72 lines
2.5 KiB
Bash
Executable File
72 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
set -euo pipefail
|
|
|
|
repo_root=$(CDPATH= cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
|
|
cd "$repo_root"
|
|
|
|
usage() {
|
|
printf 'Usage: scripts/native-gate.sh --repository OWNER/REPOSITORY --go-version goX.Y.Z --runner-version VERSION --runner-name NAME --output DIR\n' >&2
|
|
}
|
|
|
|
repository=''
|
|
expected_go=''
|
|
runner_version=''
|
|
runner_name=''
|
|
output=''
|
|
while (( $# > 0 )); do
|
|
case "$1" in
|
|
--repository) repository=$2; shift 2 ;;
|
|
--go-version) expected_go=$2; shift 2 ;;
|
|
--runner-version) runner_version=$2; shift 2 ;;
|
|
--runner-name) runner_name=$2; shift 2 ;;
|
|
--output) output=$2; shift 2 ;;
|
|
*) usage; exit 2 ;;
|
|
esac
|
|
done
|
|
if [[ ! "$repository" =~ ^[a-z0-9][a-z0-9._-]*/[a-z0-9][a-z0-9._-]*$ || -z "$expected_go" || -z "$runner_version" || -z "$runner_name" || -z "$output" ]]; then
|
|
usage
|
|
exit 2
|
|
fi
|
|
if [[ "$(go env GOVERSION)" != "$expected_go" ]]; then
|
|
printf 'error: expected %s, found %s\n' "$expected_go" "$(go env GOVERSION)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p -- "$output"
|
|
./scripts/check-licenses.sh
|
|
./scripts/test-public-snapshot.sh
|
|
HIMESAN_RACE=1 ./scripts/verify.sh
|
|
go test ./internal/compiler -run '^$' -fuzz '^FuzzCompileNeverPanics$' -fuzztime=15s
|
|
go test ./internal/compiler -run '^$' -fuzz '^FuzzGoDelimiterNeverPanics$' -fuzztime=15s
|
|
go test ./internal/lsp -run '^$' -fuzz '^FuzzFrameReaderNeverPanics$' -fuzztime=15s
|
|
go test ./internal/lsp -run '^$' -fuzz '^FuzzDocumentPositionNeverPanics$' -fuzztime=15s
|
|
(
|
|
cd sando
|
|
go test -run '^$' -fuzz '^FuzzWriteURLPolicy$' -fuzztime=15s
|
|
)
|
|
go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
|
|
(
|
|
cd sando
|
|
go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
|
|
)
|
|
./scripts/verify-consumer.sh
|
|
|
|
./scripts/package-native.sh --version v0.0.0-verification.1 --output "$output"
|
|
artifact=$(find "$output" -maxdepth 1 -type f -name '*.tar.gz' -print -quit)
|
|
artifact_sha=$(awk '{print $1}' "$artifact.sha256")
|
|
completed_at=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
|
|
go run ./cmd/himesan-release receipt \
|
|
--output "$output/TEND-CI-VERIFICATION.json" \
|
|
--repository "$repository" \
|
|
--commit "$(git rev-parse HEAD)" \
|
|
--tree "$(git rev-parse 'HEAD^{tree}')" \
|
|
--goos "$(go env GOOS)" --goarch "$(go env GOARCH)" \
|
|
--go-version "$expected_go" --runner-version "$runner_version" \
|
|
--runner-name "$runner_name" --artifact-sha256 "$artifact_sha" \
|
|
--completed-at "$completed_at" \
|
|
--gates test,vet,build,race,generation,contracts,public-snapshot,fuzz,vulnerability,consumer,package \
|
|
--generated-files internal/compiler/testdata/golden/basic.sando.go
|
|
printf 'Native verification evidence: %s\n' "$output"
|