binary_provenance.yml

name: Binary Provenance
on:
    workflow_call:
        inputs:
          artifacts:
            required: true
            type: string
          dir:
            required: true
            type: string
          kosli_org:
            required: true
            type: string
          flow_name:
            required: true
            type: string
          trail_name:
            required: true
            type: string
        secrets:        
            kosli_api_token:
                required: true


jobs:
    binary-provenance:
        runs-on: ubuntu-latest
        permissions:
            id-token: write
            contents: write
            pull-requests: read
            attestations: write
        strategy:
            matrix:
                artifact: ${{fromJson(inputs.artifacts)}}
        steps:
        - uses: actions/checkout@v4

        - uses: actions/download-artifact@v4
          with:
            name: ${{inputs.dir}}
            path: ${{ github.workspace }}/${{inputs.dir}}

        - name: setup-kosli-cli
          uses: kosli-dev/setup-cli-action@v2
          with:
            version:
                ${{ vars.KOSLI_CLI_VERSION }}

        - name: Make the artifact fingerprint available for following steps
          run: |
            ARTIFACT_SHA=$(kosli fingerprint ${{matrix.artifact.path}} --artifact-type file)
            echo "FINGERPRINT=$ARTIFACT_SHA" >> ${GITHUB_ENV}

        - name: Attest Build Provenance
          id: artifact-gh-attest
          uses: actions/attest-build-provenance@v1
          with:
            subject-name: ${{matrix.artifact.template_name}}
            subject-digest: sha256:${{ env.FINGERPRINT }}

        - name: Make artifact GH sigstore attestation index available to next steps
          run: |
            TRANSPARENCY_LOG_INDEX=$(jq '.verificationMaterial.tlogEntries[0].logIndex' ${{ steps.artifact-gh-attest.outputs.bundle-path }})
            echo "ARTIFACT_TLOG_INDEX=$TRANSPARENCY_LOG_INDEX" >> ${GITHUB_ENV}
        
        - name: Generate SBOM for the binary
          uses: anchore/sbom-action@v0
          with:
            file: ${{matrix.artifact.path}}
            format: 'spdx-json'
            output-file: '${{matrix.artifact.template_name}}-sbom.spdx.json'
            upload-artifact: false
            upload-release-assets: false
        
        - name: Publish SBOM
          uses: anchore/sbom-action/publish-sbom@v0
          with:
            sbom-artifact-match: ".*\\.spdx.json$"
        
        - name: Attest SBOM to Github
          id: sbom-gh-attest
          uses: actions/attest-sbom@v1
          with:
            sbom-path: '${{matrix.artifact.template_name}}-sbom.spdx.json'
            subject-name: ${{matrix.artifact.template_name}}
            subject-digest: sha256:${{ env.FINGERPRINT }}

        - name: Make sbom GH sigstore attestation index available to next steps
          run: |
            TRANSPARENCY_LOG_INDEX=$(jq '.verificationMaterial.tlogEntries[0].logIndex' ${{ steps.sbom-gh-attest.outputs.bundle-path }})
            echo "SBOM_TLOG_INDEX=$TRANSPARENCY_LOG_INDEX" >> ${GITHUB_ENV}

        - name: Report artifact to Kosli
          env:
            KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
          run: 
            kosli attest artifact
                ${{matrix.artifact.path}}
                --flow ${{ inputs.flow_name }}
                --trail ${{ inputs.trail_name }} 
                --name ${{matrix.artifact.template_name}}
                --fingerprint ${{ env.FINGERPRINT }}
                --external-url sigstore=https://search.sigstore.dev/?hash=${{ env.FINGERPRINT }}
                --org ${{ inputs.kosli_org }}

        - name: Report SBOM to Kosli
          env:
            KOSLI_API_TOKEN: ${{ secrets.kosli_api_token }}
          run: 
            kosli attest generic
              --flow ${{ inputs.flow_name }}
              --trail ${{ inputs.trail_name }} 
              --name sbom
              --fingerprint ${{ env.FINGERPRINT }}
              --attachments  ${{matrix.artifact.template_name}}-sbom.spdx.json
              --external-url sigstore=https://search.sigstore.dev/?logIndex=${{ env.SBOM_TLOG_INDEX }}
              --org ${{ inputs.kosli_org }}