From c920028bd0ba022a4a72710fb591b41382d0bf8e Mon Sep 17 00:00:00 2001 From: Ramon Petgrave Date: Wed, 24 Jul 2024 21:22:41 +0000 Subject: [PATCH 1/4] explitly add maven-plugin-plugin to slsa-hashing-plugin Signed-off-by: Ramon Petgrave --- actions/maven/publish/slsa-hashing-plugin/pom.xml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/actions/maven/publish/slsa-hashing-plugin/pom.xml b/actions/maven/publish/slsa-hashing-plugin/pom.xml index bcb90123e2..bf0a12535e 100644 --- a/actions/maven/publish/slsa-hashing-plugin/pom.xml +++ b/actions/maven/publish/slsa-hashing-plugin/pom.xml @@ -16,6 +16,16 @@ 1.8 + + + + org.apache.maven.plugins + maven-plugin-plugin + 3.13.1 + + + + org.apache.maven From 18beeb3df99567e2e26842bf1332c42a6156b8c9 Mon Sep 17 00:00:00 2001 From: Ramon Petgrave Date: Wed, 24 Jul 2024 21:29:45 +0000 Subject: [PATCH 2/4] add maven e2e Signed-off-by: Ramon Petgrave --- .github/workflows/pre-submit.e2e.maven.yml | 57 ++++++ e2e/README.md | 3 + e2e/maven/workflow_dispatch/pom.xml | 163 ++++++++++++++++++ .../src/main/java/hello/Greeter.java | 7 + .../src/main/java/hello/HelloWorld.java | 8 + 5 files changed, 238 insertions(+) create mode 100644 .github/workflows/pre-submit.e2e.maven.yml create mode 100644 e2e/README.md create mode 100644 e2e/maven/workflow_dispatch/pom.xml create mode 100644 e2e/maven/workflow_dispatch/src/main/java/hello/Greeter.java create mode 100644 e2e/maven/workflow_dispatch/src/main/java/hello/HelloWorld.java diff --git a/.github/workflows/pre-submit.e2e.maven.yml b/.github/workflows/pre-submit.e2e.maven.yml new file mode 100644 index 0000000000..92e23ccc48 --- /dev/null +++ b/.github/workflows/pre-submit.e2e.maven.yml @@ -0,0 +1,57 @@ +# Copyright 2023 SLSA Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: pre-submit e2e maven + +on: + # builder_maven_slsa3.yml relies on .github/actions/verify-token, which does not support merge_group and pull_request events. + push: + workflow_dispatch: + +permissions: read-all + +env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + +jobs: + build: + permissions: + id-token: write # For signing. + contents: read # For repo checkout of private repos. + actions: read # For getting workflow run on private repos. + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_maven_slsa3.yml@main + with: + directory: ./e2e/maven/workflow_dispatch + + verify: + runs-on: ubuntu-latest + needs: [build] + steps: + - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 + - uses: slsa-framework/slsa-github-generator/actions/maven/secure-download-attestations@main + with: + name: "${{ needs.build.outputs.provenance-download-name }}" + sha256: "${{ needs.build.outputs.provenance-download-sha256 }}" + path: ./ + - uses: slsa-framework/slsa-github-generator/actions/maven/secure-download-target@main + with: + name: "${{ needs.build.outputs.target-download-name }}" + sha256: "${{ needs.build.outputs.target-download-sha256 }}" + path: ./ + - uses: slsa-framework/slsa-verifier/actions/installer@v2.6.0 + - name: Verify artifact + env: + PROVENANCE_PATH: ${{ needs.build.outputs.provenance-download-name }} + TARGET_PATH: ${{ needs.build.outputs.target-download-name }} + run: slsa-verifier verify-artifact "$TARGET_PATH" --provenance-path "$PROVENANCE_PATH" diff --git a/e2e/README.md b/e2e/README.md new file mode 100644 index 0000000000..09531bd576 --- /dev/null +++ b/e2e/README.md @@ -0,0 +1,3 @@ +# E2E Tests + +This folder contains test data for some end-to-end (E2E) tests. \ No newline at end of file diff --git a/e2e/maven/workflow_dispatch/pom.xml b/e2e/maven/workflow_dispatch/pom.xml new file mode 100644 index 0000000000..ce94d1dc40 --- /dev/null +++ b/e2e/maven/workflow_dispatch/pom.xml @@ -0,0 +1,163 @@ + + + 4.0.0 + io.github.adamkorcz + test-java-project + 1.21.96 + jar + Adams test java project + A test java project. + https://github.com/AdamKorcz/test-java-project + + 1.8 + 1.8 + + + + ossrh + https://s01.oss.sonatype.org/content/repositories/snapshots + + + ossrh + https://s01.oss.sonatype.org/service/local/staging/deploy/maven2/ + + + + + MIT License + http://www.opensource.org/licenses/mit-license.php + + + + + Adam K + Adam@adalogics.com + Ada Logics + http://www.adalogics.com + + + + scm:git:git://github.com/adamkorcz/test-java-project.git + scm:git:ssh://github.com:simpligility/test-java-project.git + http://github.com/adamkorcz/test-java-project/tree/main + + + + + org.apache.maven.plugins + maven-source-plugin + 3.3.1 + + + attach-sources + package + + jar-no-fork + + + + + + org.apache.maven.plugins + maven-javadoc-plugin + 3.6.3 + + ${java.home}/bin/javadoc + + + + attach-javadocs + + jar + + + + + + org.apache.maven.plugins + maven-shade-plugin + 3.5.1 + + + package + + shade + + + + + hello.HelloWorld + + + + + + + + org.sonatype.plugins + nexus-staging-maven-plugin + 1.6.13 + true + + ossrh + https://s01.oss.sonatype.org/ + false + + + + org.apache.maven.plugins + maven-gpg-plugin + 3.1.0 + + + sign-artifacts + verify + + sign + + + + + + --pinentry-mode + loopback + + + + + org.apache.maven.plugins + maven-deploy-plugin + 3.1.2 + + + deploy-file + deploy + + deploy-file + + + textfile.txt + https://s01.oss.sonatype.org/ + io.github.adamkorcz + + + + + + io.github.slsa-framework.slsa-github-generator + hash-maven-plugin + 0.0.1 + + + + hash-jarfile + + + + + ${SLSA_OUTPUTS_ARTIFACTS_FILE} + + + + + diff --git a/e2e/maven/workflow_dispatch/src/main/java/hello/Greeter.java b/e2e/maven/workflow_dispatch/src/main/java/hello/Greeter.java new file mode 100644 index 0000000000..f92a442354 --- /dev/null +++ b/e2e/maven/workflow_dispatch/src/main/java/hello/Greeter.java @@ -0,0 +1,7 @@ +package hello; + +public class Greeter { + public String sayHello() { + return "Hello world!"; + } +} diff --git a/e2e/maven/workflow_dispatch/src/main/java/hello/HelloWorld.java b/e2e/maven/workflow_dispatch/src/main/java/hello/HelloWorld.java new file mode 100644 index 0000000000..1626b45cbd --- /dev/null +++ b/e2e/maven/workflow_dispatch/src/main/java/hello/HelloWorld.java @@ -0,0 +1,8 @@ +package hello; + +public class HelloWorld { + public static void main(String[] args) { + Greeter greeter = new Greeter(); + System.out.println(greeter.sayHello()); + } +} From 7af2de29b31b9b0f5bf730a8138a419dcae06887 Mon Sep 17 00:00:00 2001 From: Ramon Petgrave Date: Wed, 24 Jul 2024 21:36:48 +0000 Subject: [PATCH 3/4] lint Signed-off-by: Ramon Petgrave --- e2e/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/e2e/README.md b/e2e/README.md index 09531bd576..99f7cbb53a 100644 --- a/e2e/README.md +++ b/e2e/README.md @@ -1,3 +1,3 @@ # E2E Tests -This folder contains test data for some end-to-end (E2E) tests. \ No newline at end of file +This folder contains test data for some end-to-end (E2E) tests. From a804574c6edcbbbb2fc5782c9a71d532f64ac147 Mon Sep 17 00:00:00 2001 From: Ramon Petgrave Date: Wed, 24 Jul 2024 21:37:01 +0000 Subject: [PATCH 4/4] explicit maven-plugin-plugin in e2e Signed-off-by: Ramon Petgrave --- e2e/maven/workflow_dispatch/pom.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/e2e/maven/workflow_dispatch/pom.xml b/e2e/maven/workflow_dispatch/pom.xml index ce94d1dc40..fe51de5d89 100644 --- a/e2e/maven/workflow_dispatch/pom.xml +++ b/e2e/maven/workflow_dispatch/pom.xml @@ -43,6 +43,11 @@ + + org.apache.maven.plugins + maven-plugin-plugin + 3.13.1 + org.apache.maven.plugins maven-source-plugin