tuf-conformance/.github/workflows/publish-report.yml at main · theupdateframework/tuf-conformance · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
name: Publish client conformance report

on:
  schedule:
    - cron: '0 2 * * *'
  workflow_dispatch:

jobs:
  fetch-results:
    name: Fetch ${{ matrix.name }} results
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false # Don't stop if one client results download fails
      matrix:
        include:
          - name: python-tuf
            repo: theupdateframework/python-tuf
            workflow: conformance.yml
            branch: develop
          - name: tuf-js
            repo: theupdateframework/tuf-js
            workflow: conformance.yml
            branch: main
          - name: sigstore-java
            repo: sigstore/sigstore-java
            workflow: tuf-conformance.yml
            branch: main
          - name: sigstore-ruby
            repo: sigstore/sigstore-ruby
            workflow: ci.yml
            branch: main
          - name: sigstore-rust
            repo: sigstore/sigstore-rust
            workflow: tuf-conformance.yml
            branch: main


    steps:
      - name: Download artifact
        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
        with:
          # A token is required to read other repos' artifacts. This token is a fine grained token
          # with read-only "public repositories" access only. It is set to expire in 1 year
          # (maximum accepted by OpenSSF)
          github_token: ${{ secrets.READ_ONLY_TOKEN }}
          repo: ${{ matrix.repo }}
          workflow: ${{ matrix.workflow }}
          branch: ${{ matrix.branch }}
          name: tuf-conformance-results
          workflow_conclusion: completed
          path: ./results/
        continue-on-error: true

      - name: Rename artifact for aggregation
        run: |
          if [ -f "./results/tuf-conformance-report.json" ]; then
            mv ./results/tuf-conformance-report.json "./results/${{ matrix.name }}.json"
          else
            # create empty file so report generator can still include the client as "not found"
            mkdir ./results
            echo "{}" > "./results/${{ matrix.name }}.json"
          fi

      - name: Upload ${{ matrix.name }} results
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: ${{ matrix.name }}-result
          path: ./results/${{ matrix.name }}.json

  build-report:
    name: Build client conformance report
    runs-on: ubuntu-latest
    needs: [fetch-results]
    if: always()

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Download all individual results
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: '*-result'
          path: ./results

      - name: Generate report
        run: |
          python .github/scripts/generate_client_report.py \
            --reports-dir ./results \
            --output results/index.html

      - name: Upload report for Pages
        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: results/

  deploy-pages:
    permissions:
      pages: write
      id-token: write
    environment:
      name: github-pages
      url: ${{ steps.deployment.outputs.page_url }}
    runs-on: ubuntu-latest
    needs: build-report
    steps:
      - name: Deploy to GitHub Pages
        id: deployment
        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0