TUF expiration check: tuf.fleetctl.com #569
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Checks signatures that are about to expire on https://tuf.fleetctl.com. | |
| name: "TUF expiration check: tuf.fleetctl.com" | |
| on: | |
| pull_request: | |
| paths: | |
| - ".github/workflows/check-tuf-timestamps.yml" | |
| workflow_dispatch: # Manual | |
| schedule: | |
| - cron: "0 10,22 * * *" # every day at 10 AM and 10 PM | |
| # This allows a subsequently queued workflow run to interrupt previous runs | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference | |
| shell: bash | |
| permissions: | |
| contents: read | |
| jobs: | |
| test-go: | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | |
| with: | |
| egress-policy: audit | |
| - name: Check remote timestamp.json file | |
| id: check_timestamp | |
| run: | | |
| expires=$(curl -s https://tuf.fleetctl.com/timestamp.json | jq -r '.signed.expires' | cut -c 1-10) | |
| today=$(date "+%Y-%m-%d") | |
| warning_at=$(date -d "$today + 4 day" "+%Y-%m-%d") | |
| expires_sec=$(date -d "$expires" "+%s") | |
| warning_at_sec=$(date -d "$warning_at" "+%s") | |
| if [ "$expires_sec" -le "$warning_at_sec" ]; then | |
| echo "timestamp_warn=true" >> ${GITHUB_OUTPUT} | |
| else | |
| echo "timestamp_warn=false" >> ${GITHUB_OUTPUT} | |
| fi | |
| - name: Check remote snapshot.json file | |
| id: check_snapshot | |
| run: | | |
| expires=$(curl -s https://tuf.fleetctl.com/snapshot.json | jq -r '.signed.expires' | cut -c 1-10) | |
| today=$(date "+%Y-%m-%d") | |
| warning_at=$(date -d "$today + 30 day" "+%Y-%m-%d") | |
| expires_sec=$(date -d "$expires" "+%s") | |
| warning_at_sec=$(date -d "$warning_at" "+%s") | |
| if [ "$expires_sec" -le "$warning_at_sec" ]; then | |
| echo "snapshot_warn=true" >> ${GITHUB_OUTPUT} | |
| else | |
| echo "snapshot_warn=false" >> ${GITHUB_OUTPUT} | |
| fi | |
| - name: Check remote targets.json file | |
| id: check_targets | |
| run: | | |
| expires=$(curl -s https://tuf.fleetctl.com/targets.json | jq -r '.signed.expires' | cut -c 1-10) | |
| today=$(date "+%Y-%m-%d") | |
| warning_at=$(date -d "$today + 30 day" "+%Y-%m-%d") | |
| expires_sec=$(date -d "$expires" "+%s") | |
| warning_at_sec=$(date -d "$warning_at" "+%s") | |
| if [ "$expires_sec" -le "$warning_at_sec" ]; then | |
| echo "targets_warn=true" >> ${GITHUB_OUTPUT} | |
| else | |
| echo "targets_warn=false" >> ${GITHUB_OUTPUT} | |
| fi | |
| - name: Check remote root.json file | |
| id: check_root | |
| run: | | |
| expires=$(curl -s https://tuf.fleetctl.com/root.json | jq -r '.signed.expires' | cut -c 1-10) | |
| today=$(date "+%Y-%m-%d") | |
| warning_at=$(date -d "$today + 30 day" "+%Y-%m-%d") | |
| expires_sec=$(date -d "$expires" "+%s") | |
| warning_at_sec=$(date -d "$warning_at" "+%s") | |
| if [ "$expires_sec" -le "$warning_at_sec" ]; then | |
| echo "root_warn=true" >> ${GITHUB_OUTPUT} | |
| else | |
| echo "root_warn=false" >> ${GITHUB_OUTPUT} | |
| fi | |
| - name: Slack timestamp notification | |
| if: ${{ steps.check_timestamp.outputs.timestamp_warn == 'true' }} | |
| uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 | |
| with: | |
| payload: | | |
| { | |
| "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "⚠️ https://tuf.fleetctl.com/timestamp.json is about to expire or has already expired\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| - name: Slack snapshot notification | |
| if: ${{ steps.check_snapshot.outputs.snapshot_warn == 'true' }} | |
| uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 | |
| with: | |
| payload: | | |
| { | |
| "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "⚠️ https://tuf.fleetctl.com/snapshot.json is about to expire or has already expired\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| - name: Slack targets notification | |
| if: ${{ steps.check_targets.outputs.targets_warn == 'true' }} | |
| uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 | |
| with: | |
| payload: | | |
| { | |
| "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "⚠️ https://tuf.fleetctl.com/targets.json is about to expire or has already expired\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | |
| - name: Slack root notification | |
| if: ${{ steps.check_root.outputs.root_warn == 'true' }} | |
| uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0 | |
| with: | |
| payload: | | |
| { | |
| "text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}", | |
| "blocks": [ | |
| { | |
| "type": "section", | |
| "text": { | |
| "type": "mrkdwn", | |
| "text": "⚠️ https://tuf.fleetctl.com/root.json is about to expire or has already expired\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}" | |
| } | |
| } | |
| ] | |
| } | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }} | |
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK |