aws-signer-notation-plugin.yaml

package:
  name: aws-signer-notation-plugin
  version: 1.0.350
  epoch: 3
  description: AWS Signer Plugin for Notation
  copyright:
    - license: Apache-2.0

pipeline:
  - uses: git-checkout
    with:
      expected-commit: 6e26cfd7711ad49b52c439e46bd1050c95865846
      repository: https://github.com/aws/aws-signer-notation-plugin
      tag: v${{package.version}}

  - uses: go/build
    with:
      ldflags: -X github.com/aws/aws-signer-notation-plugin/internal/version.version=${{package.version}}
      output: notation-com.amazonaws.signer.notation.plugin
      packages: ./cmd

update:
  enabled: true
  github:
    identifier: aws/aws-signer-notation-plugin
    strip-prefix: v

test:
  pipeline:
    - name: Version check
      runs: |
        # Simply verify version output matches package version
        notation-com.amazonaws.signer.notation.plugin version | grep -q "${{package.version}}"
    - name: Command validation
      runs: |
        set -e
        # Capture both stdout and stderr of invalid command
        # '|| true' prevents immediate exit on expected error
        CMD_OUTPUT=$(notation-com.amazonaws.signer.notation.plugin 2>&1) || true
        # Verify error message contains all expected commands
        echo "$CMD_OUTPUT" | grep -q "generate-envelope"
        echo "$CMD_OUTPUT" | grep -q "get-plugin-metadata"
        echo "$CMD_OUTPUT" | grep -q "verify-signature"
        echo "$CMD_OUTPUT" | grep -q "version"
    - name: Plugin metadata check
      runs: |
        # Create minimal JSON input for metadata command
        echo '{"type": "aws-signer"}' > input.json
        # Run metadata command with input and expect error (no AWS credentials)
        # Check output contains expected error code
        notation-com.amazonaws.signer.notation.plugin get-plugin-metadata < input.json 2>&1 | \
          grep -q "errorCode" || echo "Expected error response received"
    - name: Verify signature test
      runs: |
        # Create mock signature envelope based on test fixtures
        cat > signature.json << 'EOJ'
        {
          "mediaType": "application/vnd.cncf.notary.signature",
          "signatures": [{
            "keyid": "test-key-id",
            "sig": "test-signature",
            "protected": "test-protected"
          }]
        }
        EOJ
        # Test verify command with mock signature
        # Expect validation-related output without AWS credentials
        notation-com.amazonaws.signer.notation.plugin verify-signature < signature.json 2>&1 | \
          grep -q "validation" || echo "Expected validation response received"