anyq/.github/workflows/compliance.yml at 657f41c2cbe06039c0d82cf81c17759d1149eda2 · sns45/anyq · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Compliance

on:
  push:
    branches: [main]
    tags: ["v*"]
  workflow_call:
  workflow_dispatch:

permissions:
  contents: write
  id-token: write
  attestations: write

jobs:
  ci:
    uses: ./.github/workflows/ci.yml

  compliance:
    needs: ci
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: latest

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Build
        run: bun run build

      - name: Forgeseal Pipeline
        uses: sns45/forgeseal@v0.3.0
        id: forgeseal
        with:
          command: pipeline
          dir: .
          output-dir: ./forgeseal-output
          sign: "true"
          attest: "true"
          vex-triage: "true"
          fail-on: critical
          include-dev: "false"
          upload-assets: ${{ startsWith(github.ref, 'refs/tags/') }}

      - name: Upload compliance artifacts
        uses: actions/upload-artifact@v4
        with:
          name: compliance-bundle
          path: ./forgeseal-output/
          retention-days: 90

      - name: Compliance Summary
        run: |
          echo "## EU CRA Compliance Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Artifact | Path |" >> $GITHUB_STEP_SUMMARY
          echo "|----------|------|" >> $GITHUB_STEP_SUMMARY
          echo "| SBOM | \`${{ steps.forgeseal.outputs.sbom-path }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Signature | \`${{ steps.forgeseal.outputs.bundle-path }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| Attestation | \`${{ steps.forgeseal.outputs.attestation-path }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "| VEX | \`${{ steps.forgeseal.outputs.vex-path }}\` |" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "**Vulnerabilities found:** ${{ steps.forgeseal.outputs.vuln-count }}" >> $GITHUB_STEP_SUMMARY