feat: automate releases and generate slsa provenance

netomi commented 12 months ago

This fixes #239 .

It uses the existing release-drafter config and the generic slsa generator workflow.

This PR adds the following changes:

adds a new workflow release.yml that triggers when tags with name [v*] are being created
it will build the app as distribution (zip file), generate slsa provenance for it and attach it to a release prepared by release drafter
after the release preparation have been completed, you can manually publish the release (it will be a draft after the workflow has been completed)

This PR is an attempt to automate releases using existing configurations. In the long term, switch to jreleaser seems like the way to go, however this will affect the release notes. Also the builder workflow for jreleaser and slsa is not really mature atm, using the generic generator is a safe solution for now imho.

cc @mbarbero

netomi commented 12 months ago

I was testing the release workflow in a fork: https://github.com/OtterdogTest/macos-notarization-service/actions/runs/6156752670

netomi commented 12 months ago

Added a simple script to download releases from a GitHub repo and verify them with the attached provenance: https://gitlab.eclipse.org/eclipsefdn/security/scripts/-/blob/main/github/download-github-release.sh?ref_type=heads

Output is something like this:

tn@proteus:~/workspace/eclipse/tmp$ ./download-github-release.sh -r OtterdogTest/macos-notarization-service -v 1.2.0 -a macos-notarization-service
REPO = OtterdogTest/macos-notarization-service
VERSION = 1.2.0
ARTIFACT = macos-notarization-service
Downloaded artifact 'macos-notarization-service-1.2.0.zip'
Downloaded provenance 'macos-notarization-service-1.2.0.zip.intoto.jsonl'
Verified signature against tlog entry index 35832649 at URL: https://rekor.sigstore.dev/api/v1/log/entries/24296fb24b8ad77a974d0969c1794c4ee66430f39ee346c823fdafbaca7c018e078063cbd51b58b7
Verified build using builder "https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@refs/tags/v1.9.0" at commit 0ae0a91fac3e0e4ff7ae2b2e5718c68d1cb38e9a
Verifying artifact macos-notarization-service-1.2.0.zip: PASSED

PASSED: Verified SLSA provenance

eclipse-cbi / macos-notarization-service

feat: automate releases and generate slsa provenance #240