ADR-018: GitHub Action v2.1 - Attestation, OIDC & Compliance¶

# Use default branch detection (works with main, master, or custom default)
if: |
  github.event_name == 'push' &&
  github.ref == format('refs/heads/{0}', github.event.repository.default_branch)

# Default (lint-only)
permissions:
  contents: read

# With SARIF upload
permissions:
  contents: read
  security-events: write

# With attestation + OIDC
permissions:
  contents: read
  security-events: write
  attestations: write
  id-token: write
  packages: write  # Required for container attestations (optional)

# With PR comment
permissions:
  contents: read
  pull-requests: write

inputs:
  # ============ Existing (v2.0) ============
  bundles:
    description: 'Glob pattern for evidence bundles'
    default: ''
  fail_on:
    description: 'Fail threshold: error, warn, info, none'
    default: 'error'
  sarif:
    description: 'Upload SARIF to GitHub Security tab'
    default: 'true'
  category:
    description: 'SARIF category (auto-generated if omitted)'
    default: ''
  baseline_dir:
    description: 'Path to baseline bundles for diff'
    default: ''
  baseline_key:
    description: 'Key for baseline cache lookup'
    default: ''
  write_baseline:
    description: 'Write baseline after successful run (main branch only)'
    default: 'false'
  comment_diff:
    description: 'Post PR comment with diff summary'
    default: 'true'
  version:
    description: 'Assay CLI version to install'
    default: 'latest'

  # ============ New (v2.1) ============
  pack:
    description: |
      Compliance pack(s) to apply (comma-separated).
      Examples: eu-ai-act-baseline, soc2-baseline, ./custom.yaml
    required: false
    default: ''

  store:
    description: |
      BYOS store URL for evidence push.
      Examples: s3://bucket/prefix, az://container, gs://bucket
      Requires OIDC trust relationship configured.
    required: false
    default: ''

  store_provider:
    description: |
      Cloud provider for OIDC authentication.
      Options: aws, gcp, azure, auto (detect from URL)
    required: false
    default: 'auto'

  store_role:
    description: |
      IAM role/identity for OIDC authentication.
      AWS: arn:aws:iam::ACCOUNT:role/ROLE
      GCP: projects/PROJECT/locations/global/workloadIdentityPools/POOL/providers/PROVIDER
      Azure: azure://TENANT/APP
    required: false
    default: ''

  attest:
    description: |
      Generate SLSA-aligned artifact attestation for evidence bundles.
      Requires permissions: attestations: write, id-token: write
      Only runs on push to default branch.
    required: false
    default: 'false'

  badge_gist:
    description: |
      Gist ID for dynamic coverage badge.
      Requires GIST_TOKEN secret with gist:write scope.
      Only runs on push to default branch.
    required: false
    default: ''

outputs:
  # ============ Existing (v2.0) ============
  verified:
    description: 'true if all bundles passed verification'
  findings_error:
    description: 'Count of error-level findings'
  findings_warn:
    description: 'Count of warning-level findings'
  sarif_path:
    description: 'Path to generated SARIF file'
  sarif_uploaded:
    description: 'true if SARIF was uploaded to Code Scanning'
  diff_summary:
    description: 'One-line diff summary'
  diff_new_findings:
    description: 'Count of new findings vs baseline'
  reports_dir:
    description: 'Path to reports directory'

  # ============ New (v2.1) ============
  pack_applied:
    description: 'Comma-separated list of applied pack IDs'
  pack_score:
    description: 'Compliance score (0-100) across all packs'
  pack_articles:
    description: 'Comma-separated list of covered articles (e.g., "12(1),12(2)(a)")'
  bundle_url:
    description: 'URL of pushed evidence bundle in BYOS (if store set)'
  attestation_id:
    description: 'Artifact attestation UUID (if attest=true)'
  attestation_url:
    description: 'URL to view attestation in GitHub UI (if attest=true)'
  coverage_percent:
    description: 'Evidence coverage percentage (tools with policy / total tools)'

- name: Lint with compliance packs
  if: inputs.pack != ''
  shell: bash
  run: |
    PACKS="${{ inputs.pack }}"

    assay evidence lint \
      --format sarif \
      --pack "$PACKS" \
      --output "$REPORTS_DIR/lint.sarif" \
      $BUNDLES

    # Extract pack metadata for Job Summary
    SARIF="$REPORTS_DIR/lint.sarif"

    PACK_APPLIED=$(jq -r '[.runs[0].tool.driver.rules[]?.properties.pack // empty] | unique | join(",")' "$SARIF")
    PACK_SCORE=$(jq -r '.runs[0].properties.complianceScore // 100' "$SARIF")
    PACK_ARTICLES=$(jq -r '[.runs[0].tool.driver.rules[]?.properties.article_ref // empty] | unique | join(",")' "$SARIF")
    DISCLAIMER=$(jq -r '.runs[0].properties.disclaimer // empty' "$SARIF")

    echo "pack_applied=$PACK_APPLIED" >> $GITHUB_OUTPUT
    echo "pack_score=$PACK_SCORE" >> $GITHUB_OUTPUT
    echo "pack_articles=$PACK_ARTICLES" >> $GITHUB_OUTPUT

    # Store disclaimer for Job Summary
    if [ -n "$DISCLAIMER" ]; then
      echo "pack_disclaimer<<EOF" >> $GITHUB_OUTPUT
      echo "$DISCLAIMER" >> $GITHUB_OUTPUT
      echo "EOF" >> $GITHUB_OUTPUT
    fi

- name: Write Job Summary
  shell: bash
  run: |
    {
      echo "## Compliance Pack Results"
      echo ""
      echo "| Pack | Version | Score | Articles |"
      echo "|------|---------|-------|----------|"
      echo "| $PACK_APPLIED | 1.0.0 | ${PACK_SCORE}% | $PACK_ARTICLES |"

      # MANDATORY: Display disclaimer if present
      if [ -n "$DISCLAIMER" ]; then
        echo ""
        echo "> ⚠️ **Disclaimer**: $DISCLAIMER"
      fi
    } >> $GITHUB_STEP_SUMMARY

# In calling workflow, add concurrency group to prevent parallel writes
concurrency:
  group: assay-evidence-${{ github.ref }}
  cancel-in-progress: false  # Don't cancel in-progress evidence push

# AWS OIDC
- name: Configure AWS credentials (OIDC)
  if: inputs.store != '' && inputs.store_provider == 'aws'
  uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
  with:
    role-to-assume: ${{ inputs.store_role }}
    aws-region: ${{ inputs.store_region || 'us-east-1' }}

# GCP OIDC
- name: Configure GCP credentials (OIDC)
  if: inputs.store != '' && inputs.store_provider == 'gcp'
  uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
  with:
    workload_identity_provider: ${{ inputs.store_role }}

# Azure OIDC
- name: Configure Azure credentials (OIDC)
  if: inputs.store != '' && inputs.store_provider == 'azure'
  uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
  with:
    client-id: ${{ inputs.azure_client_id }}
    tenant-id: ${{ inputs.azure_tenant_id }}
    subscription-id: ${{ inputs.azure_subscription_id }}

- name: Push evidence to BYOS
  if: |
    inputs.store != '' &&
    github.event_name == 'push' &&
    github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
    steps.process.outputs.verified == 'true'
  shell: bash
  run: |
    for bundle in $BUNDLES; do
      URL=$(assay evidence push "$bundle" --store "${{ inputs.store }}" --json | jq -r '.url')
      echo "Pushed: $URL"
    done
    echo "bundle_url=$URL" >> $GITHUB_OUTPUT

- name: Generate artifact attestation
  id: attest
  if: |
    inputs.attest == 'true' &&
    github.event_name == 'push' &&
    github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
    steps.process.outputs.verified == 'true'
  uses: actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v3.0.0
  with:
    subject-path: ${{ steps.process.outputs.reports_dir }}/*.tar.gz

- name: Export attestation outputs
  if: steps.attest.outcome == 'success'
  shell: bash
  run: |
    echo "attestation_id=${{ steps.attest.outputs.attestation-id }}" >> $GITHUB_OUTPUT
    echo "attestation_url=${{ steps.attest.outputs.attestation-url }}" >> $GITHUB_OUTPUT

- name: Update coverage badge
  if: |
    inputs.badge_gist != '' &&
    github.event_name == 'push' &&
    github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
  uses: schneegans/dynamic-badges-action@e9a478b16159b4d31420099ba146cdc50f134483 # v1.7.0
  with:
    auth: ${{ secrets.GIST_TOKEN }}
    gistID: ${{ inputs.badge_gist }}
    filename: assay-coverage.json
    label: Evidence Coverage
    message: ${{ steps.process.outputs.coverage_percent }}%
    valColorRange: ${{ steps.process.outputs.coverage_percent }}
    maxColorRange: 100
    minColorRange: 0

# Verified and pinned (Jan 2026)
actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
github/codeql-action/upload-sarif@b20883b0cd1f46c72ae0ba6d1090936928f9fa30 # v4.32.0
actions/attest-build-provenance@1c608d11d69870c2092266b3f9a6f3abbf17002c # v3.0.0
aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7
schneegans/dynamic-badges-action@e9a478b16159b4d31420099ba146cdc50f134483 # v1.7.0
peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0

- name: Validate store configuration
  if: inputs.store != ''
  shell: bash
  run: |
    STORE="${{ inputs.store }}"
    PROVIDER="${{ inputs.store_provider }}"
    ROLE="${{ inputs.store_role }}"

    # Auto-detect provider if not set
    if [ "$PROVIDER" = "auto" ]; then
      case "$STORE" in
        s3://*) PROVIDER="aws" ;;
        gs://*) PROVIDER="gcp" ;;
        az://*|https://*.blob.core.windows.net/*) PROVIDER="azure" ;;
        *)
          echo "::error::Unknown store URL scheme. Set store_provider explicitly."
          exit 1
          ;;
      esac
    fi

    # Require store_role for OIDC providers
    if [ "$PROVIDER" = "aws" ] || [ "$PROVIDER" = "gcp" ]; then
      if [ -z "$ROLE" ]; then
        echo "::error::store_role is required for $PROVIDER OIDC authentication."
        echo "::error::AWS: arn:aws:iam::ACCOUNT:role/ROLE"
        echo "::error::GCP: projects/PROJECT/locations/global/workloadIdentityPools/POOL/providers/PROVIDER"
        exit 1
      fi
    fi

    echo "provider=$PROVIDER" >> $GITHUB_OUTPUT