Add end-to-end tests to sign & verify

[Hayden-IO]

We also need to add a GitHub Action to run tests on PR submission.

[laurentsimon]

@woodruffw @di we want to implement e2e signing / verification for our pre-submit tests. Could you point us to how you set this up for sigstore-python? I recall you're pre-generating OIDC tokens every 15mn or so?

[woodruffw]

@woodruffw @di we want to implement e2e signing / verification for our pre-submit tests. Could you point us to how you set this up for sigstore-python? I recall you're pre-generating OIDC tokens every 15mn or so?

If I'm understanding correctly, I think this is what you want: https://github.com/sigstore-conformance/extremely-dangerous-public-oidc-beacon

That repository has a repeating workflow that continuously leaks an OIDC credential solely for testing purposes, both as a workflow artifact and as a GitHub pages asset here: https://sigstore-conformance.github.io/extremely-dangerous-public-oidc-beacon/oidc-token.txt. You should be able to point any HTTP client at that URL, pull the token, and go from there 🙂

Does that cover your testing use case?

[laurentsimon]

Thanks @woodruffw yes that should cover our use case. Exactly what I was looking for!

[woodruffw]

No problem, happy to help!

[mihaimaruseac]

Also to consider when doing end-to-end testing: #190 (comment)