Skip to content

Refactor and add BuildType interface#47

Merged
laurentsimon merged 14 commits into
slsa-framework:mainfrom
ianlewis:api-refactor
May 26, 2022
Merged

Refactor and add BuildType interface#47
laurentsimon merged 14 commits into
slsa-framework:mainfrom
ianlewis:api-refactor

Conversation

@ianlewis
Copy link
Copy Markdown
Member

@ianlewis ianlewis commented May 16, 2022

Depends on #69
Fixes #13
Fixes #2

Improve the API by adding the BuildType interface that builders can extend to implement their own build types. The intention is to improve the API and not rely so much on function parameters and allow the API to scale easier with minimal backwards incompatible changes.

The Github API client was added in order to get the workflow path via the API and solve #11 in a later PR.

The BuildType interface represents a SLSA build type and the GithubActionsBuild implements it with a basic Github Actions build type that can be extended by ecosystem builders.

A typical ecosystem builder might look like:

type GoBuild struct {
    GithubActionsBuild
}

func (b *GoBuild) URI() string {
	return "https://github.com/slsa-framework/slsa-github-generator-go@v1"
}

func (b *GoBuild) BuildConfig(context.Context) (interface{}, error) {
	return buildConfig{
		Version: buildConfigVersion,
		Steps: []step{
			// Single step.
			{
				Command: com,
				Env:     env,
			},
		},
	}
}

You can then create it and generate SLSA from it:

b := GoBuild{
	GithubActionsBuild: NewGithubActionsBuild(subjects, githubContext)
}
g := NewHostedActionsGenerator(&b)
p, _ := g.Generate(context.Background())

Github API and OIDC clients are a bit annoying to deal with in tests so the generator will support not using them by setting a NilClientProvider. In that case the generator might generate invalid SLSA but is good enough for automated or e2e tests.

if isTest() {
	g = g.WithClients(&NilClientProvider{})
}

Comment thread github/workflow.go
Comment thread slsa/buildtype.go Outdated
Comment thread slsa/provenance.go
@ianlewis
Copy link
Copy Markdown
Member Author

I'll finish this up and send for review after #50 gets merged.

@ianlewis ianlewis marked this pull request as ready for review May 20, 2022 00:11
@ianlewis ianlewis requested review from MarkLodato and asraa as code owners May 20, 2022 00:11
@ianlewis
Copy link
Copy Markdown
Member Author

@laurentsimon Could you take a look at this? would like to merge at some point soon.

Copy link
Copy Markdown
Collaborator

@laurentsimon laurentsimon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@laurentsimon laurentsimon merged commit 2f211f0 into slsa-framework:main May 26, 2022
@ianlewis ianlewis deleted the api-refactor branch July 27, 2022 01:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve WorkflowRun customization Create provenance generation library

2 participants