)
238244
vcr (~> 6.3, >= 6.3.1)

‎vendor/cache/sigstore-cli-0.2.1.gem‎

-8 KB
Binary file not shown.

‎vendor/cache/sigstore-ruby-ce93acf7fa7e/.bundlecache‎

Whitespace-only changes.

‎vendor/cache/sigstore-ruby-ce93acf7fa7e/.github/dependabot.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
version: 2
2+
3+
updates:
4+
- package-ecosystem: bundler
5+
directory: /
6+
schedule:
7+
interval: daily
8+
9+
- package-ecosystem: github-actions
10+
directory: /
11+
schedule:
12+
interval: daily
13+
open-pull-requests-limit: 99
14+
rebase-strategy: "disabled"
15+
groups:
16+
actions:
17+
patterns:
18+
- "*"
19+
20+
- package-ecosystem: github-actions
21+
directory: .github/actions/upload-coverage/
22+
schedule:
23+
interval: daily
24+
open-pull-requests-limit: 99
25+
rebase-strategy: "disabled"
26+
groups:
27+
actions:
28+
patterns:
29+
- "*"

‎vendor/cache/sigstore-ruby-ce93acf7fa7e/.github/workflows/ci.yml‎

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
schedule:
9+
- cron: "0 12 * * *"
10+
11+
permissions: {}
12+
13+
jobs:
14+
ruby-versions:
15+
uses: ruby/actions/.github/workflows/ruby_versions.yml@3fbf038d6f0d8043b914f923764c61bc2a114a77
16+
with:
17+
engine: all
18+
min_version: 3.2
19+
20+
test:
21+
needs: ruby-versions
22+
runs-on: ${{ matrix.os }}
23+
name: Test Ruby ${{ matrix.ruby }} / ${{ matrix.os }}
24+
strategy:
25+
fail-fast: false
26+
matrix:
27+
ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
28+
os: [ubuntu-latest]
29+
# os: [ ubuntu-latest, macos-latest, windows-latest ]
30+
# include:
31+
# - { os: windows-latest, ruby: ucrt }
32+
# - { os: windows-latest, ruby: mingw }
33+
# - { os: windows-latest, ruby: mswin }
34+
steps:
35+
- name: Harden Runner
36+
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
37+
with:
38+
egress-policy: audit
39+
40+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
with:
42+
persist-credentials: false
43+
- name: Set up Ruby
44+
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
45+
with:
46+
ruby-version: ${{ matrix.ruby }}
47+
bundler-cache: true
48+
49+
- name: Run the tests
50+
run: bin/rake test
51+
52+
- name: Upload coverage reports to Codecov
53+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
54+
if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always()
55+
with:
56+
token: ${{ secrets.CODECOV_TOKEN }}
57+
slug: sigstore/sigstore-ruby
58+
59+
sigstore-conformance:
60+
needs: ruby-versions
61+
runs-on: ${{ matrix.os }}
62+
name: Sigstore Ruby ${{ matrix.ruby }} / ${{ matrix.os }}
63+
strategy:
64+
fail-fast: false
65+
matrix:
66+
ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
67+
os: [ubuntu-latest]
68+
# os: [ ubuntu-latest, macos-latest, windows-latest ]
69+
# include:
70+
# - { os: windows-latest, ruby: ucrt }
71+
# - { os: windows-latest, ruby: mingw }
72+
# - { os: windows-latest, ruby: mswin }
73+
steps:
74+
- name: Harden Runner
75+
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
76+
with:
77+
egress-policy: audit
78+
79+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
80+
with:
81+
persist-credentials: false
82+
- name: Set up Ruby
83+
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
84+
with:
85+
ruby-version: ${{ matrix.ruby }}
86+
bundler-cache: true
87+
88+
- name: Run the conformance tests
89+
uses: sigstore/sigstore-conformance@d658ea74a060aeabae78f8a379167f219dc38c38 # v0.0.16
90+
with:
91+
entrypoint: ${{ github.workspace }}/bin/conformance-entrypoint
92+
xfail: "${{ matrix.ruby != 'head' && matrix.ruby != '3.4' && 'test_verify_rejects_bad_tsa_timestamp' }}"
93+
if: ${{ matrix.os }} == "ubuntu-latest"
94+
- name: Run the conformance tests against staging
95+
uses: sigstore/sigstore-conformance@d658ea74a060aeabae78f8a379167f219dc38c38 # v0.0.16
96+
with:
97+
entrypoint: ${{ github.workspace }}/bin/conformance-entrypoint
98+
xfail: "${{ matrix.ruby != 'head' && matrix.ruby != '3.4' && 'test_verify_rejects_bad_tsa_timestamp' }}"
99+
environment: staging
100+
if: ${{ matrix.os }} == "ubuntu-latest"
101+
- name: Upload coverage reports to Codecov
102+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
103+
if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always()
104+
with:
105+
token: ${{ secrets.CODECOV_TOKEN }}
106+
slug: sigstore/sigstore-ruby
107+
108+
tuf-conformance:
109+
needs: ruby-versions
110+
runs-on: ${{ matrix.os }}
111+
name: TUF Ruby ${{ matrix.ruby }} / ${{ matrix.os }}
112+
strategy:
113+
fail-fast: false
114+
matrix:
115+
ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
116+
os: [ubuntu-latest]
117+
# os: [ ubuntu-latest, macos-latest, windows-latest ]
118+
# include:
119+
# - { os: windows-latest, ruby: ucrt }
120+
# - { os: windows-latest, ruby: mingw }
121+
# - { os: windows-latest, ruby: mswin }
122+
steps:
123+
- name: Harden Runner
124+
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
125+
with:
126+
egress-policy: audit
127+
128+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
129+
with:
130+
persist-credentials: false
131+
- name: Set up Ruby
132+
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
133+
with:
134+
ruby-version: ${{ matrix.ruby }}
135+
bundler-cache: true
136+
137+
- name: Touch requirements.txt
138+
run: touch requirements.txt
139+
140+
- name: Write xfails
141+
run: bin/rake bin/tuf-conformance-entrypoint.xfails
142+
143+
- name: Run the TUF conformance tests
144+
uses: theupdateframework/tuf-conformance@9bfc222a371e30ad5511eb17449f68f855fb9d8f # v2.3.0
145+
with:
146+
entrypoint: ${{ github.workspace }}/bin/tuf-conformance-entrypoint
147+
artifact-name: "test repositories ${{ matrix.ruby }} ${{ matrix.os }}"
148+
if: |
149+
${{ matrix.os }} == "ubuntu-latest"
150+
151+
- name: Upload coverage reports to Codecov
152+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
153+
if: ${{ matrix.ruby }} == ${{ fromJson(needs.ruby-versions.outputs.latest) }} && ${{ matrix.os }} == "ubuntu-latest" && always()
154+
with:
155+
token: ${{ secrets.CODECOV_TOKEN }}
156+
slug: sigstore/sigstore-ruby
157+
158+
smoketest:
159+
needs: ruby-versions
160+
runs-on: ubuntu-latest
161+
name: Smoketest
162+
permissions:
163+
id-token: write
164+
strategy:
165+
fail-fast: false
166+
matrix:
167+
ruby: ${{ fromJson(needs.ruby-versions.outputs.versions) }}
168+
os: [ubuntu-latest]
169+
steps:
170+
- name: Harden Runner
171+
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
172+
with:
173+
egress-policy: audit
174+
175+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
176+
with:
177+
persist-credentials: false
178+
- name: Set up Ruby
179+
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
180+
with:
181+
ruby-version: ${{ fromJson(needs.ruby-versions.outputs.latest) }}
182+
bundler-cache: true
183+
- name: Build the gem
184+
run: bin/rake build
185+
- name: List built gems
186+
id: list-gems
187+
run: |
188+
echo "gems=$(find pkg -type f -name '*.gem' -print0 | xargs -0 jq --compact-output --null-input --args '[$ARGS.positional[]]')" >> $GITHUB_OUTPUT
189+
- name: Run the smoketest
190+
run: |
191+
./bin/smoketest ${BUILT_GEMS}
192+
env:
193+
BUILT_GEMS: ${{ join(fromJson(steps.list-gems.outputs.gems), ' ') }}
194+
WORKFLOW_NAME: ci
195+
196+
all-tests-pass:
197+
if: always()
198+
199+
needs:
200+
- test
201+
- sigstore-conformance
202+
- tuf-conformance
203+
204+
runs-on: ubuntu-latest
205+
206+
steps:
207+
- name: Harden Runner
208+
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
209+
with:
210+
egress-policy: audit
211+
212+
- name: check test jobs
213+
uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
214+
with:
215+
jobs: ${{ toJSON(needs) }}
216+
217+
lint:
218+
needs: ruby-versions
219+
runs-on: ubuntu-latest
220+
name: Lint
221+
steps:
222+
- name: Harden Runner
223+
uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49 # v2.12.2
224+
with:
225+
egress-policy: audit
226+
227+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
228+
with:
229+
persist-credentials: false
230+
- name: Set up Ruby
231+
uses: ruby/setup-ruby@a4effe49ee8ee5b8b5091268c473a4628afb5651 # v1.245.0
232+
with:
233+
ruby-version: ${{ fromJson(needs.ruby-versions.outputs.latest) }}
234+
bundler-cache: true
235+
- name: Run the linter
236+
run: bin/rubocop
237+
238+
zizmor:
239+
name: zizmor
240+
runs-on: ubuntu-latest
241+
permissions:
242+
security-events: write
243+
# required for workflows in private repositories
244+
contents: read
245+
actions: read
246+
steps:
247+
- name: Checkout repository
248+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
249+
with:
250+
persist-credentials: false
251+
252+
- name: Install the latest version of uv
253+
uses: astral-sh/setup-uv@180f8b44399608a850e1db031fa65c77746566d3 # v5.0.1
254+
255+
- name: Run zizmor 🌈
256+
run: uvx zizmor --format sarif . > results.sarif
257+
258+
env:
259+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
260+
261+
- name: Upload SARIF file
262+
uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
263+
with:
264+
sarif_file: results.sarif
265+
category: zizmor

0 commit comments

Comments
 (0)