stow_types/
trusted_builder.rs

1//! Identity of the one GitHub Actions workflow whose signatures the CLI
2//! trusts.
3//!
4//! The scheduler dispatches builds to exactly this workflow on exactly this
5//! ref, and the CLI accepts a Fulcio certificate only when its subject is the
6//! URL these pieces compose to. Spelling each piece once keeps the two ends
7//! from drifting apart.
8
9/// `concat!` needs literals, hence the macros.
10macro_rules! repository {
11    () => {
12        "water-rs/stow"
13    };
14}
15macro_rules! workflow_file {
16    () => {
17        "build-crate.yml"
18    };
19}
20macro_rules! index_workflow_file {
21    () => {
22        "index-publish.yml"
23    };
24}
25macro_rules! branch {
26    () => {
27        "main"
28    };
29}
30
31/// GitHub repository (`owner/name`) that hosts the trusted build workflow.
32pub const REPOSITORY: &str = repository!();
33/// Workflow file under `.github/workflows/` that performs trusted builds.
34pub const WORKFLOW_FILE: &str = workflow_file!();
35/// Branch the trusted workflow runs from. `workflow_dispatch` takes the bare
36/// branch name; the certificate subject carries the full ref.
37pub const BRANCH: &str = branch!();
38/// Subject Alternative Name Fulcio issues to the trusted workflow.
39pub const CERTIFICATE_IDENTITY: &str = concat!(
40    "https://github.com/",
41    repository!(),
42    "/.github/workflows/",
43    workflow_file!(),
44    "@refs/heads/",
45    branch!()
46);
47/// OIDC issuer of GitHub Actions job tokens.
48pub const CERTIFICATE_ISSUER: &str = "https://token.actions.githubusercontent.com";
49
50/// Workflow file under `.github/workflows/` that publishes and signs the
51/// artifact indexes.
52pub const INDEX_WORKFLOW_FILE: &str = index_workflow_file!();
53/// Subject Alternative Name Fulcio issues to the index-publish workflow.
54///
55/// The certificate identity under which published artifact indexes are
56/// signed, composed exactly like [`CERTIFICATE_IDENTITY`]: same
57/// repository, same `main` branch, the index workflow file.
58pub const INDEX_CERTIFICATE_IDENTITY: &str = concat!(
59    "https://github.com/",
60    repository!(),
61    "/.github/workflows/",
62    index_workflow_file!(),
63    "@refs/heads/",
64    branch!()
65);
66
67#[cfg(test)]
68mod tests {
69    use super::{CERTIFICATE_IDENTITY, INDEX_CERTIFICATE_IDENTITY};
70
71    #[test]
72    fn certificate_identity_composes_repository_workflow_and_ref() {
73        assert_eq!(
74            CERTIFICATE_IDENTITY,
75            "https://github.com/water-rs/stow/.github/workflows/build-crate.yml@refs/heads/main"
76        );
77    }
78
79    #[test]
80    fn index_certificate_identity_composes_repository_workflow_and_ref() {
81        assert_eq!(
82            INDEX_CERTIFICATE_IDENTITY,
83            "https://github.com/water-rs/stow/.github/workflows/index-publish.yml@refs/heads/main"
84        );
85    }
86}
stow_types/trusted_builder.rs

stow_types/
trusted_builder.rs
