action.yml

name: "sigstore-conformance"
author: "Alex Cameron <alex.cameron@trailofbits.com>"
description: "Conformance testing for Sigstore clients"

inputs:
  entrypoint:
    description: "the command to invoke the Sigstore client"
    required: true
    default: ""
  internal-be-careful-debug:
    description: "run with debug logs (default false)"
    required: false
    default: "false"
  skip-signing:
    description: "skip tests that involve signing (default false)"
    required: false
    default: "false"
  skip-cpython-release-tests:
    description: "skip all CPython Sigstore bundle tests"
    required: false
    default: "false"
  environment:
    description: "'production' (default) or 'staging'"
    required: false
    default: "production"
  xfail:
    description: "one or more tests that are expected to fail, whitespace-separated"
    required: false
    default: ""

runs:
  using: "composite"
  steps:
    - name: Check out latest CPython release metadata
      uses: actions/checkout@v4
      with:
        repository: woodruffw/cpython-release-tracker
        persist-credentials: false
        path: cpython-release-tracker
        ref: f5ef7e3a49c5b9aa2a5c8f9591e2c9feb1939060

    - name: Set up sigstore-conformance
      run: |
        echo "::group::Install sigstore-conformance requirements"
        # NOTE: Sourced, not executed as a script.
        source "${{ github.action_path }}/setup/setup.bash"
        echo "::endgroup::"
      shell: bash

    - name: Run sigstore-conformance
      id: sigstore-conformance
      run: |
        ${{ github.action_path }}/action.py
      env:
        GHA_SIGSTORE_CONFORMANCE_ENVIRONMENT: "${{ inputs.environment }}"
        GHA_SIGSTORE_CONFORMANCE_ENTRYPOINT: "${{ inputs.entrypoint }}"
        GHA_SIGSTORE_CONFORMANCE_INTERNAL_BE_CAREFUL_DEBUG: "${{ inputs.internal-be-careful-debug }}"
        GHA_SIGSTORE_CONFORMANCE_SKIP_SIGNING: "${{ inputs.skip-signing }}"
        GHA_SIGSTORE_CONFORMANCE_SKIP_CPYTHON_RELEASE_TESTS: "${{ inputs.skip-cpython-release-tests }}"
        GHA_SIGSTORE_CONFORMANCE_XFAIL: "${{ inputs.xfail }}"
      shell: bash