conformance.yml

name: Conformance Tests

on:
  push:
    branches:
      - main
  workflow_dispatch:
  pull_request:
  schedule:
    - cron: "45 7 * * 1,4"

permissions: {}

jobs:
  conformance:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
        with:
          python-version: "3.x"
          cache: "pip"
          cache-dependency-path: pyproject.toml

      - name: install sigstore-python
        run: python -m pip install .

      - uses: sigstore/sigstore-conformance@b7856cfca56fe3f957d4cefdc2c359cc36a84e14 # v0.0.24
        with:
          entrypoint: ${{ github.workspace }}/test/integration/sigstore-python-conformance
          xfail: "test_verify*intoto-with-custom-trust-root]" # see issue 1442

  file-issue-on-failure:
    needs: [conformance]
    if: failure() && github.event_name == 'schedule' && github.repository == 'sigstore/sigstore-python'
    permissions:
      issues: write # required to file an issue
    runs-on: ubuntu-latest
    steps:
      - name: File an issue for conformance test failure
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `[CI] Scheduled conformance test failed`,
              body: `
            A scheduled conformance test failed, see [run details](${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}).
            `
            });