Expose SLSA source level from new verify-source task

CODEOWNERS

@@ -128,6 +128,9 @@
 # renovate groupName=oci-run-script
 /task/run-script-oci-ta @konflux-ci/build-maintainers @Zokormazo @arewm
 
+# renovate groupName=verify-source
+/task/verify-source @arewm @ralphbean
+
 # These are auto-generated and often require changes when tasks change.
 # Allow anyone with write access to approve the changes.
 /pipelines/*/README.md

renovate.json

@@ -240,6 +240,12 @@
         "task/run-script-oci-ta/**"
       ]
     },
+    {
+      "groupName": "verify-source",
+      "matchFileNames": [
+        "task/verify-source/**"
+      ]
+    },
     {
       "groupName": "mobster",
       "matchFileNames": [

task/verify-source/0.1/README.md

@@ -0,0 +1,71 @@
+# verify-source task
+
+The verify-source Task verifies the SLSA source level of a git commit
+by checking for a Verification Summary Attestation (VSA) stored as a
+git note. The task fetches git notes from the repository and parses
+the VSA to extract the verified SLSA source level.
+
+WARNING: This task relies on VSAs generated by source-tool
+(https://github.com/slsa-framework/source-tool) which is currently a
+proof-of-concept and under active development. It should not be used in
+production environments. It supports GitHub and GitLab repositories,
+and may encounter API rate limits without authentication.
+
+
+## Parameters
+|name|description|default value|required|
+|---|---|---|---|
+|url|Repository URL to verify.||true|
+|revision|Commit SHA to verify.||true|
+
+## Results
+|name|description|
+|---|---|
+|SLSA_SOURCE_LEVEL_ACHIEVED|The SLSA source level achieved by this commit|
+|TEST_OUTPUT|JSON formatted test results for SLSA verification|
+
+## Workspaces
+|name|description|optional|
+|---|---|---|
+|basic-auth|A Workspace containing a token file for API authentication. The workspace should contain a file named 'token' with a GitHub personal access token, GitLab personal access token, or other authentication token. The task will automatically set the appropriate environment variable (GITHUB_TOKEN or GITLAB_TOKEN) based on the repository host. This is used to avoid rate limiting when accessing the API. Binding a Secret to this Workspace is strongly recommended over other volume types. |true|
+
+## Additional info
+
+### API Authentication
+
+To avoid API rate limits, you can provide an authentication token via the `basic-auth` workspace. The task automatically detects the repository host and sets the appropriate environment variable (`GITHUB_TOKEN` for GitHub, `GITLAB_TOKEN` for GitLab).
+
+**Create a secret with your token:**
+
+```bash
+# For GitHub
+kubectl create secret generic git-token \
+  --from-literal=token=ghp_yourGitHubTokenHere
+
+# For GitLab
+kubectl create secret generic git-token \
+  --from-literal=token=glpat-yourGitLabTokenHere
+```
+
+**Use the secret in your pipeline:**
+
+```yaml
+apiVersion: tekton.dev/v1
+kind: TaskRun
+metadata:
+  name: verify-source-example
+spec:
+  taskRef:
+    name: verify-source
+  params:
+    - name: url
+      value: https://github.com/slsa-framework/source-tool
+    - name: revision
+      value: 134593d9158efd253e979e2e8d87b939945d091e
+  workspaces:
+    - name: basic-auth
+      secret:
+        secretName: git-token
+```
+
+The task will automatically detect the `token` file in the workspace and set the appropriate environment variable based on the repository URL.

task/verify-source/0.1/tests/test-verify-source-no-vsa.yaml

@@ -0,0 +1,68 @@
+---
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: test-verify-source-no-vsa
+spec:
+  description: |
+    Test the verify-source task with a repository that has no VSA
+  tasks:
+    - name: run-task
+      taskRef:
+        name: verify-source
+      params:
+        - name: url
+          value: https://github.com/kelseyhightower/nocode
+        - name: revision
+          value: ed6c73fc16578ec53ea374585df2b965ce9f4a31
+    - name: check-result
+      params:
+        - name: SLSA_SOURCE_LEVEL_ACHIEVED
+          value: $(tasks.run-task.results.SLSA_SOURCE_LEVEL_ACHIEVED)
+        - name: TEST_OUTPUT
+          value: $(tasks.run-task.results.TEST_OUTPUT)
+      taskSpec:
+        params:
+          - name: SLSA_SOURCE_LEVEL_ACHIEVED
+          - name: TEST_OUTPUT
+        steps:
+          - name: check-result
+            env:
+              - name: SLSA_LEVEL_ACHIEVED
+                value: $(params.SLSA_SOURCE_LEVEL_ACHIEVED)
+              - name: TEST_OUTPUT
+                value: $(params.TEST_OUTPUT)
+            image: quay.io/konflux-ci/appstudio-utils:1610c1fc4cfc9c9053dbefc1146904a4df6659ef@sha256:90ac97b811073cb99a23232c15a08082b586c702b85da6200cf54ef505e3c50c
+            script: |
+              #!/usr/bin/env sh
+              set -eux
+
+              # Strip trailing newlines from results
+              LEVEL=$(echo "$SLSA_LEVEL_ACHIEVED" | tr -d '\n')
+              OUTPUT=$(echo "$TEST_OUTPUT" | tr -d '\n')
+
+              echo "SLSA_SOURCE_LEVEL_ACHIEVED: $LEVEL"
+              echo "TEST_OUTPUT: $OUTPUT"
+
+              # For repos without VSA, verify SLSA level is 1 (baseline)
+              if [ "$LEVEL" != "SLSA_SOURCE_LEVEL_1" ]; then
+                echo "ERROR: Expected SLSA_SOURCE_LEVEL_1 for repo without VSA, got: $LEVEL"
+                exit 1
+              fi
+
+              # Verify that TEST_OUTPUT is non-empty
+              if [ -z "$OUTPUT" ]; then
+                echo "ERROR: TEST_OUTPUT is empty"
+                exit 1
+              fi
+
+              # Verify that there is at least one warning (no VSA found)
+              WARNINGS=$(echo "$OUTPUT" | grep -o '"warnings": [0-9]*' | grep -o '[0-9]*' || echo "0")
+              if [ "$WARNINGS" -eq 0 ]; then
+                echo "ERROR: Expected at least one warning for repo without VSA"
+                exit 1
+              fi
+
+              echo "SUCCESS: No-VSA verification test passed - correctly identified repo without VSA"
+      runAfter:
+        - run-task

task/verify-source/0.1/tests/test-verify-source-with-vsa.yaml

@@ -0,0 +1,61 @@
+---
+apiVersion: tekton.dev/v1
+kind: Pipeline
+metadata:
+  name: test-verify-source-with-vsa
+spec:
+  description: |
+    Test the verify-source task with SLSA source verification
+  tasks:
+    - name: run-task
+      taskRef:
+        name: verify-source
+      params:
+        - name: url
+          value: https://github.com/slsa-framework/source-tool
+        - name: revision
+          value: 134593d9158efd253e979e2e8d87b939945d091e
+    - name: check-result
+      params:
+        - name: SLSA_SOURCE_LEVEL_ACHIEVED
+          value: $(tasks.run-task.results.SLSA_SOURCE_LEVEL_ACHIEVED)
+        - name: TEST_OUTPUT
+          value: $(tasks.run-task.results.TEST_OUTPUT)
+      taskSpec:
+        params:
+          - name: SLSA_SOURCE_LEVEL_ACHIEVED
+          - name: TEST_OUTPUT
+        steps:
+          - name: check-result
+            env:
+              - name: SLSA_LEVEL_ACHIEVED
+                value: $(params.SLSA_SOURCE_LEVEL_ACHIEVED)
+              - name: TEST_OUTPUT
+                value: $(params.TEST_OUTPUT)
+            image: quay.io/konflux-ci/appstudio-utils:1610c1fc4cfc9c9053dbefc1146904a4df6659ef@sha256:90ac97b811073cb99a23232c15a08082b586c702b85da6200cf54ef505e3c50c
+            script: |
+              #!/usr/bin/env sh
+              set -eux
+
+              # Strip trailing newlines from results
+              LEVEL=$(echo "$SLSA_LEVEL_ACHIEVED" | tr -d '\n')
+              OUTPUT=$(echo "$TEST_OUTPUT" | tr -d '\n')
+
+              echo "SLSA_SOURCE_LEVEL_ACHIEVED: $LEVEL"
+              echo "TEST_OUTPUT: $OUTPUT"
+
+              # Verify that SLSA level is 3 (extracted from VSA)
+              if [ "$LEVEL" != "SLSA_SOURCE_LEVEL_3" ]; then
+                echo "ERROR: Expected SLSA_SOURCE_LEVEL_3 from slsa-framework/source-tool repo VSA, got: $LEVEL"
+                exit 1
+              fi
+
+              # Verify that TEST_OUTPUT is non-empty
+              if [ -z "$OUTPUT" ]; then
+                echo "ERROR: TEST_OUTPUT is empty"
+                exit 1
+              fi
+
+              echo "SUCCESS: SLSA verification test passed"
+      runAfter:
+        - run-task