Skip to content

Commit a032d9d

Browse files
ErikElkinsErikElkins
authored
Merge branch 'main' into feat/enterprise-ip-allow-list
2 parents aed945b + 68741e0 commit a032d9d

515 files changed

Lines changed: 14441 additions & 25707 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/ci.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ jobs:
2727
shell: bash
2828
steps:
2929
- name: Checkout
30-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3131
- name: Set-up Go
32-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
32+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
3333
with:
3434
go-version-file: go.mod
3535
cache: true

‎.github/workflows/codeql.yaml‎

Lines changed: 4 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -39,17 +39,17 @@ jobs:
3939
shell: bash
4040
steps:
4141
- name: Checkout
42-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
42+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4343

4444
- name: Set-up Go
45-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
45+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
4646
if: matrix.language == 'go'
4747
with:
4848
go-version-file: go.mod
4949
cache: true
5050

5151
- name: Initialize CodeQL
52-
uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
52+
uses: github/codeql-action/init@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
5353
with:
5454
languages: ${{ matrix.language }}
5555
build-mode: ${{ matrix.build-mode }}
@@ -60,29 +60,6 @@ jobs:
6060
run: go build ./...
6161

6262
- name: Perform CodeQL Analysis
63-
uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
63+
uses: github/codeql-action/analyze@6bc82e05fd0ea64601dd4b465378bbcf57de0314 # v4.32.1
6464
with:
6565
category: "/language:${{matrix.language}}"
66-
67-
check:
68-
name: Check CodeQL Analysis
69-
if: always() && github.event_name == 'pull_request'
70-
needs:
71-
- analyze
72-
runs-on: ubuntu-latest
73-
defaults:
74-
run:
75-
shell: bash
76-
steps:
77-
- name: Check
78-
env:
79-
INPUT_RESULTS: ${{ join(needs.*.result, ' ') }}
80-
run: |
81-
set -euo pipefail
82-
read -a results <<< "${INPUT_RESULTS}"
83-
for result in "${results[@]}"; do
84-
if [[ "${result}" == "failure" ]] || [[ "${result}" == "cancelled" ]]; then
85-
echo "::error::Workflow failed!"
86-
exit 1
87-
fi
88-
done

‎.github/workflows/dotcom-acceptance-tests.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
shell: bash
4242
steps:
4343
- name: Checkout
44-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
44+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4545

4646
- name: Check secrets
4747
if: github.event_name == 'pull_request_target'
@@ -73,7 +73,7 @@ jobs:
7373
echo "token=${GH_TEST_TOKEN}" >> "${GITHUB_OUTPUT}"
7474
7575
- name: Set-up Go
76-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
76+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
7777
with:
7878
go-version-file: go.mod
7979
cache: true

‎.github/workflows/ghes-acceptance-tests.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
shell: bash
3232
steps:
3333
- name: Checkout
34-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
34+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3535

3636
- name: Check secrets
3737
if: github.event_name == 'pull_request_target'
@@ -85,7 +85,7 @@ jobs:
8585
echo "token=${TEST_USER_TOKEN}" >> "${GITHUB_OUTPUT}"
8686
8787
- name: Set-up Go
88-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
88+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
8989
with:
9090
go-version-file: go.mod
9191
cache: true

‎.github/workflows/release.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,19 +29,19 @@ jobs:
2929
run:
3030
shell: bash
3131
steps:
32-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
32+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3333
with:
3434
# Allow goreleaser to access older tag information.
3535
fetch-depth: 0
3636

3737
- name: Set-up Go
38-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
38+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
3939
with:
4040
go-version-file: go.mod
4141
cache: true
4242

4343
- name: Install Syft
44-
uses: anchore/sbom-action/download-syft@0b82b0b1a22399a1c542d4d656f70cd903571b5c # v0.21.1
44+
uses: anchore/sbom-action/download-syft@deef08a0db64bfad603422135db61477b16cef56 # v0.22.1
4545

4646
- name: Install Cosign
4747
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
@@ -64,6 +64,6 @@ jobs:
6464
args: release --clean
6565

6666
- name: Attest artifacts
67-
uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
67+
uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
6868
with:
6969
subject-checksums: ./dist/${{ github.event.repository.name }}_${{ fromJSON(steps.goreleaser.outputs.metadata).version }}_SHA256SUMS

‎.golangci.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@ linters:
1919
- misspell
2020
- modernize
2121
- nilerr
22+
- nilnesserr # https://golangci-lint.run/docs/linters/configuration/#nilnesserr
2223
- predeclared
2324
- staticcheck
2425
- unconvert

‎VERIFY_ATTESTATIONS.md‎

Lines changed: 211 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
# Using Artifact Attestations to Achieve SLSA v1 Build Level 3
2+
3+
This project started to use GitHub Action to create attestations for the release artifacts. Building software with artifact attestation streamlines supply chain security and helps us achieve [SLSA](https://slsa.dev/) v1.0 Build Level 3 for this project.
4+
5+
> [!NOTE]
6+
> Not all artifacts may have attestations generated for them. Please check the [repository attestations](https://github.com/integrations/terraform-provider-github/attestations) to see which artifacts have attestations available.
7+
>
8+
> Attestations are only available for releases from `v6.9.0`.
9+
10+
## Verifying with GitHub CLI
11+
12+
### Prerequisites
13+
14+
First, install GitHub CLI if you haven't already. See the [installation instructions](https://github.com/cli/cli#installation) for your platform.
15+
16+
### Verifying Attestations
17+
18+
To verify artifact attestations generated during the build process, use the `gh attestation verify` command from the GitHub CLI.
19+
20+
The `gh attestation verify` command requires either `--owner` or `--repo` flags to be used with it.
21+
22+
> [!NOTE]
23+
> Make sure to replace x.y.z with the actual release tag you want to verify.
24+
> Replace artifact name with the actual artifact you want to verify.
25+
26+
Download the release artifacts first:
27+
28+
```bash
29+
version="x.y.z"
30+
artifact="terraform-provider-github_${version}_darwin_amd64.zip"
31+
32+
gh release download "v${version}" --repo integrations/terraform-provider-github -p "*.zip" --clobber
33+
```
34+
35+
To verify the artifact attestations for this project, you can run the following command:
36+
37+
```bash
38+
gh attestation verify --repo integrations/terraform-provider-github --source-ref "refs/tags/v${version}"\
39+
--signer-workflow integrations/terraform-provider-github/.github/workflows/release.yaml@refs/tags/v${version} \
40+
"$artifact"
41+
```
42+
43+
### Verifying All Artifacts
44+
45+
Alternatively, you can verify all downloaded artifacts with a loop that provides individual status reporting:
46+
47+
```bash
48+
for artifact in terraform-provider-github_${version}_*.zip; do
49+
echo "Verifying: $artifact"
50+
gh attestation verify --repo integrations/terraform-provider-github --source-ref "refs/tags/v${version}" \
51+
--signer-workflow integrations/terraform-provider-github/.github/workflows/release.yaml@refs/tags/v${version} \
52+
"$artifact" && echo "✓ Verified" || echo "✗ Failed"
53+
done
54+
```
55+
56+
### Using Optional Flags
57+
58+
The `gh attestation verify` command supports additional flags for more specific verification:
59+
60+
Use the `--signer-repo` flag to specify the repository:
61+
62+
```bash
63+
gh attestation verify --owner integrations --signer-repo \
64+
integrations/terraform-provider-github \
65+
"$artifact"
66+
```
67+
68+
If you would like to require an artifact attestation to be signed with a specific workflow, use the `--signer-workflow` flag to indicate the workflow file that should be used.
69+
70+
```bash
71+
gh attestation verify --owner integrations --signer-workflow \
72+
integrations/terraform-provider-github/.github/workflows/release.yaml@refs/tags/v${version} \
73+
"$artifact"
74+
```
75+
76+
## Verifying with Cosign
77+
78+
> [!NOTE]
79+
> Not all artifacts may have attestations generated for them. Please check the [repository attestations](https://github.com/integrations/terraform-provider-github/attestations) to see which artifacts have attestations available.
80+
>
81+
> Attestations are only available for releases from `v6.9.0`.
82+
83+
In addition to artifact attestations, you can verify release artifacts using [Cosign](https://docs.sigstore.dev/cosign/overview/). Cosign is a tool for signing and verifying software artifacts and container images.
84+
85+
### Prerequisites
86+
87+
First, install Cosign if you haven't already. See the [installation instructions](https://docs.sigstore.dev/cosign/system_config/installation/) for your platform.
88+
89+
### Verify Checksums File
90+
91+
Download the checksums file and its signature bundle:
92+
93+
```bash
94+
gh release download v${version} --repo integrations/terraform-provider-github \
95+
-p "terraform-provider-github_${version}_SHA256SUMS" \
96+
-p "terraform-provider-github_${version}_SHA256SUMS.sbom.json.bundle" --clobber
97+
```
98+
99+
Verify the checksums file signature:
100+
101+
```bash
102+
cosign verify-blob \
103+
--bundle "terraform-provider-github_${version}_SHA256SUMS.sbom.json.bundle" \
104+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
105+
--certificate-identity "https://github.com/integrations/terraform-provider-github/.github/workflows/release.yaml@refs/tags/v${version}" \
106+
"terraform-provider-github_${version}_SHA256SUMS"
107+
```
108+
109+
### Verify Artifact Checksums
110+
111+
After verifying the checksums file, verify your downloaded artifacts match the checksums:
112+
113+
Download the artifact you want to verify:
114+
115+
```bash
116+
artifact="terraform-provider-github_${version}_darwin_amd64.zip"
117+
gh release download v${version} --repo integrations/terraform-provider-github \
118+
-p "$artifact" --clobber
119+
```
120+
121+
Verify the checksum:
122+
123+
```bash
124+
shasum -a 256 -c terraform-provider-github_${version}_SHA256SUMS --ignore-missing
125+
```
126+
127+
This will verify that your downloaded artifact matches the signed checksum, confirming its integrity and authenticity.
128+
129+
## Verifying SLSA Provenance Attestations with Cosign
130+
131+
In addition to using the GitHub CLI, you can verify SLSA provenance attestations using Cosign by downloading the attestation and verifying it against your local artifact.
132+
133+
### Prerequisites
134+
135+
1. Install `cosign` for verifying attestations. See the [installation instructions](https://docs.sigstore.dev/cosign/system_config/installation/).
136+
2. Install `gh` (GitHub CLI) if you haven't already. See the [installation instructions](https://github.com/cli/cli#installation).
137+
138+
### Download and Verify Attestation
139+
140+
> [!NOTE]
141+
> Make sure to replace x.y.z with the actual release tag you want to verify.
142+
> Replace artifact name with the actual artifact you want to verify.
143+
144+
> [!NOTE]
145+
> Not all artifacts may have attestations generated for them. Please check the [repository attestations](https://github.com/integrations/terraform-provider-github/attestations) to see which artifacts have attestations available.
146+
>
147+
> Attestations are only available for releases from `v6.9.0`.
148+
149+
First, download the artifact you want to verify:
150+
151+
```bash
152+
version="x.y.z"
153+
artifact="terraform-provider-github_${version}_darwin_amd64.zip"
154+
155+
gh release download "v${version}" --repo integrations/terraform-provider-github \
156+
-p "$artifact" --clobber
157+
```
158+
159+
Then, download the attestation associated with the artifact:
160+
161+
```bash
162+
gh attestation download "$artifact" \
163+
--repo integrations/terraform-provider-github
164+
```
165+
166+
This will create a file named `sha256:[digest].jsonl` in the current directory.
167+
168+
Verify the attestation using Cosign:
169+
170+
```bash
171+
# Calculate the digest and verify using the specific bundle file
172+
digest=$(shasum -a 256 "$artifact" | awk '{ print $1 }')
173+
cosign verify-blob-attestation \
174+
--bundle "sha256:${digest}.jsonl" \
175+
--new-bundle-format \
176+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
177+
--certificate-identity "https://github.com/integrations/terraform-provider-github/.github/workflows/release.yaml@refs/tags/v${version}" \
178+
"$artifact"
179+
```
180+
181+
A successful verification will output `Verified OK`, confirming that the artifact was built by the trusted GitHub Actions workflow and its provenance is securely recorded.
182+
183+
### Verifying All Release Artifacts
184+
185+
To verify all release artifacts for a specific version:
186+
187+
```bash
188+
version="x.y.z"
189+
190+
# Download all release artifacts
191+
gh release download "v${version}" --repo integrations/terraform-provider-github -p "*.zip" --clobber
192+
193+
# Download attestations for all artifacts
194+
for artifact in terraform-provider-github_${version}_*.zip; do
195+
gh attestation download "$artifact" --repo integrations/terraform-provider-github
196+
done
197+
198+
# Verify all artifacts using specific digest-based bundle files
199+
for artifact in terraform-provider-github_${version}_*.zip; do
200+
echo "Verifying: $artifact"
201+
digest=$(shasum -a 256 "$artifact" | awk '{ print $1 }')
202+
cosign verify-blob-attestation \
203+
--bundle "sha256:${digest}.jsonl" \
204+
--new-bundle-format \
205+
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
206+
--certificate-identity "https://github.com/integrations/terraform-provider-github/.github/workflows/release.yaml@refs/tags/v${version}" \
207+
"$artifact" > /dev/null && echo "✓ Verified" || echo "✗ Failed"
208+
done
209+
```
210+
211+
This approach calculates the digest for each artifact and uses the corresponding specific bundle file, ensuring each artifact is verified against its own attestation.

‎github/acc_test.go‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010
"strings"
1111
"testing"
1212

13-
"github.com/google/go-github/v81/github"
13+
"github.com/google/go-github/v82/github"
1414
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
1515
"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
1616
)
@@ -49,6 +49,9 @@ type testAccConfig struct {
4949
testPublicRepository string
5050
testPublicRepositoryOwner string
5151
testPublicReleaseId int
52+
testPublicRelaseAssetId string
53+
testPublicRelaseAssetName string
54+
testPublicReleaseAssetContent string
5255
testPublicTemplateRepository string
5356
testPublicTemplateRepositoryOwner string
5457
testGHActionsAppInstallationId int
@@ -105,11 +108,16 @@ func TestMain(m *testing.M) {
105108
}
106109

107110
config := testAccConfig{
108-
baseURL: baseURL,
109-
authMode: authMode,
110-
testPublicRepository: "terraform-provider-github",
111-
testPublicRepositoryOwner: "integrations",
112-
testPublicReleaseId: 186531906,
111+
baseURL: baseURL,
112+
authMode: authMode,
113+
testPublicRepository: "terraform-provider-github",
114+
testPublicRepositoryOwner: "integrations",
115+
testPublicReleaseId: 186531906,
116+
// The terraform-provider-github_6.4.0_manifest.json asset ID from
117+
// https://github.com/integrations/terraform-provider-github/releases/tag/v6.4.0
118+
testPublicRelaseAssetId: "207956097",
119+
testPublicRelaseAssetName: "terraform-provider-github_6.4.0_manifest.json",
120+
testPublicReleaseAssetContent: "{\n \"version\": 1,\n \"metadata\": {\n \"protocol_versions\": [\n \"5.0\"\n ]\n }\n}",
113121
testPublicTemplateRepository: "template-repository",
114122
testPublicTemplateRepositoryOwner: "template-repository",
115123
testGHActionsAppInstallationId: 15368,

0 commit comments

Comments
 (0)