Christian Manivong
d139d66c3d
CI / Tests, lint (push) Successful in 18s
The CIS gate, the SBOM, the cosign signature and the matcher's verdict lived in NetOrk/base-os, the head of the chain. Every link below it -- base-python, engine, ui, satellite, the service images -- needs the same, so the tools move here, and every image repository pins them by commit. - image_tools: cis.py, cis_os.sh, sbom.py and verify.py from base-os. The image's own repository holds its cis.toml and packages.allow; both default to the working directory. - bin/sign.sh signs whatever platforms a reference holds: base-os's index of amd64 and arm64 (EXPECT_PLATFORMS) or a dev image's single manifest (image_tools/platforms.py). - bin/verify-base.sh checks every FROM image of a Dockerfile against cosign.pub before a build; one without a digest is refused (image_tools/dockerfile.py). - bin/install-cosign.sh installs cosign v3.1.3 for amd64 and arm64 runners, checked against the release checksums. - actions/verify-base, judge, sign wrap them for the workflows. - cosign.pub is the public half of the COSIGN_PRIVATE_KEY_B64 org secret, the key rotated on 2026-10-22.
39 lines
1.2 KiB
Python
39 lines
1.2 KiB
Python
"""The composite actions every image repository of NetOrk uses (NetOrk/netork#1390).
|
|
|
|
uses: https://git.netork.io/NetOrk/image-tools/actions/<name>@<commit>
|
|
|
|
They only call what this repository holds, so a pinned commit fixes what runs.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
import yaml
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
ACTIONS = sorted((ROOT / "actions").glob("*/action.yml"))
|
|
|
|
|
|
def test_the_three_actions():
|
|
assert [a.parent.name for a in ACTIONS] == ["judge", "sign", "verify-base"]
|
|
|
|
|
|
@pytest.mark.parametrize("action", ACTIONS, ids=lambda a: a.parent.name)
|
|
def test_an_action_runs_only_what_this_repository_holds(action):
|
|
spec = yaml.safe_load(action.read_text())
|
|
|
|
assert spec["runs"]["using"] == "composite"
|
|
for step in spec["runs"]["steps"]:
|
|
for script in re.findall(r"github\.action_path }}/\.\./\.\./(bin/[\w.-]+)", step["run"]):
|
|
assert (ROOT / script).is_file(), script
|
|
assert "${{ inputs." not in step["run"], "inputs reach a script through env"
|
|
|
|
|
|
def test_signing_needs_its_secrets_from_the_caller():
|
|
text = (ROOT / "actions/sign/action.yml").read_text()
|
|
|
|
assert "COSIGN_PRIVATE_KEY_B64" in text and "secrets." not in text
|