This document describes the GitHub Actions-based CI/CD pipeline that automates building, testing, security scanning, attestation generation, and publication of Firestack artifacts. The pipeline implements a comprehensive secure software supply chain with SLSA Level 3 provenance, SBOM generation, and multi-repository publication (GitHub Packages, Maven Central, and Jitpack).
For information about the underlying build system (make-aar, gomobile, xgo), see 1.1 Build System and Deployment
The CI/CD pipeline consists of several interconnected workflows that orchestrate the lifecycle from code commit to artifact distribution.
Title: Firestack CI/CD Data Flow
Sources: .github/workflows/go.yml1-12 .github/workflows/provenance.yml1-92 .github/workflows/publish.yml1-81
The primary workflow is defined in .github/workflows/go.yml1-150 and named AAARRR. It triggers on pushes and pull requests to the n2 branch that modify *.go files .github/workflows/go.yml3-11 or via manual workflow_dispatch .github/workflows/go.yml12
The build job orchestrates compilation, testing, SBOM generation, and security scanning:
Title: Build Job Component Interaction
Key implementation details:
| Step | Purpose | Details |
|---|---|---|
| Make .github/workflows/go.yml45-55 | Build artifacts | Invokes ./make-aar nogo debug to produce AAR files; triggers Jitpack build via API .github/workflows/go.yml51-54 |
| Upload .github/workflows/go.yml68-80 | Store artifacts | Uploads to GitHub Actions with 52-day retention, max compression .github/workflows/go.yml77-79 |
| SBOM .github/workflows/go.yml83-110 | Generate SBOM | Uses Microsoft sbom-tool to create SPDX 2.2 manifest at _manifest/spdx_2.2/ .github/workflows/go.yml91-100 |
| Obj .github/workflows/go.yml111-150 | Binary analysis | Analyzes AAR contents, performs symbol restoration with eu-unstrip, and checks for NT_GNU_BUILD_ID .github/workflows/go.yml142-149 |
Sources: .github/workflows/go.yml16-150 make-aar1-107
The repository employs a multi-layered security scanning approach to ensure supply chain integrity and code safety.
The pipeline integrates Google's OSV (Open Source Vulnerabilities) scanner and GitHub's native tools:
advanced-security/cbom-action to analyze cryptographic dependencies and usage across the repository .github/workflows/xbom.yaml1-51 This workflow builds an analysis matrix and runs language-specific scans .github/workflows/xbom.yaml9-42build job has security-events: write permissions for uploading results .github/workflows/go.yml24Sources: .github/workflows/go.yml24-110 .github/workflows/scorecard.yml1-73 .github/workflows/xbom.yaml1-51
The attestation workflow .github/workflows/provenance.yml1-92 generates cryptographic attestations linking artifacts to their build process.
Title: Build Provenance Generation
actions/attest-build-provenance to create a SLSA v1.0 predicate linking the artifact name and digest to the GitHub Actions run identity .github/workflows/provenance.yml41-44actions/attest-sbom to bind the generated SPDX manifest to the artifact digests after verifying the manifest's integrity via SHA256 .github/workflows/provenance.yml81-91Sources: .github/workflows/provenance.yml1-92
The publication workflow .github/workflows/publish.yml1-148 (partial) and supporting scripts distribute artifacts to multiple targets.
Before any upload, the workflow can verify:
gh attestation verify "$file" -R "$REPO" .github/workflows/publish.yml167| Target | Mechanism | Implementation |
|---|---|---|
| GitHub Packages | Maven Deploy | Workflow identifies owner via github.repository_owner .github/workflows/publish.yml42 |
| Maven Central | OSSRH | Configured via ossrhpom.xml .ossrhpom.xml1-60 Targets Sonatype staging API .ossrhpom.xml57 |
| Jitpack | Custom Build | Jitpack builds are triggered via API .github/workflows/go.yml51 Local installation uses mvn-install .mvn-install19-25 |
Sources: .github/workflows/publish.yml1-148 .github/workflows/go.yml51 .mvn-install1-38 .jitpack.yml1-33 .ossrhpom.xml1-60
ubuntu-latest and sets up Go via go.mod .github/workflows/go.yml18-42Refresh this wiki