pcs-core/.github/workflows/distribution.yml at main · SentinelOps-CI/pcs-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: Distribution

# Clean-environment validator / verifier wheel + OCI acceptance (PR 11 / A12).
on:
  push:
    branches: [main, master]
  pull_request:
  workflow_dispatch:

jobs:
  validator-wheel:
    name: Validator-wheel clean install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - name: Validator wheel clean install
        run: bash scripts/test-validator-wheel.sh

  verifier-wheel:
    name: Verifier-wheel clean install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: "3.12"
      - name: Install elan (checksum verified)
        run: bash scripts/install-elan-verified.sh
      - name: Verifier wheel clean install
        run: |
          export PATH="$HOME/.elan/bin:$PATH"
          bash scripts/test-verifier-wheel.sh

  verifier-oci-scaffold:
    name: Verifier OCI Dockerfile pin
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Assert Dockerfile base pin + non-root user
        run: |
          python3 - <<'PY'
          from pathlib import Path
          import json
          import re

          pin = json.loads(Path("pins/python-base-image.json").read_text(encoding="utf-8"))
          df = Path("docker/verifier/Dockerfile").read_text(encoding="utf-8")
          digest = pin["index_digest"]
          assert digest.startswith("sha256:")
          assert digest in df, "Dockerfile must pin PYTHON_IMAGE by index digest"
          assert "USER pcs" in df
          assert "uid 10001" in df or "--uid 10001" in df
          assert "org.opencontainers.image.base.digest" in df
          # Forbid floating tag-only FROM without digest
          for line in df.splitlines():
              if re.match(r"^FROM\s+", line.strip()) and "@sha256:" not in line and "PYTHON_IMAGE" not in line:
                  raise SystemExit(f"unpinned FROM: {line}")
          print("OK verifier OCI Dockerfile pin + non-root")
          PY

  verifier-oci:
    name: Verifier OCI clean execution
    runs-on: ubuntu-latest
    timeout-minutes: 120
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Verifier OCI build + clean run
        run: bash scripts/test-verifier-oci.sh

  distribution-gate:
    name: Distribution matrix gate
    runs-on: ubuntu-latest
    needs:
      - validator-wheel
      - verifier-wheel
      - verifier-oci-scaffold
      - verifier-oci
    steps:
      - name: All distribution jobs passed
        run: echo "OK distribution matrix gate"