leaves_pr.yaml

on: [pull_request]

jobs:
  leaf_validator_job:
    runs-on: ubuntu-latest
    name: Validate pending leaves
    steps:

    - uses: actions/checkout@v1
      with:
         fetch-depth: 0

    - name: Leaf validator step
      id: leaf_validator
      uses: transparency-dev/serverless-log/deploy/github/log/leaf_validator@main
      with:
        log_dir: './log'

    - name: Install golang
      run: |
        cd /tmp
        wget https://golang.org/dl/go1.17.1.linux-amd64.tar.gz
        tar xvf go1.17.1.linux-amd64.tar.gz

    - name: Compile verify_release tool
      run: |
        /tmp/go/bin/go build -o /tmp/verify_release ${GITHUB_WORKSPACE}/cmd/verify_release

    - name: Signature validator step
      id: signature_validator
      run: ${GITHUB_WORKSPACE}/.github/workflows/signature_validation.sh
      env:
        # the actions triggered by a pull_request event do not have access to GH secrets,
        # therefore we embed the public key here. This should match keys/armory-drive-test.pub
        FR_PUBKEY: armory-drive+5a95a41b+Abfbe1W4+bZB//VfIXxds+SWldvUKRFxKHIy2fyg5nBO