name: Pre submits e2e
on:
  pull_request:
    branches: ["main"]
  workflow_dispatch:

permissions: read-all

jobs:
  pre-submit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          path: __THIS_REPO__

      - name: setup-go
        uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
        with:
          go-version-file: "__THIS_REPO__/go.mod"
          # not needed but gets rid of warnings
          cache: false

      - name: Build verifier at HEAD
        working-directory: __THIS_REPO__
        run: |
          set -euo pipefail
          go build -o slsa-verifier ./cli/slsa-verifier

      - name: Checkout e2e verification script
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          path: __EXAMPLE_PACKAGE__
          repository: slsa-framework/example-package

      - name: Run verification script with testdata and slsa-verifier HEAD
        env:
          SLSA_VERIFIER_TESTING: "true"
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Necessary to use the gh CLI.
        run: ./__THIS_REPO__/.github/workflows/scripts/e2e-cli.sh