Skip to content

Commit 2a11d59

Browse files
miniprow-dev[bot]miniprow-dev[bot]
authored
Merge pull request #52 from carabiner-dev/migrate-installers
Merged by miniprow
2 parents c7d0ed3 + f76aaf6 commit 2a11d59

9 files changed

Lines changed: 136 additions & 370 deletions

File tree

‎.github/workflows/test-installers.yaml‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
fail-fast: false
1414
matrix:
1515
runner: [ubuntu-latest, macos-latest, windows-latest]
16-
tool: [ampel-bootstrap, ampel, bnd, beaker, revex, snappy, unpack]
16+
tool: [ampel-bootstrap, ampel, bnd, beaker, revex, snappy, unpack, policyctl]
1717
exclude:
1818
# beaker has no Windows binary
1919
- runner: windows-latest
@@ -39,6 +39,8 @@ jobs:
3939
uses: ./install/snappy
4040
- if: matrix.tool == 'unpack'
4141
uses: ./install/unpack
42+
- if: matrix.tool == 'policyctl'
43+
uses: ./install/policyctl
4244

4345
- if: matrix.tool == 'ampel-bootstrap'
4446
name: Verify bootstrap binary runs
@@ -50,6 +52,28 @@ jobs:
5052
shell: bash
5153
run: ${{ matrix.tool }} --help
5254

55+
test-download-and-verify:
56+
strategy:
57+
fail-fast: false
58+
matrix:
59+
runner: [ubuntu-latest, macos-latest, windows-latest]
60+
runs-on: ${{ matrix.runner }}
61+
steps:
62+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
63+
with:
64+
persist-credentials: false
65+
66+
- name: Download and verify snappy
67+
uses: ./install/download-and-verify
68+
with:
69+
tool: snappy
70+
version: v0.2.4
71+
attestation-file: snappy-v0.2.4.provenance.json
72+
73+
- name: Verify snappy is on PATH
74+
shell: bash
75+
run: snappy version
76+
5377
test-ampel-verify:
5478
runs-on: ubuntu-latest
5579
permissions:

‎install/ampel/action.yml‎

Lines changed: 7 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-FileCopyrightText: Copyright 2025 Carabiner Systems, Inc
1+
# SPDX-FileCopyrightText: Copyright 2026 Carabiner Systems, Inc
22
# SPDX-License-Identifier: Apache-2.0
33

44
name: setup ampel
@@ -19,66 +19,9 @@ inputs:
1919
runs:
2020
using: "composite"
2121
steps:
22-
# - name: Checkout code
23-
# uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
24-
# with:
25-
# persist-credentials: false
26-
# repository: carabiner-dev/ampel
27-
# path: '.build/ampel/'
28-
# ref: main
29-
30-
# - name: Set up Go
31-
# uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
32-
# with:
33-
# go-version: '1.24'
34-
# cache: false
35-
# check-latest: true
36-
37-
# - name: Build
38-
# shell: bash
39-
# run: |
40-
# mkdir -p ${{ inputs.install-dir }}/bin || :
41-
# cd .build/ampel && go build -o ${{ inputs.install-dir }}/bin/ampel ./cmd/ampel/
42-
# cd -
43-
# rm -rf .build/ampel
44-
- name: Detect platform
45-
id: platform
46-
shell: bash
47-
run: |
48-
OS="${{ runner.os }}"
49-
ARCH="${{ runner.arch }}"
50-
51-
case "$OS" in
52-
Linux) os="linux" ;;
53-
macOS) os="darwin" ;;
54-
Windows) os="windows" ;;
55-
*) echo "::error::Unsupported OS: $OS"; exit 1 ;;
56-
esac
57-
58-
case "$ARCH" in
59-
X64) arch="amd64" ;;
60-
ARM64) arch="arm64" ;;
61-
*) echo "::error::Unsupported architecture: $ARCH"; exit 1 ;;
62-
esac
63-
64-
ext=""
65-
if [ "$os" = "windows" ]; then
66-
ext=".exe"
67-
fi
68-
69-
echo "filename=ampel-${{ inputs.version }}-${os}-${arch}${ext}" >> "$GITHUB_OUTPUT"
70-
echo "ext=${ext}" >> "$GITHUB_OUTPUT"
71-
- name: Install ampel
72-
shell: bash
73-
run: |
74-
mkdir -p ${{ inputs.install-dir }}/bin || :
75-
curl -Lo ${{ inputs.install-dir }}/bin/ampel${{ steps.platform.outputs.ext }} https://github.com/carabiner-dev/ampel/releases/download/${{ inputs.version }}/${{ steps.platform.outputs.filename }}
76-
chmod 0755 ${{ inputs.install-dir }}/bin/ampel${{ steps.platform.outputs.ext }}
77-
- if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}
78-
run: echo "${{ inputs.install-dir }}/bin" >> $GITHUB_PATH
79-
shell: bash
80-
- if: ${{ runner.os == 'Windows' }}
81-
run: echo "${{ inputs.install-dir }}/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
82-
shell: pwsh
83-
- shell: bash
84-
run: ampel version
22+
- uses: carabiner-dev/actions/install/download-and-verify@6022a065d6420de5d86333ecfb2b25c57f84b699
23+
with:
24+
tool: ampel
25+
version: ${{ inputs.version }}
26+
install-dir: ${{ inputs.install-dir }}
27+
attestation-file: ampel-${{ inputs.version }}.provenance.json

‎install/beaker/action.yml‎

Lines changed: 13 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,9 @@
1-
# SPDX-FileCopyrightText: Copyright 2025 Carabiner Systems, Inc
1+
# SPDX-FileCopyrightText: Copyright 2026 Carabiner Systems, Inc
22
# SPDX-License-Identifier: Apache-2.0
33

4-
# [!] Build notice:
5-
# Note that this installer curls the beaker linux binary. This
6-
# will replaced with a verified installer soon.
7-
84
name: setup beaker
95
author: carabiner-dev
10-
description: 'Installs the Carabiner beaker attester into to the runner environment'
6+
description: 'Installs the Carabiner beaker test attester into the runner environment'
117
branding:
128
icon: 'download-cloud'
139
color: 'green'
@@ -19,43 +15,17 @@ inputs:
1915
version:
2016
description: 'beaker version to install'
2117
required: false
22-
default: 'v0.1.1'
18+
default: 'v0.1.2'
2319
runs:
2420
using: "composite"
2521
steps:
26-
- name: Detect platform
27-
id: platform
28-
shell: bash
29-
run: |
30-
OS="${{ runner.os }}"
31-
ARCH="${{ runner.arch }}"
32-
33-
case "$OS" in
34-
Linux) os="linux" ;;
35-
macOS) os="darwin" ;;
36-
Windows) echo "::error::beaker does not have a Windows binary"; exit 1 ;;
37-
*) echo "::error::Unsupported OS: $OS"; exit 1 ;;
38-
esac
39-
40-
case "$ARCH" in
41-
X64) arch="amd64" ;;
42-
ARM64) arch="arm64" ;;
43-
*) echo "::error::Unsupported architecture: $ARCH"; exit 1 ;;
44-
esac
45-
46-
echo "filename=beaker-${{ inputs.version }}-${os}-${arch}" >> "$GITHUB_OUTPUT"
47-
48-
- name: Install beaker
49-
shell: bash
50-
run: |
51-
mkdir -p ${{ inputs.install-dir }}/bin || :
52-
curl -Lo ${{ inputs.install-dir }}/bin/beaker https://github.com/carabiner-dev/beaker/releases/download/${{ inputs.version }}/${{ steps.platform.outputs.filename }}
53-
chmod 0755 ${{ inputs.install-dir }}/bin/beaker
54-
55-
- if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}
56-
run: echo "${{ inputs.install-dir }}/bin" >> $GITHUB_PATH
57-
shell: bash
58-
59-
- shell: bash
60-
run: beaker version
61-
22+
- if: ${{ runner.os == 'Windows' }}
23+
shell: bash
24+
run: |
25+
echo "::error::beaker does not have a Windows binary"
26+
exit 1
27+
- uses: carabiner-dev/actions/install/download-and-verify@6022a065d6420de5d86333ecfb2b25c57f84b699
28+
with:
29+
tool: beaker
30+
version: ${{ inputs.version }}
31+
install-dir: ${{ inputs.install-dir }}

‎install/bnd/action.yml‎

Lines changed: 7 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,9 @@
1-
# SPDX-FileCopyrightText: Copyright 2025 Carabiner Systems, Inc
1+
# SPDX-FileCopyrightText: Copyright 2026 Carabiner Systems, Inc
22
# SPDX-License-Identifier: Apache-2.0
33

4-
# [!] Build notice:
5-
# Note that this installer downloads bnd fromthe release page. This
6-
# will replaced with a verified installer soon.
7-
84
name: setup bnd
95
author: carabiner-dev
10-
description: 'Installs the Carabiner bnd attester into to the runner environment'
6+
description: 'Installs the Carabiner bnd attester into the runner environment'
117
branding:
128
icon: 'download-cloud'
139
color: 'green'
@@ -23,44 +19,8 @@ inputs:
2319
runs:
2420
using: "composite"
2521
steps:
26-
- name: Detect platform
27-
id: platform
28-
shell: bash
29-
run: |
30-
OS="${{ runner.os }}"
31-
ARCH="${{ runner.arch }}"
32-
33-
case "$OS" in
34-
Linux) os="linux" ;;
35-
macOS) os="darwin" ;;
36-
Windows) os="windows" ;;
37-
*) echo "::error::Unsupported OS: $OS"; exit 1 ;;
38-
esac
39-
40-
case "$ARCH" in
41-
X64) arch="amd64" ;;
42-
ARM64) arch="arm64" ;;
43-
*) echo "::error::Unsupported architecture: $ARCH"; exit 1 ;;
44-
esac
45-
46-
ext=""
47-
if [ "$os" = "windows" ]; then
48-
ext=".exe"
49-
fi
50-
51-
echo "filename=bnd-${{ inputs.version }}-${os}-${arch}${ext}" >> "$GITHUB_OUTPUT"
52-
echo "ext=${ext}" >> "$GITHUB_OUTPUT"
53-
- name: Install bnd
54-
shell: bash
55-
run: |
56-
mkdir -p ${{ inputs.install-dir }}/bin || :
57-
curl -Lo ${{ inputs.install-dir }}/bin/bnd${{ steps.platform.outputs.ext }} https://github.com/carabiner-dev/bnd/releases/download/${{ inputs.version }}/${{ steps.platform.outputs.filename }}
58-
chmod 0755 ${{ inputs.install-dir }}/bin/bnd${{ steps.platform.outputs.ext }}
59-
- if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}
60-
run: echo "${{ inputs.install-dir }}/bin" >> $GITHUB_PATH
61-
shell: bash
62-
- if: ${{ runner.os == 'Windows' }}
63-
run: echo "${{ inputs.install-dir }}/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
64-
shell: pwsh
65-
- shell: bash
66-
run: bnd version
22+
- uses: carabiner-dev/actions/install/download-and-verify@6022a065d6420de5d86333ecfb2b25c57f84b699
23+
with:
24+
tool: bnd
25+
version: ${{ inputs.version }}
26+
install-dir: ${{ inputs.install-dir }}

‎install/download-and-verify/action.yml‎

Lines changed: 54 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,12 +32,35 @@ inputs:
3232
description: 'Name of the attestation file in the release'
3333
required: false
3434
default: 'attestations.jsonl'
35+
policy:
36+
description: >
37+
Ampel policy locator (VCS locator or path) used by `ampel verify`.
38+
Defaults to a pinned revision of the carabiner-dev policies repo's
39+
slsa-build-point policy.
40+
required: false
41+
default: 'git+https://github.com/carabiner-dev/policies@eed2d09ac2a7f8f5238a24b30492e378d8d77ad3#slsa/slsa-build-point.json'
42+
context:
43+
description: >
44+
Newline-separated context values passed to `ampel verify` as `-x KEY:VALUE`.
45+
When empty, the action injects `buildPoint:git+ssh://github.com/carabiner-dev/<repo>`
46+
derived from the download location, matching the URI scheme used in the
47+
`resolvedDependencies` of carabiner-dev SLSA provenances.
48+
required: false
49+
default: ''
50+
signers:
51+
description: >
52+
Newline-separated signer identity specs passed to `ampel verify` as `--signer SPEC`.
53+
When empty, the action injects a sigstore regexp spec pinned to the
54+
`<repo>/.github/workflows/release.yaml` workflow under carabiner-dev,
55+
with the tag left as a regex wildcard.
56+
required: false
57+
default: ''
3558
runs:
3659
using: "composite"
3760
steps:
3861
- name: Bootstrap trusted ampel
3962
if: inputs.verify == 'true'
40-
uses: carabiner-dev/actions/install/ampel-bootstrap@360ffa1eb909b0105d4eccb6d6ef337911c34952 # v1.1.6
63+
uses: carabiner-dev/actions/install/ampel-bootstrap@0a075bb75a68646d05f99c85cbbf2be40dd8e442 # bootstrap rotated to ampel v1.2.1
4164
id: bootstrap
4265

4366
- name: Detect platform
@@ -85,12 +108,38 @@ runs:
85108
- name: Verify ${{ inputs.tool }} binary
86109
if: inputs.verify == 'true'
87110
shell: bash
111+
env:
112+
CONTEXT_INPUT: ${{ inputs.context }}
113+
SIGNERS_INPUT: ${{ inputs.signers }}
114+
DEFAULT_BUILD_POINT: git+ssh://github.com/carabiner-dev/${{ steps.platform.outputs.repo }}
115+
DEFAULT_SIGNER: 'sigstore(regexp)::https://token\.actions\.githubusercontent\.com::https://github\.com/carabiner-dev/${{ steps.platform.outputs.repo }}/\.github/workflows/release\.yaml@refs/tags/[^/]+'
88116
run: |
89117
echo "::group::Verify ${{ inputs.tool }} ${{ inputs.version }}"
90-
${{ steps.bootstrap.outputs.ampel-path }} verify \
91-
--subject="${{ inputs.install-dir }}/bin/${{ inputs.tool }}${{ steps.platform.outputs.ext }}" \
92-
--collector="https://github.com/carabiner-dev/${{ steps.platform.outputs.repo }}/releases/download/${{ inputs.version }}/${{ inputs.attestation-file }}" \
93-
--policy="git+https://github.com/carabiner-dev/policies#slsa/slsa-build-point.json"
118+
119+
args=(verify)
120+
args+=(--subject="${{ inputs.install-dir }}/bin/${{ inputs.tool }}${{ steps.platform.outputs.ext }}")
121+
args+=(--collector="https://github.com/carabiner-dev/${{ steps.platform.outputs.repo }}/releases/download/${{ inputs.version }}/${{ inputs.attestation-file }}")
122+
args+=(--policy="${{ inputs.policy }}")
123+
124+
if [ -n "$CONTEXT_INPUT" ]; then
125+
while IFS= read -r line; do
126+
[ -z "$line" ] && continue
127+
args+=(-x "$line")
128+
done <<< "$CONTEXT_INPUT"
129+
else
130+
args+=(-x "buildPoint:$DEFAULT_BUILD_POINT")
131+
fi
132+
133+
if [ -n "$SIGNERS_INPUT" ]; then
134+
while IFS= read -r line; do
135+
[ -z "$line" ] && continue
136+
args+=(--signer "$line")
137+
done <<< "$SIGNERS_INPUT"
138+
else
139+
args+=(--signer "$DEFAULT_SIGNER")
140+
fi
141+
142+
"${{ steps.bootstrap.outputs.ampel-path }}" "${args[@]}"
94143
echo "::endgroup::"
95144
96145
- if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}

‎install/policyctl/action.yml‎

Lines changed: 6 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -19,47 +19,9 @@ inputs:
1919
runs:
2020
using: "composite"
2121
steps:
22-
- name: Detect platform
23-
id: platform
24-
shell: bash
25-
run: |
26-
OS="${{ runner.os }}"
27-
ARCH="${{ runner.arch }}"
28-
29-
case "$OS" in
30-
Linux) os="linux" ;;
31-
macOS) os="darwin" ;;
32-
Windows) os="windows" ;;
33-
*) echo "::error::Unsupported OS: $OS"; exit 1 ;;
34-
esac
35-
36-
case "$ARCH" in
37-
X64) arch="amd64" ;;
38-
ARM64) arch="arm64" ;;
39-
*) echo "::error::Unsupported architecture: $ARCH"; exit 1 ;;
40-
esac
41-
42-
ext=""
43-
if [ "$os" = "windows" ]; then
44-
ext=".exe"
45-
fi
46-
47-
echo "filename=policyctl-${{ inputs.version }}-${os}-${arch}${ext}" >> "$GITHUB_OUTPUT"
48-
echo "ext=${ext}" >> "$GITHUB_OUTPUT"
49-
50-
- name: Install policyctl
51-
shell: bash
52-
run: |
53-
mkdir -p ${{ inputs.install-dir }}/bin || :
54-
curl -Lo ${{ inputs.install-dir }}/bin/policyctl${{ steps.platform.outputs.ext }} https://github.com/carabiner-dev/policyctl/releases/download/${{ inputs.version }}/${{ steps.platform.outputs.filename }}
55-
chmod 0755 ${{ inputs.install-dir }}/bin/policyctl${{ steps.platform.outputs.ext }}
56-
57-
- if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}
58-
run: echo "${{ inputs.install-dir }}/bin" >> $GITHUB_PATH
59-
shell: bash
60-
- if: ${{ runner.os == 'Windows' }}
61-
run: echo "${{ inputs.install-dir }}/bin" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
62-
shell: pwsh
63-
64-
- shell: bash
65-
run: policyctl version
22+
- uses: carabiner-dev/actions/install/download-and-verify@6022a065d6420de5d86333ecfb2b25c57f84b699
23+
with:
24+
tool: policyctl
25+
version: ${{ inputs.version }}
26+
install-dir: ${{ inputs.install-dir }}
27+
attestation-file: policyctl-${{ inputs.version }}.provenance.json

0 commit comments

Comments
 (0)