action.yml

# Inspired by sigstore/cosign-installer
name: gittuf-installer
author: gittuf
description: 'Installs gittuf and includes it in your path'
inputs:
  gittuf-version:
    description: 'Version of gittuf to install'
    required: false
    default: '0.8.1'
runs:
  using: 'composite'
  steps:
    - name: Provision cosign
      uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da
    - shell: bash
      run: |
        #!/bin/bash

        shopt -s expand_aliases
        alias log_info="echo \"INFO:\""
        alias log_error="echo \"ERROR:\""

        set -e

        gittuf_dir="$HOME/.gittuf"
        executable_name="gittuf"
        executable_path="$gittuf_dir/$executable_name"
        cert_path="$executable_path.pem"
        sig_path="$executable_path.sig"

        mkdir -p $gittuf_dir

        if [[ ${{ inputs.gittuf-version }} == "main" ]]; then
          log_info "installing gittuf using 'go install' from the 'main' branch"
          GOBIN=$(go env GOPATH)/bin
          go install github.com/gittuf/gittuf@main
          ln -s $GOBIN/$executable_name $executable_path
          exit 0
        fi

        log_info "installing gittuf v${{ inputs.gittuf-version }}"
        filename_prefix="gittuf_${{ inputs.gittuf-version }}"

        case ${{ runner.os }} in
          Linux)
            case ${{ runner.arch }} in
              X64)
                filename_suffix="linux_amd64"
                ;;
              ARM64)
                filename_suffix="linux_arm64"
                ;;
              *)
                log_error "unsupported architecture ${{ runner.arch }}"
                exit 1
                ;;
            esac
            ;;

          macOS)
            case ${{ runner.arch }} in
              X64)
                filename_suffix="darwin_amd64"
                ;;
              ARM64)
                filename_suffix="darwin_arm64"
                ;;
              *)
                log_error "unsupported architecture ${{ runner.arch }}"
                exit 1
                ;;
            esac
            ;;

          Windows)
            case ${{ runner.arch }} in
              X64)
                filename_suffix="windows_amd64.exe"
                ;;
              ARM64)
                filename_suffix="windows_arm64.exe"
                ;;
              *)
                log_error "unsupported architecture ${{ runner.arch }}"
                exit 1
                ;;
            esac
            ;;

          *)
            log_error "unsupported OS ${{ runner.os }}"
            exit 1
            ;;
        esac

        filename="${filename_prefix}_${filename_suffix}"
        cert="${filename}.pem"
        sig="${filename}.sig"

        log_info "fetching $filename, $cert, and $sig"
        curl -sL https://github.com/gittuf/gittuf/releases/download/v${{ inputs.gittuf-version }}/${filename} -o $executable_path
        curl -sL https://github.com/gittuf/gittuf/releases/download/v${{ inputs.gittuf-version }}/${cert} -o $cert_path
        curl -sL https://github.com/gittuf/gittuf/releases/download/v${{ inputs.gittuf-version }}/${sig} -o $sig_path

        expected_identity="https://github.com/gittuf/gittuf/.github/workflows/release.yml@refs/tags/v${{ inputs.gittuf-version }}"
        expected_issuer="https://token.actions.githubusercontent.com"

        log_info "verifying signature using cosign"
        log_info "expected identity is '$expected_identity'"
        log_info "expected issuer is '$expected_issuer'"
        cosign verify-blob $executable_path \
          --certificate $cert_path \
          --certificate-identity $expected_identity \
          --certificate-oidc-issuer $expected_issuer \
          --signature $sig_path

        chmod +x $executable_path
        log_info "installation successful!"
    - if: ${{ runner.os == 'Linux' || runner.os == 'macOS' }}
      run: echo "$HOME/.gittuf" >> $GITHUB_PATH
      shell: bash
    - if: ${{ runner.os == 'Windows' }}
      run: echo "$HOME/.gittuf" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
      shell: pwsh