aho-corasick/.github/workflows/provenance-sync.yml at 48d2768683fab0777a320c84aefb693be14fca57 · stella/aho-corasick · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Provenance Sync

on:
  pull_request:
    types:
      [
        opened,
        synchronize,
        reopened,
        ready_for_review,
      ]
    paths:
      - "bun.lock"
      - "Cargo.lock"
      - "**/package.json"
      - "Cargo.toml"
      - "src/**"
      - "wasm/**"
      - "*.js"
      - "*.cjs"
      - "*.mjs"
      - ".provenance.yml"
  workflow_dispatch:

concurrency:
  group: provenance-sync-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions:
  contents: write
  pull-requests: write

jobs:
  sync:
    if: >-
      github.event_name != 'pull_request'
      || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          ref: ${{ github.event.pull_request.head.ref || github.ref_name }}

      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
        with:
          node-version: "22"

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2

      - name: Install cdxgen
        run: npm install --global @cyclonedx/cdxgen@12.1.5

      - name: Install provenance
        env:
          PROVENANCE_VERSION: v0.1.3
        run: |
          set -euo pipefail

          asset_name="provenance-${PROVENANCE_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
          checksums_name="provenance-${PROVENANCE_VERSION}-checksums.txt"
          base_url="https://github.com/stella/provenance/releases/download/${PROVENANCE_VERSION}"
          asset_path="${RUNNER_TEMP}/${asset_name}"
          checksums_path="${RUNNER_TEMP}/${checksums_name}"
          install_root="${RUNNER_TEMP}/provenance-install"
          install_bin="${RUNNER_TEMP}/provenance-bin"

          curl --fail --silent --show-error --location \
            --output "$asset_path" \
            "${base_url}/${asset_name}"
          curl --fail --silent --show-error --location \
            --output "$checksums_path" \
            "${base_url}/${checksums_name}"

          expected_checksum="$(
            awk -v asset="$asset_name" '$2 == asset { print $1 }' "$checksums_path"
          )"
          if [ -z "$expected_checksum" ]; then
            echo "::error::Checksum for ${asset_name} not found in ${checksums_name}"
            exit 1
          fi

          actual_checksum="$(sha256sum "$asset_path" | awk '{ print $1 }')"
          if [ "$actual_checksum" != "$expected_checksum" ]; then
            echo "::error::Checksum mismatch for ${asset_name}"
            exit 1
          fi

          rm -rf "$install_root" "$install_bin"
          mkdir -p "$install_root" "$install_bin"
          tar -xzf "$asset_path" -C "$install_root"

          cp "$(find "$install_root" -type f -name provenance | head -n 1)" \
            "$install_bin/provenance"
          chmod +x "$install_bin/provenance"
          echo "$install_bin" >> "$GITHUB_PATH"

      - name: Install dependencies
        run: bun install --frozen-lockfile

      - name: Generate provenance artifacts
        run: |
          PROVENANCE_CDXGEN="$(command -v cdxgen)"
          export PROVENANCE_CDXGEN
          provenance generate --root .

      - name: Commit refreshed artifacts
        env:
          HEAD_REF: ${{ github.event.pull_request.head.ref || github.ref_name }}
        run: |
          set -euo pipefail

          if git diff --quiet -- provenance/; then
            echo "No provenance changes detected."
            exit 0
          fi

          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add provenance/
          git commit -m "chore: refresh provenance artifacts"
          git push origin "HEAD:${HEAD_REF}"