kind-cluster-image-policy-tsa.yaml

# Copyright 2022 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Test policy-controller with TSA

on:
  pull_request:
    branches: [ 'main', 'release-*' ]

defaults:
  run:
    shell: bash

permissions: read-all

jobs:
  cip-test-trustroot-bring-your-own-keys:
    name: ClusterImagePolicy e2e tests with TrustRoot - Bring Your Own Keys
    runs-on: ubuntu-latest

    strategy:
      fail-fast: false # Keep running if one leg fails.
      matrix:
        k8s-version:
          - v1.29.x
          - v1.30.x
          - v1.31.x
          - v1.32.x

    env:
      KO_DOCKER_REPO: "registry.local:5000/policy-controller"
      SCAFFOLDING_RELEASE_VERSION: "v0.7.18"
      GO111MODULE: on
      GOFLAGS: -ldflags=-s -ldflags=-w
      KOCACHE: ~/ko

    steps:
    - name: free up disk space for the release
      run: |
          rm -rf /usr/share/dotnet/
          rm -rf "$AGENT_TOOLSDIRECTORY"
          rm -rf "/usr/local/share/boost"
          rm -rf /opt/ghc
          docker rmi $(docker image ls -aq) || true
          swapoff /swapfile || true
          rm -rf /swapfile /usr/share/dotnet /usr/local/lib/android /opt/ghc  || true
          apt purge aria2 ansible hhvm mono-devel azure-cli shellcheck rpm xorriso zsync \
            clang-6.0 lldb-6.0 lld-6.0 clang-format-6.0 clang-8 lldb-8 lld-8 clang-format-8 \
            clang-9 lldb-9 lld-9 clangd-9 clang-format-9 dotnet-sdk-3.0 dotnet-sdk-3.1=3.1.101-1 \
            esl-erlang firefox g++-8 g++-9 gfortran-8 gfortran-9 google-chrome-stable \
            google-cloud-sdk ghc-8.0.2 ghc-8.2.2 ghc-8.4.4 ghc-8.6.2 ghc-8.6.3 ghc-8.6.4 \
            ghc-8.6.5 ghc-8.8.1 ghc-8.8.2 ghc-8.8.3 ghc-8.10.1 cabal-install-2.0 cabal-install-2.2 \
            cabal-install-2.4 cabal-install-3.0 cabal-install-3.2 heroku imagemagick \
            libmagickcore-dev libmagickwand-dev libmagic-dev ant ant-optional kubectl \
            mercurial apt-transport-https mono-complete mysql-client libmysqlclient-dev \
            mysql-server mssql-tools unixodbc-dev yarn bazel chrpath libssl-dev libxft-dev \
            libfreetype6 libfreetype6-dev libfontconfig1 libfontconfig1-dev php7.1 php7.1-bcmath \
            php7.1-bz2 php7.1-cgi php7.1-cli php7.1-common php7.1-curl php7.1-dba php7.1-dev \
            php7.1-enchant php7.1-fpm php7.1-gd php7.1-gmp php7.1-imap php7.1-interbase php7.1-intl \
            php7.1-json php7.1-ldap php7.1-mbstring php7.1-mcrypt php7.1-mysql php7.1-odbc \
            php7.1-opcache php7.1-pgsql php7.1-phpdbg php7.1-pspell php7.1-readline php7.1-recode \
            php7.1-snmp php7.1-soap php7.1-sqlite3 php7.1-sybase php7.1-tidy php7.1-xml \
            php7.1-xmlrpc php7.1-xsl php7.1-zip php7.2 php7.2-bcmath php7.2-bz2 php7.2-cgi \
            php7.2-cli php7.2-common php7.2-curl php7.2-dba php7.2-dev php7.2-enchant php7.2-fpm \
            php7.2-gd php7.2-gmp php7.2-imap php7.2-interbase php7.2-intl php7.2-json php7.2-ldap \
            php7.2-mbstring php7.2-mysql php7.2-odbc php7.2-opcache php7.2-pgsql php7.2-phpdbg \
            php7.2-pspell php7.2-readline php7.2-recode php7.2-snmp php7.2-soap php7.2-sqlite3 \
            php7.2-sybase php7.2-tidy php7.2-xml php7.2-xmlrpc php7.2-xsl php7.2-zip php7.3 \
            php7.3-bcmath php7.3-bz2 php7.3-cgi php7.3-cli php7.3-common php7.3-curl php7.3-dba \
            php7.3-dev php7.3-enchant php7.3-fpm php7.3-gd php7.3-gmp php7.3-imap php7.3-interbase \
            php7.3-intl php7.3-json php7.3-ldap php7.3-mbstring php7.3-mysql php7.3-odbc \
            php7.3-opcache php7.3-pgsql php7.3-phpdbg php7.3-pspell php7.3-readline php7.3-recode \
            php7.3-snmp php7.3-soap php7.3-sqlite3 php7.3-sybase php7.3-tidy php7.3-xml \
            php7.3-xmlrpc php7.3-xsl php7.3-zip php7.4 php7.4-bcmath php7.4-bz2 php7.4-cgi \
            php7.4-cli php7.4-common php7.4-curl php7.4-dba php7.4-dev php7.4-enchant php7.4-fpm \
            php7.4-gd php7.4-gmp php7.4-imap php7.4-interbase php7.4-intl php7.4-json php7.4-ldap \
            php7.4-mbstring php7.4-mysql php7.4-odbc php7.4-opcache php7.4-pgsql php7.4-phpdbg \
            php7.4-pspell php7.4-readline php7.4-snmp php7.4-soap php7.4-sqlite3 php7.4-sybase \
            php7.4-tidy php7.4-xml php7.4-xmlrpc php7.4-xsl php7.4-zip php-amqp php-apcu \
            php-igbinary php-memcache php-memcached php-mongodb php-redis php-xdebug \
            php-zmq snmp pollinate libpq-dev postgresql-client powershell ruby-full \
            sphinxsearch subversion mongodb-org -yq >/dev/null 2>&1 || true
          apt-get remove -y 'php.*' || true
          apt-get autoremove -y >/dev/null 2>&1 || true
          apt-get autoclean -y >/dev/null 2>&1 || true
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
      with:
        go-version-file: './go.mod'
        check-latest: true

    # will use the latest release available for ko
    - uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7

    - uses: imranismail/setup-kustomize@2ba527d4d055ab63514ba50a99456fc35684947f # v2.1.0

    - name: Install yq
      uses: mikefarah/yq@4839dbbf80445070a31c7a9c1055da527db2d5ee # v4.44.6

    - name: Setup mirror
      uses: chainguard-dev/actions/setup-mirror@main
      with:
        mirror: mirror.gcr.io

    - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v2

    - name: Install cluster + sigstore
      uses: sigstore/scaffolding/actions/setup@main
      env:
        INSTALL_TSA: true
      with:
        k8s-version: ${{ matrix.k8s-version}}
        version: ${{ env.SCAFFOLDING_RELEASE_VERSION }}

    # Install policy-controller that does not have TUF embedded or installed.
    - name: Install policy-controller
      env:
        GIT_HASH: ${{ github.sha }}
        GIT_VERSION: ci
        LDFLAGS: ""
        POLICY_CONTROLLER_YAML: test/kustomize-no-tuf/policy-controller-e2e.yaml
        KO_PREFIX: registry.local:5000/policy-controller
        POLICY_CONTROLLER_ARCHS: linux/amd64
      run: |
        make ko-policy-controller
        kustomize build test/kustomize-no-tuf | kubectl apply -f -

        # Wait for the webhook to come up and become Ready
        kubectl rollout status --timeout 5m --namespace cosign-system deployments/webhook
        echo "TUF_ROOT_FILE=./root.json" >> $GITHUB_ENV

    - name: Checkout TSA for testing.
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v3.0.2
      with:
        repository: sigstore/timestamp-authority
        path: ./src/github.com/sigstore/timestamp-authority

    - name: Build timestamp-cli
      working-directory: ./src/github.com/sigstore/timestamp-authority
      run: |
        go build -o ./timestamp-cli ./cmd/timestamp-cli

    - name: Exercise our local TSA
      working-directory: ./src/github.com/sigstore/timestamp-authority
      run: |
        TSA_URL=$(kubectl -n tsa-system get ksvc tsa -ojsonpath='{.status.url}')
        echo "TSA_URL=$TSA_URL" >> $GITHUB_ENV

        curl $TSA_URL/api/v1/timestamp/certchain > ts_chain.pem
        echo "myblob" > myblob
        if ! ./timestamp-cli --timestamp_server $TSA_URL timestamp --hash sha256 --artifact myblob --out response.tsr ; then
          echo "failed to timestamp artifact"
          exit -1
        fi
        if ! ./timestamp-cli verify --timestamp response.tsr --artifact "myblob" --certificate-chain ts_chain.pem ; then
          echo "failed to verify timestamp"
          exit -1
        fi
        if ! ./timestamp-cli inspect --timestamp response.tsr --format json ; then
          echo "failed to inspect the timestamp"
          exit -1
        fi

    - name: Run TSA Tests
      timeout-minutes: 5
      run: |
        ./test/e2e_test_cluster_image_policy_with_tsa.sh

    - name: Collect diagnostics
      if: ${{ failure() }}
      uses: chainguard-dev/actions/kind-diag@29fb6e979a0b3efc79748a17e8cec08d0594cbfd # main