Skip to content

Commit 8043386

Browse files
anshisinghhanshisinghh
committed
Update releasepublished.yml and Add macaron-check-github-actions.yml
1 parent 9fc1b96 commit 8043386

2 files changed

Lines changed: 79 additions & 10 deletions

File tree

‎.github/workflows/macaron-check-github-actions.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
# Copyright (c) 2026 - 2026, Oracle and/or its affiliates. All rights reserved.
2+
# Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
3+
4+
# Run Macaron's policies and generate Verification Summary Attestation reports.
5+
# See https://github.com/oracle/macaron
6+
7+
name: Run Macaron to Check Supply Chain Security Issues
8+
on:
9+
pull_request:
10+
paths:
11+
- ".github/workflows/**"
12+
- ".github/actions/**"
13+
push:
14+
branches:
15+
- legacy/v2/master
16+
paths:
17+
- ".github/workflows/**"
18+
- ".github/actions/**"
19+
workflow_dispatch:
20+
schedule:
21+
- cron: "0 4 * * 3"
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
macaron-check-github-actions:
28+
name: Macaron Policy Verification
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: Checkout Repository
32+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33+
with:
34+
persist-credentials: false
35+
36+
- name: Run Macaron Security Analysis Action
37+
uses: oracle/macaron@b31acfe389133a5587d9639063ec70cb84e7bc47 # v0.23.0
38+
with:
39+
repo_path: ./
40+
policy_file: check-github-actions
41+
policy_purl: pkg:github.com/oracle/oci-java-sdk@.*
42+
reports_retention_days: 90

‎.github/workflows/releasepublished.yml‎

Lines changed: 37 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,8 @@ jobs:
5959
- name: Check credentials
6060
run: |
6161
set -e
62-
echo "Checking SonaType SONATYPE_BASIC_AUTH_CREDENTIALS"
63-
curl --fail -X GET -H "Content-Type:application/xml" -u "${{ secrets.SONATYPE_BASIC_AUTH_CREDENTIALS }}" https://oss.sonatype.org/service/local/staging/profiles/b39883a429024e > /dev/null
62+
echo "Checking SonaType PORTAL_ACCESS_TOKEN"
63+
curl --fail -H "Accept:application/json" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" 'https://ossrh-staging-api.central.sonatype.com/manual/search/repositories?state=open'
6464
echo "Checking GitHub ACCESS_TOKEN"
6565
curl -f -H "Authorization: Bearer ${{ secrets.ACCESS_TOKEN }}" -H 'Accept: application/vnd.github.v3.raw' -s https://api.github.com/repos/$REPO > /dev/null
6666
- name: Configure GPG key
@@ -85,6 +85,7 @@ jobs:
8585
env:
8686
ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
8787
run: |
88+
sleep 900
8889
if [ "$RELEASE" = "latest" ]; then
8990
echo "Using latest release"
9091
set +e
@@ -138,7 +139,7 @@ jobs:
138139
mkdir unpacked
139140
cd unpacked
140141
unzip -q ../asset.zip
141-
head CHANGELOG.md
142+
head CHANGELOG.md
142143
- name: GPG sign all Maven files
143144
run: |
144145
cd unpacked/maven
@@ -154,10 +155,11 @@ jobs:
154155
# Code mostly by mezzargh
155156
set -e
156157
WD=`pwd`
158+
# we use the description field for cross identification between APIs (I could not find an alternative yet), so we can fetch correct repo for promotion.
157159
START_XML=$(cat << EOF
158160
<promoteRequest>
159161
<data>
160-
<description>Publish ${GITHUB_REPOSITORY} ${RELEASE} Artifacts</description>
162+
<description>${{github.repository}}-${{github.run_id}}-${{github.run_attempt}}</description>
161163
</data>
162164
</promoteRequest>
163165
EOF
@@ -168,18 +170,43 @@ jobs:
168170
cd unpacked/maven/repository
169171
cp $WD/start.xml start.xml
170172
cat start.xml
171-
curl --fail -v -X POST -d @start.xml -H "Content-Type:application/xml" -u "${{ secrets.SONATYPE_BASIC_AUTH_CREDENTIALS }}" https://oss.sonatype.org/service/local/staging/profiles/b39883a429024e/start -o $WD/finish.xml
173+
curl -sS --fail -v -X POST -d @start.xml -H "Content-Type:application/xml" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" https://ossrh-staging-api.central.sonatype.com/service/local/staging/profiles/b39883a429024e/start -o $WD/finish.xml
172174
rm start.xml
175+
curl --fail -H "Accept:application/json" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" 'https://ossrh-staging-api.central.sonatype.com/manual/search/repositories?state=open' -o results.json
176+
SELECTOR="${{github.repository}}-${{github.run_id}}-${{github.run_attempt}}"
177+
repository_namespace=`cat results.json | jq -jr --arg SELECTOR $SELECTOR ".repositories[] | select(.description == \"$SELECTOR\").key" | jq -jRrs "@uri"`
178+
echo $repository_namespace
179+
rm results.json
173180
ls -lahn $WD
174181
cat $WD/finish.xml
175182
staging_dir=$(echo $(awk -F '[<>]' '/stagedRepositoryId/{print $3}' $WD/finish.xml))
183+
rm $WD/finish.xml
176184
echo "Staging dir is '${staging_dir}'"
177185
find . -type f | sed -E s'@./@@' | grep -v start.xml > $WD/artifacts.list
178186
ls -lahn $WD
179187
echo "Uploading $(wc -l $WD/artifacts.list | sed "s/^ *\([0-9]*\) .*$/\1/") artifacts"
180188
awk '{printf "%5d\t%s\n", NR, $0}' < $WD/artifacts.list
181-
cat $WD/artifacts.list | xargs -n 1 -I {} curl --fail -u "${{ secrets.SONATYPE_BASIC_AUTH_CREDENTIALS }}" --upload-file {} https://oss.sonatype.org/service/local/staging/deployByRepositoryId/${staging_dir}/{}
182-
cp $WD/finish.xml finish.xml
183-
cat finish.xml
184-
curl --fail -X POST -d @finish.xml -H "Content-Type:application/xml" -u "${{ secrets.SONATYPE_BASIC_AUTH_CREDENTIALS }}" -H "Content-Type:application/xml" https://oss.sonatype.org/service/local/staging/profiles/b39883a429024e/finish
185-
echo https://oss.sonatype.org/content/repositories/${staging_dir}
189+
cat $WD/artifacts.list | xargs -n 1 -I {} curl -sS --fail -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" --upload-file {} https://ossrh-staging-api.central.sonatype.com/service/local/staging/deployByRepositoryId/${staging_dir}/{}
190+
curl -s -X POST -H "Accept:application/json" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" https://ossrh-staging-api.central.sonatype.com/manual/upload/repository/${repository_namespace}?publishing_type=user_managed
191+
while [[ $(curl -sS --fail -H "Accept:application/json" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" 'https://ossrh-staging-api.central.sonatype.com/manual/search/repositories' | jq -r ".repositories[] | select(.description == \"$SELECTOR\").portal_deployment_id") == "null" ]]; do
192+
echo "Waiting for deployment ID...";
193+
curl -s -X POST -H "Accept:application/json" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" https://ossrh-staging-api.central.sonatype.com/manual/upload/repository/$repository_namespace?publishing_type=user_managed;
194+
sleep 5;
195+
done
196+
curl -sS --fail -H "Accept:application/json" -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" 'https://ossrh-staging-api.central.sonatype.com/manual/search/repositories' -o final_result.json
197+
portal_id=`cat final_result.json | jq -jr ".repositories[] | select(.description == \"$SELECTOR\").portal_deployment_id"`
198+
echo "Closing OSSRH staging repo $repository_namespace, and continueing with Portal APIs"
199+
echo "Promotion to Portal deployment staging '$portal_id' is pending ...";
200+
while [[ $(curl -sS -X 'POST' -H 'Accept:application/json' -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" "https://central.sonatype.com/api/v1/publisher/status?id=$portal_id" | jq -r '.deploymentState') == "PENDING" ]]; do
201+
echo "..."
202+
sleep 5;
203+
done
204+
echo "Validing Portal deployement ...";
205+
while [[ $(curl -sS -X 'POST' -H 'Accept:application/json' -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" "https://central.sonatype.com/api/v1/publisher/status?id=$portal_id" | jq -r '.deploymentState') == "VALIDATING" ]]; do
206+
echo "..."
207+
sleep 5;
208+
done
209+
echo "Dropping OSSRH staging repo: $repository_namespace"
210+
curl -sS -X 'DELETE' -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" https://ossrh-staging-api.central.sonatype.com/manual/drop/repository/$repository_namespace
211+
curl -sS -X 'POST' -H 'Accept:application/json' -H "Authorization: Bearer ${{ secrets.PORTAL_ACCESS_TOKEN }}" "https://central.sonatype.com/api/v1/publisher/status?id=$portal_id" | jq -e 'if .deploymentState == "FAILED" then error(.errors | tostring) else .deploymentState end'
212+
echo "Portal Staging repository: https://central.sonatype.com/api/v1/publisher/deployment/$portal_id/download/"

0 commit comments

Comments
 (0)