🐛 Retrieve branch on release triggers (#89) (#146)

* updates

* unit test

* fixes

* updates

* typo

* unit test

Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>

main_test.go

@@ -226,7 +226,7 @@ func Test_runVerify(t *testing.T) {
 			pversiontag: pString("v0"),
 			err:         pkg.ErrorMismatchVersionedTag,
 		},
-		// Provenance contains tag = v14.2. )2.5
+		// Provenance contains tag = v14.2
 		{
 			name:        "versioned v14.2 match push-v14.2",
 			artifact:    "binary-linux-amd64-push-v14.2",

pkg/provenance.go

@@ -625,6 +625,20 @@ func getAsString(environment map[string]interface{}, field string) (string, erro
 	return i, nil
 }
 
+func getEventPayload(environment map[string]interface{}) (map[string]interface{}, error) {
+	eventPayload, ok := environment["github_event_payload"]
+	if !ok {
+		return nil, fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type event payload")
+	}
+
+	payload, ok := eventPayload.(map[string]interface{})
+	if !ok {
+		return nil, fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type payload")
+	}
+
+	return payload, nil
+}
+
 func getBaseRef(environment map[string]interface{}) (string, error) {
 	baseRef, err := getAsString(environment, "github_base_ref")
 	if err != nil {
@@ -638,7 +652,7 @@ func getBaseRef(environment map[string]interface{}) (string, error) {
 
 	// Look at the event payload instead.
 	// We don't do that for all triggers because the payload
-	// is event-specific; and only the `push` event seems to have a `base_ref``.
+	// is event-specific; and only the `push` event seems to have a `base_ref`.
 	eventName, err := getAsString(environment, "github_event_name")
 	if err != nil {
 		return "", err
@@ -648,19 +662,59 @@ func getBaseRef(environment map[string]interface{}) (string, error) {
 		return "", nil
 	}
 
-	eventPayload, ok := environment["github_event_payload"]
-	if !ok {
-		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type event payload")
-	}
-
-	payload, ok := eventPayload.(map[string]interface{})
-	if !ok {
-		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type payload")
+	payload, err := getEventPayload(environment)
+	if err != nil {
+		return "", err
 	}
 
 	return getAsString(payload, "base_ref")
 }
 
+func getTargetCommittish(environment map[string]interface{}) (string, error) {
+	eventName, err := getAsString(environment, "github_event_name")
+	if err != nil {
+		return "", err
+	}
+
+	if eventName != "release" {
+		return "", nil
+	}
+
+	payload, err := getEventPayload(environment)
+	if err != nil {
+		return "", err
+	}
+
+	// For a release event, we look for release.target_commitish.
+	releasePayload, ok := payload["release"]
+	if !ok {
+		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "release absent from payload")
+	}
+
+	release, ok := releasePayload.(map[string]interface{})
+	if !ok {
+		return "", fmt.Errorf("%w: %s", ErrorInvalidDssePayload, "parameters type releasePayload")
+	}
+
+	branch, err := getAsString(release, "target_commitish")
+	if err != nil {
+		return "", fmt.Errorf("%w: %s", err, "target_commitish not present")
+	}
+
+	return "refs/heads/" + branch, nil
+}
+
+func getBranchForTag(environment map[string]interface{}) (string, error) {
+	// First try the base_ref.
+	branch, err := getBaseRef(environment)
+	if branch != "" || err != nil {
+		return branch, err
+	}
+
+	// Second try the target comittish.
+	return getTargetCommittish(environment)
+}
+
 // Get tag from the provenance invocation parameters.
 func getTag(env *dsselib.Envelope) (string, error) {
 	pyld, err := base64.StdEncoding.DecodeString(env.Payload)
@@ -720,7 +774,7 @@ func getBranch(env *dsselib.Envelope) (string, error) {
 	case "branch":
 		return getAsString(environment, "github_ref")
 	case "tag":
-		return getBaseRef(environment)
+		return getBranchForTag(environment)
 	default:
 		return "", fmt.Errorf("%w: %s %s", ErrorInvalidDssePayload,
 			"unknown ref type", refType)

pkg/provenance_test.go

@@ -353,10 +353,15 @@ func Test_VerifyBranch(t *testing.T) {
 			expected: ErrorInvalidDssePayload,
 		},
 		{
-			name:   "tag branch2",
+			name:   "tag branch2 push trigger",
 			path:   "./testdata/dsse-branch2-tag.intoto.jsonl",
 			branch: "branch2",
 		},
+		{
+			name:   "v10.0.1 release trigger",
+			path:   "./testdata/dsse-v10.0.1-release.intoto.jsonl",
+			branch: "main",
+		},
 	}
 	for _, tt := range tests {
 		tt := tt // Re-initializing variable so it is not changed while executing the closure below