stable-snapshot-timestamp.yml

#
# Copyright 2021 The Sigstore Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Stable Snapshot and Timestamp

permissions: read-all

# Execute this as a weekly cron job and on changes to repository/
# when new published metadata is submitted.
on:
  # Enable cron for re-signing snapshot and timestamp every week
  schedule:
    - cron: '0 16 * * 2' # every Tuesday at 9am PST
  # When a new root is staged
  push:
    branches:
      - main
    paths:
      - 'repository/staged/root.json'
  workflow_dispatch:
    inputs:
      dry_run:
        type: boolean
        default: false
        description: Does not trigger job, but checks on whether the job should run.
      force_snapshot:
        description: 'Whether to force a snapshot. Useful if workflow is within 5 days of a ceremony'
        required: false
        default: false
        type: boolean

jobs:
  check:
    # This job checks whether snapshot/timestamp should run.
    runs-on: ubuntu-latest
    outputs:
      block_snapshot: ${{ steps.check.outputs.block_snapshot }}
    env:
      FORCE_SNAPSHOT: ${{ inputs.force_snapshot }}
    steps:
      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
        with:
          fetch-depth: 0
      - name: Determine whether to run a snapshot/timestamp
        id: check
        shell: bash
        run: |
          set -euo pipefail

          BRANCHES=$(git for-each-ref --format='%(refname:short)' | grep origin/ceremony/)
          echo "${BRANCHES}"
          # Check whether a ceremony was initiated within a week of the current date.
          echo "block_snapshot=false" >> "${GITHUB_OUTPUT}"

          # If we force a snapshot, exit early.
          if [[ "${FORCE_SNAPSHOT}" ]]; then
            exit
          fi

          ceremonyRegex="origin/ceremony/[0-9]{4}-[0-9]{2}-[0-9]{2}$"
          for branch in ${BRANCHES}
          do
            if [[ "$branch" =~ ${ceremonyRegex} ]]; then
              echo "found ceremony branch $branch"
              branch_date=$(echo "${branch}" | cut -d '/' -f3)
              days_diff=$(( ($(date -d "00:00" +%s) - $(date -d "${branch_date}" +%s)) / (24*3600) ))
              if [[ "$days_diff" -lt 2 ]]; then
                # Detected ceremony within 2 days of current date
                echo "detected ceremony branch $branch within 2 days, stopping automated cron"
                echo "block_snapshot=true" >> "${GITHUB_OUTPUT}"
              fi
            fi
          done

  run_snapshot_timestamp_publish:
    needs: check
    if: (github.event_name == 'schedule' && github.repository == 'sigstore/root-signing' && needs.check.outputs.block_snapshot == 'false') || (github.event_name != 'schedule' && inputs.dry_run == false)  # Don't run workflow in forks on cron
    permissions:
      id-token: 'write'
      issues: 'write'
      pull-requests: 'write'
      contents: 'write'
      actions: 'read'
    uses: sigstore/root-signing/.github/workflows/reuseable-snapshot-timestamp.yml@main
    with:
      snapshot_key: 'gcpkms://projects/sigstore-root-signing/locations/global/keyRings/root/cryptoKeys/snapshot'
      timestamp_key: 'gcpkms://projects/sigstore-root-signing/locations/global/keyRings/root/cryptoKeys/timestamp'
      repo: 'repository/'
      branch: main
      provider: 'projects/163070369698/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider'
      service_account: 'github-actions@sigstore-root-signing.iam.gserviceaccount.com'
    secrets:
      token: ${{ secrets.SIGSTORE_ROOT_SIGNING_FINE_GRAINED_PAT }}