validate.yaml

name: Validate and Release

on: [push, pull_request]

# Declare default permissions as read only.
permissions: read-all

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
        with:
          egress-policy: audit
          
      - name: Checkout
        uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6

      - name: Run ShellCheck
        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
        env:
          SHELLCHECK_OPTS: -x
        with:
          ignore_paths: test

      - name: Conftest - tests.sh
        uses: redhat-cop/github-actions/confbatstest@e4729075dcd3f34946b80df6b1bfb952b9fee166 # v4
        with:
          tests: test/tests.sh

      - name: Conftest - tests_fail.sh
        uses: redhat-cop/github-actions/confbatstest@e4729075dcd3f34946b80df6b1bfb952b9fee166 # v4
        with:
          raw: test/tests_fail.sh > tests_fail.log || exit 0

      - name: Check failed tests
        run: |
          if [[ $(grep -c "not ok" tests_fail.log) -ne 9 ]]; then
            echo "Expected a fixed number of failed jobs. Failing."
            cat tests_fail.log
            exit 1
          fi

      - name: Tar and Generate hashes
        shell: bash
        id: hash
        run: |
          tar cvf bats-library.tar load.bash src/
          
          echo "hashes=$(sha256sum bats-library.tar | base64 -w0)" >> "$GITHUB_OUTPUT"

      - name: Upload bats-library.tar
        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4
        with:
          name: bats-library.tar
          path: bats-library.tar
          if-no-files-found: error
          retention-days: 5

    outputs:
      hashes: ${{ steps.hash.outputs.hashes }}

  provenance:
    needs: [validate]
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      actions: read
      id-token: write
      contents: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0 # v2.0.0
    with:
      base64-subjects: "${{ needs.validate.outputs.hashes }}"
      upload-assets: true

  release:
    needs: [validate, provenance]
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    permissions:
      contents: write
    steps:
      - name: Download bats-library.tar
        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4
        with:
          name: bats-library.tar

      - name: Upload assets to release
        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87 # v2.0.5
        with:
          files: |
            bats-library.tar